mirror of
https://github.com/anchore/syft.git
synced 2026-11-01 06:56:40 +01:00
Rajan Agaskar
ae0683074e
- Resolves #2974 - add detailed instructions re: updating schemas (a necessary task when a new CycloneDX spec version becomes available). - The DefaultVersion constant has been updated to "1.6" -- it's not clear to me how this is used at this time (it may be redundant given other code), but effectively unless a specific spec version is configured, `syft` will emit the "most recent" spec version available for cyclonedx. Users who wish to pin back to a "older" specVersion (e.g. to preserve compatibilty with utilities that have not yet bumped to latest) can either set this in a syft config file or pass a name@spec_version pair to the output flag (e.g. `-o cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`) - Regenerate relevant .golden files (there seems to be a way to do this via flags, but I couldn't quite figure out the right set to pass correctly, esp. since (as a relative go novice) I found it difficult to run just a single test file. I ended up "brute-forcing it" by changing the *updateSnapshot val to "true" and running it in Goland. A brief comment giving an example of regenerating fixtures usage would be helpful. Signed-off-by: Rajan Agaskar <ragaskar@gmail.com>
134 lines
2.9 KiB
Plaintext
134 lines
2.9 KiB
Plaintext
{
|
|
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
|
|
"bomFormat": "CycloneDX",
|
|
"specVersion": "1.6",
|
|
"serialNumber": "urn:uuid:redacted",
|
|
"version": 1,
|
|
"metadata": {
|
|
"timestamp": "timestamp:redacted",
|
|
"tools": {
|
|
"components": [
|
|
{
|
|
"type": "application",
|
|
"author": "anchore",
|
|
"name": "syft",
|
|
"version": "v0.42.0-bogus"
|
|
}
|
|
]
|
|
},
|
|
"component": {
|
|
"bom-ref":"redacted",
|
|
"type": "container",
|
|
"name": "user-image-input",
|
|
"version": "sha256:redacted"
|
|
}
|
|
},
|
|
"components": [
|
|
{
|
|
"bom-ref":"redacted",
|
|
"type": "library",
|
|
"name": "package-1",
|
|
"version": "1.0.1",
|
|
"licenses": [
|
|
{
|
|
"license": {
|
|
"id": "MIT"
|
|
}
|
|
}
|
|
],
|
|
"cpe": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
|
|
"purl": "a-purl-1",
|
|
"properties": [
|
|
{
|
|
"name": "syft:package:foundBy",
|
|
"value": "the-cataloger-1"
|
|
},
|
|
{
|
|
"name": "syft:package:language",
|
|
"value": "python"
|
|
},
|
|
{
|
|
"name": "syft:package:type",
|
|
"value": "python"
|
|
},
|
|
{
|
|
"name": "syft:package:metadataType",
|
|
"value": "python-package"
|
|
},
|
|
{
|
|
"name": "syft:location:0:layerID",
|
|
"value": "sha256:redacted"
|
|
},
|
|
{
|
|
"name": "syft:location:0:path",
|
|
"value": "/somefile-1.txt"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"bom-ref":"redacted",
|
|
"type": "library",
|
|
"name": "package-2",
|
|
"version": "2.0.1",
|
|
"cpe": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
|
|
"purl": "pkg:deb/debian/package-2@2.0.1",
|
|
"properties": [
|
|
{
|
|
"name": "syft:package:foundBy",
|
|
"value": "the-cataloger-2"
|
|
},
|
|
{
|
|
"name": "syft:package:type",
|
|
"value": "deb"
|
|
},
|
|
{
|
|
"name": "syft:package:metadataType",
|
|
"value": "dpkg-db-entry"
|
|
},
|
|
{
|
|
"name": "syft:location:0:layerID",
|
|
"value": "sha256:redacted"
|
|
},
|
|
{
|
|
"name": "syft:location:0:path",
|
|
"value": "/somefile-2.txt"
|
|
},
|
|
{
|
|
"name": "syft:metadata:installedSize",
|
|
"value": "0"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"bom-ref":"redacted",
|
|
"type": "operating-system",
|
|
"name": "debian",
|
|
"version": "1.2.3",
|
|
"description": "debian",
|
|
"swid": {
|
|
"tagId": "debian",
|
|
"name": "debian",
|
|
"version": "1.2.3"
|
|
},
|
|
"properties": [
|
|
{
|
|
"name": "syft:distro:id",
|
|
"value": "debian"
|
|
},
|
|
{
|
|
"name": "syft:distro:idLike:0",
|
|
"value": "like!"
|
|
},
|
|
{
|
|
"name": "syft:distro:prettyName",
|
|
"value": "debian"
|
|
},
|
|
{
|
|
"name": "syft:distro:versionID",
|
|
"value": "1.2.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|