mirror of
https://github.com/anchore/syft.git
synced 2026-11-03 07:56:36 +01:00
Rajan Agaskar
ae0683074e
- Resolves #2974 - add detailed instructions re: updating schemas (a necessary task when a new CycloneDX spec version becomes available). - The DefaultVersion constant has been updated to "1.6" -- it's not clear to me how this is used at this time (it may be redundant given other code), but effectively unless a specific spec version is configured, `syft` will emit the "most recent" spec version available for cyclonedx. Users who wish to pin back to a "older" specVersion (e.g. to preserve compatibilty with utilities that have not yet bumped to latest) can either set this in a syft config file or pass a name@spec_version pair to the output flag (e.g. `-o cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`) - Regenerate relevant .golden files (there seems to be a way to do this via flags, but I couldn't quite figure out the right set to pass correctly, esp. since (as a relative go novice) I found it difficult to run just a single test file. I ended up "brute-forcing it" by changing the *updateSnapshot val to "true" and running it in Goland. A brief comment giving an example of regenerating fixtures usage would be helpful. Signed-off-by: Rajan Agaskar <ragaskar@gmail.com>
66 lines
2.5 KiB
XML
66 lines
2.5 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<bom xmlns="http://cyclonedx.org/schema/bom/1.6" serialNumber="redacted" version="1">
|
|
<metadata>
|
|
<timestamp>redacted</timestamp>
|
|
<tools>
|
|
<components>
|
|
<component type="application">
|
|
<author>anchore</author>
|
|
<name>syft</name>
|
|
<version>v0.42.0-bogus</version>
|
|
</component>
|
|
</components>
|
|
</tools>
|
|
<component bom-ref="redacted" type="container">
|
|
<name>user-image-input</name>
|
|
<version>sha256:redacted</version>
|
|
</component>
|
|
</metadata>
|
|
<components>
|
|
<component bom-ref="redacted" type="library">
|
|
<name>package-1</name>
|
|
<version>1.0.1</version>
|
|
<licenses>
|
|
<license>
|
|
<id>MIT</id>
|
|
</license>
|
|
</licenses>
|
|
<cpe>cpe:2.3:*:some:package:1:*:*:*:*:*:*:*</cpe>
|
|
<purl>a-purl-1</purl>
|
|
<properties>
|
|
<property name="syft:package:foundBy">the-cataloger-1</property>
|
|
<property name="syft:package:language">python</property>
|
|
<property name="syft:package:type">python</property>
|
|
<property name="syft:package:metadataType">python-package</property>
|
|
<property name="syft:location:0:layerID">sha256:redacted</property>
|
|
<property name="syft:location:0:path">/somefile-1.txt</property>
|
|
</properties>
|
|
</component>
|
|
<component bom-ref="redacted" type="library">
|
|
<name>package-2</name>
|
|
<version>2.0.1</version>
|
|
<cpe>cpe:2.3:*:some:package:2:*:*:*:*:*:*:*</cpe>
|
|
<purl>pkg:deb/debian/package-2@2.0.1</purl>
|
|
<properties>
|
|
<property name="syft:package:foundBy">the-cataloger-2</property>
|
|
<property name="syft:package:type">deb</property>
|
|
<property name="syft:package:metadataType">dpkg-db-entry</property>
|
|
<property name="syft:location:0:layerID">sha256:redacted</property>
|
|
<property name="syft:location:0:path">/somefile-2.txt</property>
|
|
<property name="syft:metadata:installedSize">0</property>
|
|
</properties>
|
|
</component>
|
|
<component bom-ref="redacted" type="operating-system">
|
|
<name>debian</name>
|
|
<version>1.2.3</version>
|
|
<description>debian</description>
|
|
<swid tagId="debian" name="debian" version="1.2.3"></swid>
|
|
<properties>
|
|
<property name="syft:distro:id">debian</property>
|
|
<property name="syft:distro:idLike:0">like!</property>
|
|
<property name="syft:distro:prettyName">debian</property>
|
|
<property name="syft:distro:versionID">1.2.3</property>
|
|
</properties>
|
|
</component>
|
|
</components>
|
|
</bom> |