feat: add support for component's evidences according to spec#810

Merged

jkowalleck merged 28 commits intoCycloneDX:mainfrom

Jun 7, 2025

Contributor

OxPirates commented May 3, 2025 •

edited by jkowalleck

Loading

fixes #737

OxPirates requested a review from a team as a code owner

May 3, 2025 10:26

Member

jkowalleck commented May 5, 2025 •

edited

Loading

Thank you for providing this feature, @OxPirates

could you

also add test models in https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/tests/_data/models.py ?
see why linters are failing? https://github.com/CycloneDX/cyclonedx-python-lib/actions/runs/14810009968/job/41639406673?pr=810
see why code standard is failing? https://github.com/CycloneDX/cyclonedx-python-lib/actions/runs/14810009968/job/41639410612?pr=810 - see also https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CONTRIBUTING.md#code-style

jkowalleck requested changes

View reviewed changes

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

Contributor Author

OxPirates commented May 5, 2025

@jkowalleck Thank you for your time, Will work on it and submit the changes.

OxPirates force-pushed the main branch from bc2cbde to b066921 Compare

May 7, 2025 11:59

jkowalleck requested changes

View reviewed changes

tests/_data/models.py Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

cyclonedx/model/component.py Outdated Show resolved Hide resolved

OxPirates force-pushed the main branch from b066921 to dbc4fe9 Compare

May 8, 2025 12:51

Contributor Author

OxPirates commented May 8, 2025

@jkowalleck Thank you for the detailed review. All comments have been addressed except the one regarding ToolReference

OxPirates force-pushed the main branch from dbc4fe9 to e3b29a2 Compare

May 8, 2025 13:10

OxPirates requested a review from jkowalleck

May 10, 2025 16:24

OxPirates force-pushed the main branch from e3b29a2 to fde8be1 Compare

May 13, 2025 12:53

jkowalleck reviewed

View reviewed changes

cyclonedx/model/component.py Outdated Show resolved Hide resolved

tests/_data/models.py Show resolved Hide resolved

tests/_data/models.py Outdated Show resolved Hide resolved

tests/_data/models.py Outdated Show resolved Hide resolved

OxPirates force-pushed the main branch from fde8be1 to 209b3d1 Compare

May 17, 2025 10:56

jkowalleck requested changes

View reviewed changes

tests/_data/models.py Outdated Show resolved Hide resolved

tests/_data/models.py Outdated Show resolved Hide resolved

tests/_data/models.py Outdated Show resolved Hide resolved

tests/_data/models.py Outdated Show resolved Hide resolved

tests/_data/models.py Show resolved Hide resolved


          feat: add support for component's evidences according to spec

849c7a4

Signed-off-by: Arun <arun0548@gmail.com>

OxPirates force-pushed the main branch from 209b3d1 to 849c7a4 Compare

May 19, 2025 13:54

OxPirates requested a review from jkowalleck

May 19, 2025 13:57

Member

jkowalleck commented May 23, 2025

the amend/squash of the changes makes review hard.
please bare with me, review takes a while


          Merge branch 'main' into main

f92dcc5

jkowalleck requested changes

View reviewed changes

Member

jkowalleck left a comment •

edited

Loading

please move all these new symbols to an own module called component_evidence.
Thanks in advance

cyclonedx/model/component.py Outdated Show resolved Hide resolved

jkowalleck added 6 commits

May 27, 2025 11:58


          prep extraxtion of component_evidence

a65cc0e

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          prep extraxtion of component_evidence

63c1cc5

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          refactor: compoennt evidence

7b30eff

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          prep extraxtion of component_evidence

45abefe

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          prep extraxtion of component_evidence

392e61d

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          refactor: compoennt evidence

cbb7370

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Member

jkowalleck commented May 27, 2025

please move all these new symbols to an own module called component_evidence.
Thanks in advance

did that for you. will continue the review

jkowalleck added 3 commits

May 27, 2025 17:08

wip

ec89ae7

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          tests

da433b6

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

wip

564b3e6

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck reviewed

View reviewed changes

cyclonedx/model/component_evidence.py Outdated Show resolved Hide resolved


          Fix for pipeline failures, improvement for Identity, spec v1.5, v1.6

9382ad4

Signed-off-by: Arun <arun0548@gmail.com>

jkowalleck reviewed

View reviewed changes

cyclonedx/model/component_evidence.py Outdated Show resolved Hide resolved

tests/_data/models.py Outdated Show resolved Hide resolved

cyclonedx/model/component_evidence.py Outdated Show resolved Hide resolved

jkowalleck added 6 commits

May 31, 2025 11:27


          tests: bring backtest case with multiple evidence identities

1a7b41f

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          modified _IdentityToolRepositorySerializationHelper

95df588

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          reverted callstack frames as lists

b66ecc3

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          clean _IdentityRepositorySerializationHelper

47a1ef4

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          fix component evidence serialization

5de7307

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          tidy

0ee583e

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck force-pushed the main branch from f74a316 to 0ee583e Compare

May 31, 2025 09:27


          cleanup

78fd4db

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Member

jkowalleck commented May 31, 2025 •

edited

Loading

@OxPirates, i fixed the normalizers implementation so that it also works for multiple identities in CycloneDX 1.5 XML.

CI/CT fails, since the implementation of the serialization library needs a little tweak - will add this soon.

PS: fixed and created madpah/serializable#172


          typing for serialization lib

7aef6e1

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Member

jkowalleck commented May 31, 2025

@OxPirates I think we have a solid implementation, now.
could you review and see if something is missing or if additional test might be needed?

jkowalleck self-requested a review

May 31, 2025 09:55

jkowalleck added the schema 1.5 label

jkowalleck mentioned this pull request

[TRACKING] Complete support for CycloneDX v1.5 #578

Open

15 tasks


          remove TODO

de6d628

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Contributor Author

OxPirates commented May 31, 2025

@OxPirates I think we have a solid implementation, now. could you review and see if something is missing or if additional test might be needed?

Yes, Alredy doing so..

jkowalleck added 5 commits

June 2, 2025 07:18


          Merge remote-tracking branch 'origin/main' into OxPirates_main

57625da


          style: remove no longer used typehint-ignores

c4a0218

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>


          Merge remote-tracking branch 'origin/main' into OxPirates_main

bb111c3


          Merge branch 'main' into main

d2f93aa


          style: upgrade code style

8aac643

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Contributor Author

OxPirates commented Jun 7, 2025

@OxPirates I think we have a solid implementation, now. could you review and see if something is missing or if additional test might be needed?

Yes, Alredy doing so..

Can we promote this change now?

Member

jkowalleck commented Jun 7, 2025

@OxPirates I think we have a solid implementation, now. could you review and see if something is missing or if additional test might be needed?

Yes, Alredy doing so..

Can we promote this change now?

sure. I was just waiting for your review.
If you agree to the change set, I will merge and release it early next week

Contributor Author

OxPirates commented Jun 7, 2025

@OxPirates I think we have a solid implementation, now. could you review and see if something is missing or if additional test might be needed?

Yes, Alredy doing so..

Can we promote this change now?

sure. I was just waiting for your review. If you agree to the change set, I will merge and release it early next week

Yes, Please go ahead, No further comment

jkowalleck approved these changes

View reviewed changes

jkowalleck merged commit 3395fda into CycloneDX:main

42 checks passed

Member

jkowalleck commented Jun 10, 2025

this feature was released in https://github.com/CycloneDX/cyclonedx-python-lib/releases/tag/v10.2.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels