sbom-cyclonedx 0.1.0 → 0.2.0

data/sig/sbom/cyclone_dx/type.rbs

@@ -0,0 +1,16 @@
+module SBOM
+  module CycloneDX
+    module Type
+      module Boolean
+      end
+
+      class Union
+        @types: Array[fieldTypeLabel]
+
+        def self.[]: [T < fieldTypeLabel] (*T) -> instance
+
+        private def initialize: [T < fieldTypeLabel] (*T) -> void
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/array_validator.rbs

@@ -0,0 +1,31 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class ArrayValidator < BaseValidator[::Array[fieldValue]]
+        type itemsValidator = ^(untyped) -> Array[String]
+        type validSingleTypeLabel =
+          :boolean
+        | :date_time
+        | :email_address
+        | :float
+        | :integer
+        | singleton(SBOM::CycloneDX::Record::Base)
+        | :string
+        | :uri
+
+        @items_validator: BaseValidator[fieldValue]
+        @unique: bool
+
+        def initialize: (
+            items: itemsValidator | validSingleTypeLabel | Validator::arrayItemValidatorParams,
+            ?unique: bool,
+            ?required: bool
+          ) -> void
+
+        def valid?: (untyped) -> bool
+        private def validator_method: (SBOM::CycloneDX::Validator::BaseValidator[untyped]) -> ^(untyped) -> Array[String]
+        private def proc_validator: (^(untyped) -> (bool | Array[untyped] | String)) -> ^(untyped) -> Array[String]
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/base_validator.rbs

@@ -0,0 +1,21 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class BaseValidator[in T < fieldValue]
+        MISSING_REQUIRED: String
+        INVALID_TYPE: String
+
+        @types: Array[fieldType]
+        @required: bool
+        @errors: Array[String]
+
+        def initialize: (*fieldType, ?required: bool) -> void
+        def valid?: (untyped) -> bool
+        def validate: (untyped) -> Array[String]
+        def required?: () -> bool
+        def const?: () -> bool
+        def raw_types: () -> Array[fieldType]
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/boolean_validator.rbs

@@ -0,0 +1,9 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class BooleanValidator < BaseValidator[bool]
+        def initialize: (?required: bool) -> void
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/date_time_validator.rbs

@@ -0,0 +1,10 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class DateTimeValidator < BaseValidator[dateTime]
+        def initialize: (?required: bool) -> void
+        def valid?: (untyped) -> bool
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/email_address_validator.rbs

@@ -0,0 +1,10 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class EmailAddressValidator < BaseValidator[emailAddress]
+        def initialize: (?required: bool) -> void
+        def valid?: (untyped) -> bool
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/float_validator.rbs

@@ -0,0 +1,12 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class FloatValidator < BaseValidator[Float]
+        @range: Range[number?]
+
+        def initialize: (?maximum: number?, ?minimum: number?, ?required: bool) -> void
+        def valid?: (untyped) -> bool
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/integer_validator.rbs

@@ -0,0 +1,12 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class IntegerValidator < BaseValidator[Integer]
+        @range: Range[number?]
+
+        def initialize: (?maximum: number?, ?minimum: number?, ?required: bool) -> void
+        def valid?: (untyped) -> bool
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/record_validator.rbs

@@ -0,0 +1,12 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class RecordValidator < BaseValidator[Record::Base]
+        @record_type: singleton(SBOM::CycloneDX::Record::Base)
+
+        def initialize: (type: singleton(SBOM::CycloneDX::Record::Base), ?required: bool) -> void
+        def valid?: (untyped) -> bool
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/string_validator.rbs

@@ -0,0 +1,14 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class StringValidator < BaseValidator[String]
+        @enum: Array[String]?
+        @length_range: Range[Integer?]
+        @pattern: Regexp
+
+        def initialize: (?enum: Array[String]?, ?max_length: Integer?, ?min_length: Integer?, ?pattern: Regexp, ?required: bool) -> void
+        def valid?: (untyped) -> bool
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/union_validator.rbs

@@ -0,0 +1,24 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class UnionValidator < BaseValidator[fieldValue]
+        type unionableValidatorParams =
+          fieldTypeLabel
+        | [:array, arrayValidatorParams]
+        | [:boolean, booleanValidatorParams]
+        | [:date_time, dateTimeValidatorParams]
+        | [:email_address, emailAddressValidatorParams]
+        | [:float, floatValidatorParams]
+        | [:integer, integerValidatorParams]
+        | [singleton(SBOM::CycloneDX::Record::Base), recordValidatorParams]
+        | [:string, stringValidatorParams]
+        | [:uri, uriValidatorParams]
+
+        @nested_validators: Array[BaseValidator[untyped]]
+
+        def initialize: (of: Array[unionableValidatorParams], ?required: bool) -> void
+        def valid?: (untyped) -> bool
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator/uri_validator.rbs

@@ -0,0 +1,10 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      class URIValidator < BaseValidator[uri]
+        def initialize: (?required: bool) -> void
+        def valid?: (untyped) -> bool
+      end
+    end
+  end
+end

data/sig/sbom/cyclone_dx/validator.rbs

@@ -0,0 +1,66 @@
+module SBOM
+  module CycloneDX
+    module Validator
+      type anyValidator =
+        ArrayValidator
+      | BooleanValidator
+      | DateTimeValidator
+      | EmailAddressValidator
+      | FloatValidator
+      | IntegerValidator
+      | RecordValidator
+      | StringValidator
+      | UnionValidator
+      | URIValidator
+
+      type arrayValidatorParams = { items: ^(untyped) -> bool | fieldTypeLabel | arrayItemValidatorParams, ?unique: bool, ?required: bool }
+      type booleanValidatorParams = { ?required: bool }
+      type dateTimeValidatorParams = { ?required: bool }
+      type emailAddressValidatorParams = { ?required: bool }
+      type floatValidatorParams = { ?maximum: number?, ?minimum: number, ?required: bool }
+      type integerValidatorParams = { ?maximum: Integer, ?minimum: Integer, ?required: bool }
+      type recordValidatorParams = { type: singleton(SBOM::CycloneDX::Record::Base), ?required: bool }
+      type stringValidatorParams = { ?enum: Array[String], ?max_length: Integer?, ?min_length: Integer?, ?pattern: Regexp, ?required: bool }
+      type unionValidatorParams = { of: Array[UnionValidator::unionableValidatorParams], ?required: bool }
+      type uriValidatorParams = { ?required: bool }
+      type anyValidatorParams =
+        arrayValidatorParams
+      | booleanValidatorParams
+      | dateTimeValidatorParams
+      | emailAddressValidatorParams
+      | floatValidatorParams
+      | integerValidatorParams
+      | recordValidatorParams
+      | stringValidatorParams
+      | unionValidatorParams
+      | uriValidatorParams
+
+      type arrayItemValidatorParams =
+        [:array, arrayValidatorParams]
+      | [:boolean, booleanValidatorParams]
+      | [:date_time, dateTimeValidatorParams]
+      | [:email_address, emailAddressValidatorParams]
+      | [:float, floatValidatorParams]
+      | [:integer, integerValidatorParams]
+      | [singleton(SBOM::CycloneDX::Record::Base), recordValidatorParams]
+      | [:string, stringValidatorParams]
+      | [:union, unionValidatorParams]
+      | [:uri, uriValidatorParams]
+
+      SIMPLE_TYPES: [:array, :boolean, :date_time, :email_address, :float, :integer, :string, :uri]
+
+      def self.for:
+        (:array type, **untyped) -> ArrayValidator
+      | (:boolean type, **untyped) -> BooleanValidator
+      | (:date_time type, **untyped) -> DateTimeValidator
+      | (:email_address type, **untyped) -> EmailAddressValidator
+      | (:float type, **untyped) -> FloatValidator
+      | (:integer type, **untyped) -> IntegerValidator
+      | (singleton(SBOM::CycloneDX::Record::Base) type, **untyped) -> RecordValidator
+      | (:string type, **untyped) -> StringValidator
+      | (:union type, **untyped) -> UnionValidator
+      | (:uri type, **untyped) -> URIValidator
+      | (fieldTypeLabel type, **untyped) -> BaseValidator[untyped]
+    end
+  end
+end

data/sig/sbom/cyclone_dx.rbs

@@ -0,0 +1,13 @@
+module SBOM
+  module CycloneDX
+    VERSION: String
+
+    class Error < StandardError
+    end
+
+    def self.create: (Hash[String | Symbol, fieldValue]) -> Record::Root
+    def self.load: (File) -> Record::Root
+    def self.parse: (String) -> Record::Root
+    def self.json_create: (::Hash[String | Symbol, untyped]) -> Record::Root
+  end
+end

data/sig/types.rbs

@@ -0,0 +1,45 @@
+type dateTime = DateTime | Time | String
+type emailAddress = EmailAddress::Address | String
+type number = Integer | Float
+type uri = URI::Generic | String
+type fieldValue =
+  bool
+| dateTime
+| emailAddress
+| Float
+| Integer
+| SBOM::CycloneDX::Record::Base
+| String
+| URI::Generic
+| nil
+| Array[fieldValue]
+type fieldTypeLabel =
+  :array
+| :boolean
+| :date_time
+| :email_address
+| :float
+| :integer
+| singleton(SBOM::CycloneDX::Record::Base)
+| :string
+| :union
+| :uri
+type fieldType = Class & (
+  singleton(Array)
+  | singleton(TrueClass)
+  | singleton(FalseClass)
+  | singleton(DateTime)
+  | singleton(Time)
+  | singleton(EmailAddress::Address)
+  | singleton(Float)
+  | singleton(Integer)
+  | singleton(String)
+  | singleton(URI::Generic)
+  | singleton(SBOM::CycloneDX::Record::Base)
+)
+
+type jsonObject = Float | Integer | String | bool | Array[jsonObject] | Hash[String, jsonObject] | nil
+
+# Steep can't find this for some raeason
+class Date::Error < Exception
+end

data/spec/email_address_extension_spec.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "email_address_extension"
+
+describe EmailAddressExtension do
+  let(:email_address_string) { Faker::Internet.email }
+  let(:email_address) { EmailAddress.new(email_address_string) }
+
+  it "disables dns lookup" do
+    expect(email_address.host.dns_enabled?).to be false
+    expect(email_address.host.config[:dns_lookup]).to eq(:off)
+  end
+
+  it "disables host validation" do
+    expect(email_address.host.dns_enabled?).to be false
+    expect(email_address.host.config[:host_validation]).to eq(:syntax)
+  end
+
+  it "aliases #as_json to #to_s" do
+    expect(email_address.as_json).to eq(email_address_string)
+  end
+
+  it "aliases #to_json to #to_s" do
+    expect(email_address.to_json).to eq(email_address_string)
+  end
+end

data/spec/factories/factory_helper.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "faker"
+
+module FactoryHelper
+  SEQUENCE_GENERATORS = {
+    # Generators for data not available through Faker, mostly matching Pattern:: constants
+    cdx_urn_fragment: ->(n) { "fragment-#{n}" },
+    cdx_bom_version: ->(n) { (n + 1).to_s },
+    cdx_urn_nss: ->(n) { "#{SecureRandom.uuid}/#{use_generator(:cdx_bom_version, n)}" },
+    cdx_urn_assigned_name: ->(n) { "urn:cdx:#{use_generator(:cdx_urn_nss, n)}" },
+    cdx_urn_with_fragment: lambda do |n|
+      "#{use_generator(:cdx_urn_assigned_name, n)}##{use_generator(:cdx_urn_fragment, n)}"
+    end,
+    cdx_urn: lambda do |n|
+      next use_generator(:cdx_urn_assigned_name, n) if Faker::Boolean.boolean
+
+      use_generator(:cdx_urn_with_fragment, n)
+    end,
+    bom_serial_number: ->(_) { "urn:uuid:#{SecureRandom.uuid}" },
+    ref_link: ->(n) { "ref-link-#{n}" },
+    ref_or_cdx_urn: lambda do |n|
+      Faker::Boolean.boolean ? use_generator(:ref_link, n) : use_generator(:cdx_urn_with_fragment, n)
+    end,
+    hash_value: ->(_) { SecureRandom.hex([32, 40, 64, 96, 128].sample) },
+    locale: ->(_) { I18n.available_locales.sample.to_s },
+    mime_type: ->(_) { Faker::File.mime_type },
+    open_cre: ->(_) { "CRE:#{rand(1..100)}-#{rand(1..100)}" },
+    content_type: lambda do |n|
+      mime_type = use_generator(:mime_type, n)
+      next mime_type if Faker::Boolean.boolean
+
+      "#{mime_type}; #{Faker::Lorem.word.downcase}=#{Faker::Lorem.word.downcase}-#{n}"
+    end,
+    url: lambda do |_|
+      gen_url = Faker::Internet.url
+      next gen_url if Faker::Boolean.boolean
+
+      URI.parse(gen_url)
+    end,
+    email: lambda do |_|
+      gen_email = Faker::Internet.email
+      next gen_email if Faker::Boolean.boolean
+
+      EmailAddress::Address.new(gen_email)
+    end
+  }.freeze
+
+  SEQUENCE_GENERATORS.each do |name, generator|
+    FactoryBot::Internal.register_sequence(FactoryBot::Sequence.new(name, &generator))
+  end
+
+  def self.use_generator(name, n) # rubocop:disable Naming/MethodParameterName
+    SEQUENCE_GENERATORS.fetch(name).call(n)
+  end
+
+  def generate_association(factories, *args, **kwargs)
+    association(factories.sample, *args, **kwargs)
+  end
+
+  def association_list(factory, count = nil, *args, **kwargs)
+    Array.new(count || rand(1..2)) { generate_association(Array(factory), *args, **kwargs) }
+  end
+
+  def generate_license_choice(*args, **kwargs)
+    generate_association(%i[license_expression wrapped_license], *args, **kwargs)
+  end
+
+  def license_choice_list(count = nil, *args, **kwargs)
+    association_list(%i[license_expression wrapped_license], count, *args, **kwargs)
+  end
+
+  def generate_signature(*args, **kwargs)
+    generate_association(%i[jsf_signature signature_chain signer_list], *args, **kwargs)
+  end
+end
+
+FactoryBot::Evaluator.prepend(FactoryHelper)

data/spec/factories/record/advisory_factory.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :advisory, parent: :record, class: "SBOM::CycloneDX::Record::Advisory" do
+    url { generate(:url) }
+
+    trait :all_fields do
+      title { Faker::Lorem.sentence }
+    end
+  end
+end

data/spec/factories/record/annotation_factory.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :annotation, parent: :record, class: "SBOM::CycloneDX::Record::Annotation" do
+    subjects { Array.new(rand(1..4)) { generate(:ref_or_cdx_urn) } }
+    annotator
+    timestamp { Faker::Time.backward(days: 367) }
+    text { Faker::Lorem.sentence }
+
+    trait :all_fields do
+      bom_ref { generate(:ref_link) }
+      annotator
+      signature { generate_signature }
+    end
+  end
+
+  factory :annotator, parent: :record, class: "SBOM::CycloneDX::Record::Annotation::Annotator" do
+    transient do
+      annotator_type do
+        %i[
+          organization
+          individual
+          component
+          service
+        ].sample
+      end
+    end
+
+    trait :all_fields
+
+    trait :organization do
+      transient { annotator_type { :organization } }
+    end
+
+    trait :contact do
+      transient { annotator_type { :contact } }
+    end
+
+    trait :component do
+      transient { annotator_type { :component } }
+    end
+
+    trait :service do
+      transient { annotator_type { :service } }
+    end
+
+    organization do
+      annotator_type == :organization ? association(:organizational_entity) : nil
+    end
+
+    individual do
+      annotator_type == :individual ? association(:organizational_contact) : nil
+    end
+
+    component do
+      annotator_type == :component ? association(:component) : nil
+    end
+
+    service do
+      annotator_type == :service ? association(:service) : nil
+    end
+  end
+end

data/spec/factories/record/attachment_factory.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :attachment, parent: :record, class: "SBOM::CycloneDX::Record::Attachment" do
+    content { Base64.encode64(Faker::Lorem.paragraph) }
+  end
+
+  trait :all_fields
+end

data/spec/factories/record/cipher_suite_factory.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+FactoryBot.define do
+  factory :cipher_suite, parent: :record, class: "SBOM::CycloneDX::Record::CipherSuite" do
+    transient do
+      cipher_data { @cipher_data ||= YAML.load_file("spec/fixtures/cipher_info.yml") }
+    end
+
+    trait :all_fields do
+      name { cipher_data.keys.sample }
+      identifiers { cipher_data[name] }
+      algorithms do
+        name.split("_")[0..-2].each_with_object([]) do |word, memo|
+          case word
+          when "WITH", "TLS", "NULL" then next
+          when /\A[0-9]+\z/ then memo << "#{memo.pop}-#{word}"
+          when /\A[A-Z]+[0-9]{2,}\z/ then memo << word.gsub(/([A-Z])([0-9])/, '\1-\2').downcase
+          else memo << word.downcase
+          end
+        end
+      end
+    end
+  end
+end

data/spec/factories/record/co2_measure_factory.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :co2_measure, parent: :record, class: "SBOM::CycloneDX::Record::CO2Measure" do
+    value { rand(0.0..100.0) }
+
+    trait :all_fields
+  end
+end

data/spec/factories/record/command_factory.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :command, parent: :record, class: "SBOM::CycloneDX::Record::Command" do
+    trait :all_fields do
+      executed { "echo '#{Faker::Lorem.sentence}'" }
+      properties { association_list(:property) }
+    end
+  end
+end

data/spec/factories/record/commit_factory.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :commit, parent: :record, class: "SBOM::CycloneDX::Record::Commit" do
+    trait :all_fields do
+      uid { Faker::Crypto.sha1 }
+      url { generate(:url) }
+      author factory: :identifiable_action
+      committer factory: :identifiable_action
+      message { Faker::Lorem.sentence }
+    end
+  end
+end

data/spec/factories/record/component_data_factory.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require "sbom/cyclone_dx/enum"
+
+FactoryBot.define do
+  factory :component_data, parent: :record, class: "SBOM::CycloneDX::Record::ComponentData" do
+    type { SBOM::CycloneDX::Enum::COMPONENT_DATA_TYPE.sample }
+
+    trait :all_fields do
+      bom_ref { generate(:ref_link) }
+      name { Faker::Lorem.word }
+      contents factory: :content
+      classification { Faker::Lorem.word }
+      sensitive_data { Array.new(rand(1..4)) { Faker::Lorem.word } }
+      graphics factory: :graphics_collection
+      description { Faker::Lorem.sentence }
+      governance factory: :data_governance
+    end
+  end
+
+  factory :content, parent: :record, class: "SBOM::CycloneDX::Record::ComponentData::Content" do
+    trait :all_fields do
+      attachment
+      url { generate(:url) }
+      properties { association_list(:property) }
+    end
+  end
+end

data/spec/factories/record/component_evidence_factory.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :component_evidence, parent: :record, class: "SBOM::CycloneDX::Record::ComponentEvidence" do
+    trait :all_fields do
+      identity { association_list(:component_identity_evidence) }
+      occurrences { association_list(:occurrence) }
+      callstack
+      licenses { license_choice_list(rand(1..3)) }
+      copyright { association_list(:copyright) }
+    end
+  end
+
+  factory :callstack, parent: :record, class: "SBOM::CycloneDX::Record::ComponentEvidence::Callstack" do
+    trait :all_fields do
+      frames { association_list(:frame) }
+    end
+  end
+
+  factory :frame, parent: :record, class: "SBOM::CycloneDX::Record::ComponentEvidence::Frame" do
+    source_module { Faker::Lorem.word }
+
+    trait :all_fields do
+      package { Faker::Lorem.word }
+      function { Faker::Lorem.word }
+      parameters { Faker::Lorem.words(number: rand(1..4)) }
+      line { rand(1..1000) }
+      column { rand(1..200) }
+      full_filename { Faker::File.file_name }
+    end
+  end
+
+  factory :occurrence, parent: :record, class: "SBOM::CycloneDX::Record::ComponentEvidence::Occurrence" do
+    location { Faker::File.file_name }
+
+    trait :all_fields do
+      bom_ref { generate(:ref_link) }
+      line { rand(1..1000) }
+      offset { rand(1..200) }
+      symbol { Faker::Lorem.word }
+      additional_context { Faker::Lorem.sentence }
+    end
+  end
+end