oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-04 08:26:38 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: update syft to generate cyclone-dx 1.6 by default (#2978)

Browse Source 
- Resolves #2974
- add detailed instructions re: updating schemas (a necessary task
  when a new CycloneDX spec version becomes available).
- The DefaultVersion constant has been updated to "1.6" -- it's not
  clear to me how this is used at this time (it may be redundant given
  other code), but effectively unless a specific spec version is
  configured, `syft` will emit the "most recent" spec version available
  for cyclonedx. Users who wish to pin back to a "older" specVersion
  (e.g. to preserve compatibilty with utilities that have not yet bumped
  to latest) can either set this in a syft config file or pass a
  name@spec_version pair to the output flag (e.g. `-o
  cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`)
- Regenerate relevant .golden files (there seems to be a way to do this
  via flags, but I couldn't quite figure out the right set to pass
  correctly, esp. since (as a relative go novice) I found it difficult
  to run just a single test file. I ended up "brute-forcing it" by
  changing the *updateSnapshot val to "true" and running it in Goland.
  A brief comment giving an example of regenerating fixtures usage would
  be helpful.

Signed-off-by: Rajan Agaskar <ragaskar@gmail.com>
This commit is contained in:
Rajan Agaskar
2024-06-21 08:51:27 -07:00
committed by GitHub
parent 9b178174a7
commit ae0683074e
13 changed files with 5289 additions and 330 deletions
Download Patch File Download Diff File Expand all files Collapse all files
schema/cyclonedx/spdx.xsd
+126 -1
View File
@@ -2,7 +2,7 @@
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified"
targetNamespace="http://cyclonedx.org/schema/spdx"
version="1.0-3.23">
version="1.0-3.24.0">
<xs:simpleType name="licenseId">
<xs:restriction base="xs:string">
@@ -12,6 +12,11 @@
<xs:documentation>BSD Zero Clause License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="3D-Slicer-1.0">
<xs:annotation>
<xs:documentation>3D Slicer License v1.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="AAL">
<xs:annotation>
<xs:documentation>Attribution Assurance License</xs:documentation>
@@ -117,6 +122,11 @@
<xs:documentation>Aladdin Free Public License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="AMD-newlib">
<xs:annotation>
<xs:documentation>AMD newlib License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="AMDPLPA">
<xs:annotation>
<xs:documentation>AMD&apos;s plpa_map.c License</xs:documentation>
@@ -147,6 +157,11 @@
<xs:documentation>ANTLR Software Rights Notice with license fallback</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="any-OSI">
<xs:annotation>
<xs:documentation>Any OSI License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Apache-1.0">
<xs:annotation>
<xs:documentation>Apache License 1.0</xs:documentation>
@@ -322,6 +337,11 @@
<xs:documentation>BSD 2-Clause - Ian Darwin variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="BSD-2-Clause-first-lines">
<xs:annotation>
<xs:documentation>BSD 2-Clause - first lines requirement</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="BSD-2-Clause-FreeBSD">
<xs:annotation>
<xs:documentation>BSD 2-Clause FreeBSD License</xs:documentation>
@@ -522,6 +542,11 @@
<xs:documentation>Caldera License (without preamble)</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Catharon">
<xs:annotation>
<xs:documentation>Catharon License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="CATOSL-1.1">
<xs:annotation>
<xs:documentation>Computer Associates Trusted Open Source License 1.1</xs:documentation>
@@ -1002,6 +1027,11 @@
<xs:documentation>curl License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="cve-tou">
<xs:annotation>
<xs:documentation>Common Vulnerability Enumeration ToU License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="D-FSL-1.0">
<xs:annotation>
<xs:documentation>Deutsche Freie Software Lizenz</xs:documentation>
@@ -1482,6 +1512,11 @@
<xs:documentation>gtkbook License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Gutmann">
<xs:annotation>
<xs:documentation>Gutmann License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HaskellReport">
<xs:annotation>
<xs:documentation>Haskell Language Report License</xs:documentation>
@@ -1532,11 +1567,21 @@
<xs:documentation>HPND with US Government export control warning</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-export-US-acknowledgement">
<xs:annotation>
<xs:documentation>HPND with US Government export control warning and acknowledgment</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-export-US-modify">
<xs:annotation>
<xs:documentation>HPND with US Government export control warning and modification rqmt</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-export2-US">
<xs:annotation>
<xs:documentation>HPND with US Government export control and 2 disclaimers</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-Fenneberg-Livingston">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant</xs:documentation>
@@ -1547,6 +1592,11 @@
<xs:documentation>Historical Permission Notice and Disclaimer - INRIA-IMAG variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-Intel">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - Intel variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-Kevlin-Henney">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - Kevlin Henney variant</xs:documentation>
@@ -1557,6 +1607,11 @@
<xs:documentation>Historical Permission Notice and Disclaimer - Markus Kuhn variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-merchantability-variant">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - merchantability variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-MIT-disclaimer">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer with MIT disclaimer</xs:documentation>
@@ -1587,11 +1642,21 @@
<xs:documentation>HPND sell variant with MIT disclaimer</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-sell-variant-MIT-disclaimer-rev">
<xs:annotation>
<xs:documentation>HPND sell variant with MIT disclaimer - reverse</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-UC">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - University of California variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HPND-UC-export-US">
<xs:annotation>
<xs:documentation>Historical Permission Notice and Disclaimer - University of California, US export warning</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="HTMLTIDY">
<xs:annotation>
<xs:documentation>HTML Tidy License</xs:documentation>
@@ -2027,6 +2092,11 @@
<xs:documentation>MIT Festival Variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="MIT-Khronos-old">
<xs:annotation>
<xs:documentation>MIT Khronos - old variant</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="MIT-Modern-Variant">
<xs:annotation>
<xs:documentation>MIT License Modern Variant</xs:documentation>
@@ -2162,11 +2232,21 @@
<xs:documentation>Net Boolean Public License v1</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="NCBI-PD">
<xs:annotation>
<xs:documentation>NCBI Public Domain Notice</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="NCGL-UK-2.0">
<xs:annotation>
<xs:documentation>Non-Commercial Government Licence</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="NCL">
<xs:annotation>
<xs:documentation>NCL Source Code License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="NCSA">
<xs:annotation>
<xs:documentation>University of Illinois/NCSA Open Source License</xs:documentation>
@@ -2282,6 +2362,11 @@
<xs:documentation>Open Use of Data Agreement v1.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="OAR">
<xs:annotation>
<xs:documentation>OAR License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="OCCT-PL">
<xs:annotation>
<xs:documentation>Open CASCADE Technology Public License</xs:documentation>
@@ -2562,6 +2647,11 @@
<xs:documentation>Pixar License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="pkgconf">
<xs:annotation>
<xs:documentation>pkgconf License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Plexus">
<xs:annotation>
<xs:documentation>Plexus Classworlds License</xs:documentation>
@@ -2587,6 +2677,11 @@
<xs:documentation>PostgreSQL License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="PPL">
<xs:annotation>
<xs:documentation>Peer Production License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="PSF-2.0">
<xs:annotation>
<xs:documentation>Python Software Foundation License 2.0</xs:documentation>
@@ -2862,6 +2957,11 @@
<xs:documentation>Sun PPP License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Sun-PPP-2000">
<xs:annotation>
<xs:documentation>Sun PPP License (2000)</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="SunPro">
<xs:annotation>
<xs:documentation>SunPro License</xs:documentation>
@@ -2907,6 +3007,11 @@
<xs:documentation>Transitive Grace Period Public Licence 1.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="threeparttable">
<xs:annotation>
<xs:documentation>threeparttable License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="TMate">
<xs:annotation>
<xs:documentation>TMate Open Source License</xs:documentation>
@@ -3132,6 +3237,11 @@
<xs:documentation>XSkat License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="xzoom">
<xs:annotation>
<xs:documentation>xzoom License</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="YPL-1.0">
<xs:annotation>
<xs:documentation>Yahoo! Public License v1.0</xs:documentation>
@@ -3203,6 +3313,11 @@
<xs:documentation>Asterisk exception</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Asterisk-linking-protocols-exception">
<xs:annotation>
<xs:documentation>Asterisk linking protocols exception</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="Autoconf-exception-2.0">
<xs:annotation>
<xs:documentation>Autoconf exception 2.0</xs:documentation>
@@ -3438,6 +3553,11 @@
<xs:documentation>OpenVPN OpenSSL Exception</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="PCRE2-exception">
<xs:annotation>
<xs:documentation>PCRE2 exception</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="PS-or-PDF-font-exception-20170817">
<xs:annotation>
<xs:documentation>PS/PDF font exception (2017-08-17)</xs:documentation>
@@ -3463,6 +3583,11 @@
<xs:documentation>Qwt exception 1.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="RRDtool-FLOSS-exception-2.0">
<xs:annotation>
<xs:documentation>RRDtool FLOSS exception 2.0</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="SANE-exception">
<xs:annotation>
<xs:documentation>SANE Exception</xs:documentation>