Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bom: initialize its own metadata #256

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

jimklimov
Copy link
Contributor

@jimklimov jimklimov commented Sep 13, 2023

This PR is yet another part of my larger proposal of Merge ability changes stacked in the PR queue.

It adds some utility methods to Bom class, so it can be in charge of initializing a (usually new) Bom object into a usefully populated one, e.g. the merge result to pile other Bom's into, while being the authoritative location to know and care about the class and data structure involved - well in OOP style.

These methods allow the Bom object to initialize:

  • a Metadata object (if null);
  • a collection of Metadata/Tools (now updated to match recent changes in upstream code of the library with a ToolChoices layer) pre-populated with the current version of the cyclonedx-dotnet-library and if possible to discover - its consumer like the cyclonedx-cli tool;
  • a timestamp (now);
  • either a new serial number (new UUIDv4) and set Version=1 if this is a new document (or if explicitly requested by method argument), or increment the Version field if it is a re-iteration of an existing document.

Library consumers which modify these fields directly (e.g. MergeCommand.cs in cyclonedx-cli) would benefit from being updated accordingly; a PR to this effect will be posted shortly.

Calls to these methods were added to HierarchicalMerge() and FlatMerge(Boms, ...) methods, to pre-populate the result object into which merged information would land, since after any processing we conceptually yield a new document.

Note that it would be pedantically prudent to also do this in FlatMerge(Bom, Bom) method which does most of the actual merging work - however, it does so in a loop (called from FlatMerge(Boms, ...)) and in current Merge.cs codebase would just waste CPU time on detection or generation of needed information just to forget it with the next cycle. Still, it would be "correct" to populate this information for the benefit of (theoretically possible, not seen yet) "other consumers" who would only call this method directly, and not know/care about populating those fields on their own, whether "manually" or by using the Bom methods introduced here on the object that pops out from the FlatMerge() call. I did not pursue this corner case here, because it is addressed differently (with an API change to pass toggles whether to do or skip such pre-init) in the larger solution for merge ability improvements.

As it happens, this PR also fixes an issue reported earlier:
Closes: #183

… SerialNumber, Version, Metadata/Tools[] for current library and its consumer script)

Signed-off-by: Jim Klimov <jimklimov@gmail.com>
…kit() to pre-init HierarchicalMerge() and FlatMerge() output object

Signed-off-by: Jim Klimov <jimklimov@gmail.com>
…library 6.0.0 with its intermediate ToolChoices type (for CDX spec 1.5)

Signed-off-by: Jim Klimov <jimklimov@gmail.com>
…is concerns

Signed-off-by: Jim Klimov <jimklimov@gmail.com>
Signed-off-by: Jim Klimov <jimklimov@gmail.com>
mtsfoni pushed a commit to CycloneDX/cyclonedx-cli that referenced this pull request Aug 11, 2024
Primarily written as a practical test case for `Bom.WalkThis()` and
`Bom.RenameBomRef()` methods introduced in the library, but may be
useful to have exposed for end-users.

Relies on CycloneDX/cyclonedx-dotnet-library#245
for the bulk of work (BomEntity base-class and interface family, etc.)
and CycloneDX/cyclonedx-dotnet-library#256 for
metadata update of the output document.

---------

Signed-off-by: Jim Klimov <jimklimov@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Flatmerge clobbers metadata.component
1 participant