[Eljees]

Description

CycloneDX 1.5+ represents component file locations in the standard evidence.occurrences[].location field. Syft only decoded its proprietary syft:location properties, so locations from third-party CycloneDX BOMs were dropped during import.

This change:

• converts non-empty evidence occurrence locations into Syft file locations
• merges them with existing syft:location properties without changing backward compatibility
• deduplicates repeated locations through the existing LocationSet
• adds component-level and end-to-end CycloneDX JSON decoder regression tests

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

Issue references

Fixes #3880

[Eljees]

Ping — this has been open since 28 July with no review yet.

CycloneDX 1.5+ carries component file locations in evidence.occurrences[].location, but Syft only decoded its own syft:location properties, so locations from third-party BOMs were dropped on import. This decodes the standard field as well, merges it with the existing properties without changing backward compatibility, and deduplicates through LocationSet.

Unit tests, lint and static analysis are green on 0296719.

Happy to close it if you would rather fix #3880 differently.

[Eljees]

Adding the real-world case this was missing. The tests here are hand-written decoder units; what follows is a document produced by an unmodified third-party generator, which is the situation the change is actually for.

cdxgen 12.8.4 (the OWASP CycloneDX generator), invoked plainly as cdxgen -t js, with no evidence-specific flags, on a one-dependency project whose src/index.js starts with require('lodash'):

"components": [{
  "name": "lodash", "version": "4.17.21", "purl": "pkg:npm/lodash@4.17.21",
  "evidence": {
    "identity": [{ "field": "purl", "confidence": 1, "concludedValue": "package-lock.json" }],
    "occurrences": [{ "location": "src/index.js", "line": 1 }]
  }
}]

Feeding that document to syft convert bom.json -o syft-json:

main (3325493)   lodash 4.17.21   locations=[]
this PR          lodash 4.17.21   locations=['src/index.js']

So the file the generator recorded is dropped today, on a default invocation of a mainstream tool, at the current spec version (the document declares specVersion 1.7). evidence.occurrences is where CycloneDX puts this, and Syft's own encoder writes locations as syft:location properties instead — which is fine for a Syft-to-Syft round trip, and is exactly why documents from other tools lose it on the way in.

Housekeeping, since the branch was cut in August: it merges into current main cleanly. On the merge result, syft/format/internal/cyclonedxutil and .../helpers pass, and syft/format/cyclonedxjson fails exactly one test, TestCycloneDxImageEncoder, which fails identically on a pristine main checkout here because it needs docker to build its fixture. Nothing is attributable to this change.

Happy to add the generated document as a testdata fixture if you would rather the regression be pinned to a real file than to the hand-written snippets.

🤖 Generated with Claude Code

https://claude.ai/code/session_015CsUTRwsaFCwavDJTPwEpW

[spiffcs]

Looking at this one today. Apologies for the delay here

[spiffcs]

@Eljees thanks for this, and apologies for how long it sat without a review.

I picked it up and pushed on top of your branch rather than ask you for another round to keep this moving.

Added

• Dedupe fix. A path present in both a syft:location property and an evidence occurrence decoded to two locations. This was because the two never compare equal in a LocationSet.
• Encode. Syft now writes evidence.occurrences for CycloneDX 1.5+, one per distinct path. This should make encode/decode symmetrical.
• Layout. Evidence logic moved to helpers/evidence.go with its own tests.
• Tests. Your cases are now rows in Test_decodeComponent. The inline document in the JSON decoder test is replaced by an unmodified cdxgen 12.8.4 document, as a row in TestDecoder_Decode. I also added a round-trip test (no doubled locations), a spec-version test, and a test that decoding memory stays proportional to input, in line with #5404.
• Merged main and regenerated the CycloneDX golden snapshots.

Behavior changes

• Every CycloneDX 1.5+ document syft emits gains an evidence element and gets larger. syft:location properties are kept, so each path is written twice.
• Third-party BOMs with evidence.occurrences now decode with locations. For components without a bom-ref, that changes the package ID. Components with a bom-ref keep it as their ID. This is also a section I'd like another maintainer to look at so we can discuss if we should be more discriminating of what content can be in the evidence.occurences field if they have the potential to not 1:1 to locations.
• Syft-generated BOMs decode to the same locations as before.

Open question

Running cdxgen 12.8.4 and syft on the same one-dependency project:

• cdxgen: occurrences: [{location: "src/index.js", line: 1}] (where lodash is imported); the manifest is in evidence.identity[].methods[] (manifest-analysis, package-lock.json).
• syft: occurrences: [{location: "/package-lock.json"}] (where the package was discovered).

Syft locations mean "what led to discovering this package", which is closer to cdxgen's identity than its occurrences. This PR maps locations to occurrences, which is what #3880 and Dependency-Track use. We want to settle whether that is the right long-term home before merging.

Before merging

• Decide the occurrences vs identity.methods question above
• CI green on the new commits, including CycloneDX schema validation of the new output
• Check some downstream consequences in grype and how it uses decoded locations
• If it merges as is: make a note for the output growth and the package ID change