CycloneDX 1.6 PoC

Cargo.toml

@@ -60,7 +60,6 @@ criterion = "0.5.1"
 csaf = { version = "0.5.0", default-features = false }
 csaf-walker = { version = "0.10.0", default-features = false }
 cve = "0.3.1"
-cyclonedx-bom = "0.8.0"
 env_logger = "0.11.0"
 futures = "0.3.30"
 futures-util = "0.3"
@@ -115,6 +114,7 @@ sea-orm-migration = "1"
 sea-query = "0.32.0"
 semver = "1"
 serde = "1.0.183"
+serde-cyclonedx = "0.9.1"
 serde_json = "1.0.114"
 serde_with = "3.11.0"
 serde_yml = "0.0.12"

entity/src/sbom.rs

@@ -12,7 +12,7 @@ pub struct Model {
     pub sbom_id: Uuid,
     pub node_id: String,
 
-    pub document_id: String,
+    pub document_id: Option<String>,
 
     pub published: Option<OffsetDateTime>,
     pub authors: Vec<String>,

etc/test-data/cyclonedx/simple_1dot6.json

@@ -0,0 +1,92 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "metadata": {
+    "timestamp": "1970-01-01T13:30:00Z",
+    "component": {
+      "name": "simple",
+      "type": "application"
+    }
+  },
+  "components": [
+    {
+      "name": "A",
+      "version": "1",
+      "bom-ref": "a",
+      "purl": "pkg:rpm/redhat/[email protected]?arch=src",
+      "type": "library"
+    },
+    {
+      "name": "B",
+      "version": "1",
+      "bom-ref": "b",
+      "purl": "pkg:rpm/redhat/[email protected]?arch=src",
+      "type": "library"
+    },
+    {
+      "name": "AA",
+      "version": "1",
+      "bom-ref": "aa",
+      "purl": "pkg:rpm/redhat/[email protected]?arch=src",
+      "type": "library"
+    },
+    {
+      "name": "BB",
+      "version": "1",
+      "bom-ref": "bb",
+      "purl": "pkg:rpm/redhat/[email protected]?arch=src",
+      "type": "library"
+    },
+    {
+      "name": "CC",
+      "version": "1",
+      "bom-ref": "cc",
+      "purl": "pkg:rpm/redhat/[email protected]?arch=src",
+      "type": "library"
+    },
+    {
+      "name": "DD",
+      "version": "1",
+      "bom-ref": "dd",
+      "purl": "pkg:rpm/redhat/[email protected]?arch=src",
+      "type": "library"
+    },
+    {
+      "name": "EE",
+      "version": "1",
+      "bom-ref": "ee",
+      "purl": "pkg:rpm/redhat/[email protected]?arch=src",
+      "type": "library"
+    },
+    {
+      "name": "FF",
+      "version": "1",
+      "bom-ref": "ff",
+      "purl": "pkg:rpm/redhat/[email protected]?arch=src",
+      "type": "library"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "a",
+      "dependsOn": ["b"]
+    },
+    {
+      "ref": "aa",
+      "dependsOn": ["bb"]
+    },
+    {
+      "ref": "bb",
+      "dependsOn": ["cc"]
+    },
+    {
+      "ref": "bb",
+      "dependsOn": ["dd"]
+    },
+    {
+      "ref": "dd",
+      "dependsOn": ["ff"]
+    }
+  ]
+}

migration/src/lib.rs

@@ -95,6 +95,7 @@ mod m0000740_ensure_get_purl_fns;
 mod m0000750_alter_advisory_add_document_id;
 mod m0000760_product_status_index;
 mod m0000780_alter_source_document_time;
+mod m0000790_alter_sbom_alter_document_id;
 
 pub struct Migrator;
 
@@ -197,6 +198,7 @@ impl MigratorTrait for Migrator {
             Box::new(m0000750_alter_advisory_add_document_id::Migration),
             Box::new(m0000760_product_status_index::Migration),
             Box::new(m0000780_alter_source_document_time::Migration),
+            Box::new(m0000790_alter_sbom_alter_document_id::Migration),
         ]
     }
 }

migration/src/m0000790_alter_sbom_alter_document_id.rs

@@ -0,0 +1,55 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        // modify, allow null
+
+        manager
+            .alter_table(
+                Table::alter()
+                    .table(Sbom::Table)
+                    .modify_column(ColumnDef::new(Sbom::DocumentId).string().null().to_owned())
+                    .to_owned(),
+            )
+            .await?;
+
+        // bring back the null value, or consider it null if we already did not have a real value
+
+        manager
+            .get_connection()
+            .execute_unprepared(r#"UPDATE sbom SET document_id = NULL where document_id=''"#)
+            .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        // set an empty string, works and is required
+
+        manager
+            .get_connection()
+            .execute_unprepared(r#"UPDATE sbom SET document_id = '' where document_id IS NULL"#)
+            .await?;
+
+        manager
+            .alter_table(
+                Table::alter()
+                    .table(Sbom::Table)
+                    .modify_column(ColumnDef::new(Sbom::DocumentId).string().not_null())
+                    .to_owned(),
+            )
+            .await?;
+
+        Ok(())
+    }
+}
+
+#[derive(DeriveIden)]
+enum Sbom {
+    Table,
+    DocumentId,
+}

modules/analysis/Cargo.toml

@@ -31,7 +31,6 @@ actix-http = { workspace = true }
 bytes = { workspace = true }
 bytesize = { workspace = true }
 chrono = { workspace = true }
-cyclonedx-bom = { workspace = true }
 hex = { workspace = true }
 humantime = { workspace = true }
 jsonpath-rust = { workspace = true }

modules/fundamental/Cargo.toml

@@ -48,7 +48,6 @@ chrono = { workspace = true }
 criterion = { workspace = true, features = ["html_reports", "async_tokio"] }
 csaf = { workspace = true }
 cve = { workspace = true }
-cyclonedx-bom = { workspace = true }
 hex = { workspace = true }
 humantime = { workspace = true }
 jsonpath-rust = { workspace = true }
@@ -58,11 +57,13 @@ packageurl = { workspace = true }
 regex = { workspace = true }
 roxmltree = { workspace = true }
 semver = { workspace = true }
+serde-cyclonedx = { workspace = true }
 serde_json = { workspace = true }
 serde_yml = { workspace = true }
 sha2 = { workspace = true }
 spdx-rs = { workspace = true }
 strum = { workspace = true }
+termimad = "0.31.0"
 test-context = { workspace = true }
 test-log = { workspace = true, features = ["log", "trace"] }
 tokio-util = { workspace = true }
@@ -71,7 +72,6 @@ trustify-test-context = { workspace = true }
 urlencoding = { workspace = true }
 walkdir = { workspace = true }
 zip = { workspace = true }
-termimad = "0.31.0"
 
 [[bench]]
 name = "bench"