chore(cyclonedx): emit metadata.tools in the 1.6 components form - #1102
Conversation
Replace the deprecated tools array (vendor/name/version) with tools.components using type, name, version, and publisher so the BOM stays valid when CycloneDX drops the legacy shape in 1.7. Fixes OWASP#1097
sonukapoor
left a comment
sonukapoor
left a comment
There was a problem hiding this comment.
This is the right fix, and it closes a gap I left open in #1093.
When we moved specVersion to 1.6 there, metadata.tools kept the 1.4 array
shape. That is deprecated in 1.6, so we were emitting a document that declared
one version and described its tooling in the form of an older one. Moving to
tools.components with publisher instead of vendor makes the two agree.
I like that the tests assert vendor is absent rather than only checking the
new shape is present. That is the assertion that actually fails if someone
reintroduces the old form alongside the new one.
Verified locally: full suite green at 1792, build clean, and a real scan now
emits tools: {"components": [...]} with publisher: "OWASP".
|
Merged - thank you @XiaoZ-0218! This will ship in v1.34.0, which I am cutting shortly. |
2 participants
Summary
metadata.toolsfrom the deprecated CycloneDX 1.6 array (vendor/name/version) to the moderntools.componentsobject (type/name/version/publisher).tests/cyclonedx.test.tsso a regression back to the legacy array fails.Fixes #1097
Dependency-Track note
Issue #1097 asked to verify the documented consumer before shipping. Dependency-Track already models both legacy and component/service-based tool metadata (see DependencyTrack/dependency-track#6785: "Dependency-Track already models both legacy and component/service-based tool metadata"), so this output should remain ingestible.
Test plan