sbom-cyclonedx 0.1.0 → 0.2.0

data/spec/factories/record/service_factory.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :service, parent: :record, class: "SBOM::CycloneDX::Record::Service" do
+    name { Faker::App.name }
+
+    trait :all_fields do
+      bom_ref { generate(:ref_link) }
+      provider { association :organizational_entity }
+      group { Faker::Lorem.word }
+      version { Faker::App.semantic_version }
+      description { Faker::Lorem.sentence }
+      endpoints { Array.new(rand(0..3)) { generate(:url) } }
+      authenticated { Faker::Boolean.boolean }
+      x_trust_boundary { Faker::Boolean.boolean }
+      trust_zone { Faker::Lorem.word }
+      data { association_list(:service_data) }
+      licenses { license_choice_list }
+      external_references { association_list(:external_reference) }
+      services { association_list(:service) }
+      release_notes { association :release_notes }
+      properties { association_list(:property) }
+      tags { Array.new(rand(0..3)) { Faker::Lorem.word } }
+      signature { generate_signature }
+    end
+  end
+end

data/spec/factories/record/signature_factory.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  # This will almost not pass cursory validation, but is good enough for these specs
+  factory :jsf_signature, parent: :record, class: "SBOM::CycloneDX::Record::Signature::JSFSignature" do
+    algorithm { SBOM::CycloneDX::Enum::SIGNATURE_ALGORITHM.sample }
+    value { Base64.encode64(SecureRandom.bytes(64)) }
+
+    trait :all_fields do
+      key_id { SecureRandom.uuid }
+      public_key { generate_association(%i[ec okp rsa]) }
+      certificate_path { Array.new(rand(1..3)) { Base64.encode64(SecureRandom.bytes(534)) } }
+      excludes { Faker::Lorem.words(number: rand(1..3)).map(&:downcase) }
+    end
+  end
+
+  factory :signature_chain, parent: :record, class: "SBOM::CycloneDX::Record::Signature::SignatureChain" do
+    trait :all_fields do
+      signatures { association_list(:jsf_signature) }
+    end
+  end
+
+  factory :signer_list, parent: :record, class: "SBOM::CycloneDX::Record::Signature::SignerList" do
+    trait :all_fields do
+      signers { association_list(:jsf_signature) }
+    end
+  end
+
+  factory :ec, parent: :record, class: "SBOM::CycloneDX::Record::Signature::JSFSignature::PublicKey::EC" do
+    crv { SBOM::CycloneDX::Enum::SIGNATURE_EC_CRV.sample }
+    x { Base64.encode64(SecureRandom.bytes(32)) }
+    y { Base64.encode64(SecureRandom.bytes(32)) }
+
+    trait :all_fields
+  end
+
+  factory :okp, parent: :record, class: "SBOM::CycloneDX::Record::Signature::JSFSignature::PublicKey::OKP" do
+    crv { SBOM::CycloneDX::Enum::SIGNATURE_OKP_CRV.sample }
+    x { Base64.encode64(SecureRandom.bytes(32)) }
+
+    trait :all_fields
+  end
+
+  factory :rsa, parent: :record, class: "SBOM::CycloneDX::Record::Signature::JSFSignature::PublicKey::RSA" do
+    n { Base64.encode64(rand(1..4096).to_s) }
+    e { Base64.encode64(rand(1..4096).to_s) }
+
+    trait :all_fields
+  end
+end

data/spec/factories/record/standard_factory.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :standard, parent: :record, class: "SBOM::CycloneDX::Record::Standard" do
+    trait :all_fields do
+      bom_ref { generate(:ref_link) }
+      name { Faker::Lorem.word }
+      version { Faker::App.semantic_version }
+      description { Faker::Lorem.sentence }
+      owner { Faker::Company.name }
+      requirements { association_list(:requirement) }
+      levels { association_list(:level) }
+      external_references { association_list(:external_reference) }
+      signature { generate_signature }
+    end
+  end
+
+  factory :level, parent: :record, class: "SBOM::CycloneDX::Record::Standard::Level" do
+    bom_ref { generate(:ref_link) }
+    identifier { Faker::Lorem.word }
+    title { Faker::Lorem.word }
+    description { Faker::Lorem.sentence }
+    requirements { Array.new(rand(0..2)) { generate(:ref_link) } }
+  end
+
+  factory :requirement, parent: :record, class: "SBOM::CycloneDX::Record::Standard::Requirement" do
+    bom_ref { generate(:ref_link) }
+    identifier { Faker::Lorem.word }
+    title { Faker::Lorem.word }
+    text { Faker::Lorem.paragraph }
+    descriptions { Array.new(rand(0..2)) { Faker::Lorem.sentence } }
+    open_cre { Array.new(rand(0..3)) { generate(:open_cre) } }
+    parent { generate(:ref_link) }
+    properties { association_list(:property) }
+    external_references { association_list(:external_reference) }
+  end
+end

data/spec/factories/record/step_factory.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :step, parent: :record, class: "SBOM::CycloneDX::Record::Step" do
+    trait :all_fields do
+      name { Faker::Lorem.word }
+      description { Faker::Lorem.sentence }
+      commands { association_list(:command) }
+      properties { association_list(:property) }
+    end
+  end
+end

data/spec/factories/record/swid_factory.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :swid, parent: :record, class: "SBOM::CycloneDX::Record::SWID" do
+    tag_id { "tag_id" }
+    name { "name" }
+
+    trait :all_fields do
+      version { Faker::App.semantic_version }
+      tag_version { rand(0..100) }
+      patch { Faker::Boolean.boolean }
+      text { association(:attachment) }
+      url { generate(:url) }
+    end
+  end
+end

data/spec/factories/record/task_factory.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :task, parent: :record, class: "SBOM::CycloneDX::Record::Task" do
+    bom_ref { generate(:ref_link) }
+    uid { Faker::Lorem.characters(number: 16) }
+
+    trait :all_fields do
+      name { Faker::Lorem.word }
+      description { Faker::Lorem.sentence }
+      resource_references { association_list(:resource_reference_choice) }
+      task_types { SBOM::CycloneDX::Enum::TASK_TYPE.sample(rand(1..3)) }
+      trigger { association(:trigger) }
+      steps { association_list(:step) }
+      inputs { association_list(:input) }
+      outputs { association_list(:output) }
+      time_start { Faker::Time.backward(days: 367) }
+      time_end { time_start + rand(1..100).hours }
+      workspaces { association_list(:workspace) }
+      runtime_topology { association_list(:dependency) }
+      properties { association_list(:property) }
+    end
+  end
+end

data/spec/factories/record/tools_factory.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :tools, parent: :record, class: "SBOM::CycloneDX::Record::Tools" do
+    trait :all_fields do
+      components { association_list(:component) }
+      services { association_list(:service) }
+    end
+  end
+end

data/spec/factories/record/trigger_factory.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :trigger, parent: :record, class: "SBOM::CycloneDX::Record::Trigger" do
+    bom_ref { generate(:ref_link) }
+    uid { Faker::Lorem.characters(number: 16) }
+    type { SBOM::CycloneDX::Enum::TRIGGER_TYPE.sample }
+
+    trait :all_fields do
+      name { Faker::Lorem.word }
+      description { Faker::Lorem.sentence }
+      resource_references { association_list(:resource_reference_choice) }
+      event { association(:event) }
+      conditions { association_list(:condition) }
+      time_activated { Faker::Time.backward(days: 367) }
+      inputs { association_list(:input) }
+      outputs { association_list(:output) }
+      properties { association_list(:property) }
+    end
+  end
+end

data/spec/factories/record/version_factory.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :version, parent: :record, class: "SBOM::CycloneDX::Record::Version" do
+    transient do
+      version_type { %i[fixed range].sample }
+    end
+
+    trait(:fixed) { version_type { :fixed } }
+    trait(:range) { version_type { :range } }
+
+    version { Faker::App.semantic_version if version_type == :fixed }
+    range { ">=#{Faker::App.semantic_version}" if version_type == :range }
+
+    trait :all_fields do
+      status { SBOM::CycloneDX::Enum::AFFECTED_STATUS.sample }
+    end
+  end
+end

data/spec/factories/record/volume_factory.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :volume, parent: :record, class: "SBOM::CycloneDX::Record::Volume" do
+    trait :all_fields do
+      uid { Faker::Lorem.characters(number: 16) }
+      name { Faker::Lorem.word }
+      mode { SBOM::CycloneDX::Enum::VOLUME_MODE.sample }
+      path { Faker::File.dir }
+      size_allocated { "#{rand(0..1023)}#{["", "K", "M", "G", "T", "P"].sample}B" }
+      persistent { Faker::Boolean.boolean }
+      remote { Faker::Boolean.boolean }
+      properties { association_list(:property) }
+    end
+  end
+end

data/spec/factories/record/vulnerability_factory.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :vulnerability, parent: :record, class: "SBOM::CycloneDX::Record::Vulnerability" do
+    trait :all_fields do
+      bom_ref { generate(:ref_link) }
+      id { "CVE-#{rand(2015..2024)}-#{rand(100_000..999_999)}" }
+      source { association(:vulnerability_source) }
+      references { association_list(:reference) }
+      ratings { association_list(:rating) }
+      cwes { Array.new(rand(1..3)) { rand(1..999) } }
+      description { Faker::Lorem.sentence }
+      detail { Faker::Lorem.paragraph }
+      recommendation { Faker::Lorem.sentence }
+      workaround { Faker::Lorem.sentence }
+      proof_of_concept { association(:proof_of_concept) }
+      advisories { association_list(:advisory) }
+      created { Faker::Time.backward(days: 367) }
+      published { created + rand(1..7).days }
+      updated { published + rand(1..30).days }
+      rejected { updated + rand(1..30).days }
+      credits { association(:credits) }
+      tools { association(:tools) }
+      analysis { association(:analysis) }
+      affects { association_list(:affects) }
+      properties { association_list(:property) }
+    end
+  end
+
+  factory :analysis, parent: :record, class: "SBOM::CycloneDX::Record::Vulnerability::Analysis" do
+    trait :all_fields do
+      state { SBOM::CycloneDX::Enum::IMPACT_ANALYSIS_STATE.sample }
+      justification { SBOM::CycloneDX::Enum::IMPACT_ANALYSIS_JUSTIFICATION.sample }
+      response { SBOM::CycloneDX::Enum::RESPONSE.sample(rand(1..3)) }
+      detail { Faker::Lorem.paragraph }
+      first_issued { Faker::Time.backward(days: 367) }
+      last_updated { first_issued + rand(1..30).days }
+    end
+  end
+
+  factory :affects, parent: :record, class: "SBOM::CycloneDX::Record::Vulnerability::Affects" do
+    ref { generate(:ref_or_cdx_urn) }
+
+    trait :all_fields do
+      versions { association_list(:version) }
+    end
+  end
+
+  factory :credits, parent: :record, class: "SBOM::CycloneDX::Record::Vulnerability::Credits" do
+    trait :all_fields do
+      organizations { association_list(:organizational_entity) }
+      individuals { association_list(:organizational_contact) }
+    end
+  end
+
+  factory :proof_of_concept, parent: :record, class: "SBOM::CycloneDX::Record::Vulnerability::ProofOfConcept" do
+    trait :all_fields do
+      reproduction_steps { Faker::Lorem.paragraph }
+      environment { Faker::Lorem.word }
+      supporting_material { association_list(:attachment) }
+    end
+  end
+
+  factory :reference, parent: :record, class: "SBOM::CycloneDX::Record::Vulnerability::Reference" do
+    id { "CVE-#{rand(2015..2024)}-#{rand(100_000..999_999)}" }
+    source { association(:vulnerability_source) }
+
+    trait :all_fields
+  end
+end

data/spec/factories/record/vulnerability_source_factory.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :vulnerability_source, parent: :record, class: "SBOM::CycloneDX::Record::VulnerabilitySource" do
+    trait :all_fields do
+      url { generate(:url).to_s }
+      name { Faker::Lorem.word }
+    end
+  end
+end

data/spec/factories/record/workflow_factory.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :workflow, parent: :record, class: "SBOM::CycloneDX::Record::Workflow" do
+    bom_ref { generate(:ref_link) }
+    uid { SecureRandom.uuid }
+
+    trait :all_fields do
+      name { Faker::Lorem.word }
+      description { Faker::Lorem.sentence }
+      resource_references { association_list(:resource_reference_choice) }
+      tasks { association_list(:task) }
+      task_dependencies { association_list(:dependency) }
+      task_types { SBOM::CycloneDX::Enum::TASK_TYPE.sample(rand(1..3)) }
+      trigger { association(:trigger) }
+      steps { association_list(:step) }
+      inputs { association_list(:input) }
+      outputs { association_list(:output) }
+      time_start { Faker::Time.backward(days: 367) }
+      time_end { time_start + rand(1..100).hours }
+      workspaces { association_list(:workspace) }
+      runtime_topology { association_list(:dependency) }
+      properties { association_list(:property) }
+    end
+  end
+end

data/spec/factories/record/workspace_factory.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :workspace, parent: :record, class: "SBOM::CycloneDX::Record::Workspace" do
+    bom_ref { generate(:ref_link) }
+    uid { Faker::Lorem.characters(number: 16) }
+
+    trait :all_fields do
+      name { Faker::Lorem.word }
+      aliases { Faker::Lorem.words(number: rand(1..3)) }
+      description { Faker::Lorem.sentence }
+      resource_references { association_list(:resource_reference_choice) }
+      access_mode { SBOM::CycloneDX::Enum::ACCESS_MODE.sample }
+      mount_path { Faker::File.dir }
+      managed_data_type { Faker::Lorem.word }
+      volume_request { Faker::Lorem.word }
+      volume { association(:volume) }
+      properties { association_list(:property) }
+    end
+  end
+end

data/spec/factories/record_factory.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require "faker"
+require "i18n"
+require "sbom/cyclone_dx"
+require "sbom/cyclone_dx/record"
+
+module SBOM
+  module CycloneDX
+    module Record
+      module MockRecord
+        # Schema name: Basic
+        class Basic < Base
+          prop :string_value, :string
+        end
+
+        # Schema name: AllTypes
+        class AllTypes < Base
+          prop :string_value, :string
+          prop :integer_value, :integer
+          prop :float_value, :float
+          prop :boolean_value, :boolean
+          prop :basic_record_value, Basic
+          prop :array_value, :array, items: :string
+          prop :datetime_value, :date_time
+          prop :uri_value, :uri
+          prop :union_value, :union, of: %i[string integer]
+          prop :email_address_value, :email_address
+        end
+
+        # Schema name: RequiredMembers
+        class RequiredMembers < Base
+          prop :always_required, :string, required: true
+          prop :any_required_a, :string
+          prop :any_required_b, :string
+          prop :one_required_a, :string
+          prop :one_required_b, :string
+          prop :impl_required_a, :string
+          prop :impl_required_b, :string
+          prop :optional, :string
+
+          validate :any_required_a, :any_required_b, presence: :any
+          validate :one_required_a, :one_required_b, presence: :one
+          validate(:impl_required_a, :impl_required_b) { |a, b| a.nil? || b.present? }
+        end
+      end
+    end
+  end
+end
+
+FactoryBot.define do
+  factory :record, class: "SBOM::CycloneDX::Record" do
+    initialize_with { new(**attributes) }
+
+    factory :mock_record, class: "SBOM::CycloneDX::Record" do
+      trait :string_value do
+        string_value { Faker::Lorem.sentence }
+      end
+
+      trait :integer_value do
+        integer_value { rand(1..100) }
+      end
+
+      trait :float_value do
+        float_value { rand(1..100) + rand(0.01..0.99) }
+      end
+
+      trait :boolean_value do
+        boolean_value { [true, false].sample }
+      end
+
+      trait :basic_record_value do
+        basic_record_value { basic_record }
+      end
+
+      trait :array_value do
+        array_value { Faker::Lorem.words(number: 4) }
+      end
+
+      trait :datetime_value do
+        datetime_value { Faker::Time.between(from: DateTime.now - 2, to: DateTime.now) }
+      end
+
+      trait :uri_value do
+        uri_value { [URI.parse(Faker::Internet.url), Faker::Internet.url].sample }
+      end
+
+      trait :union_value do
+        union_value { [Faker::Marketing.buzzwords, rand(1..100)].sample }
+      end
+
+      trait :email_address_value do
+        email_address_value do
+          [EmailAddress::Address.new(Faker::Internet.email), Faker::Internet.email].sample
+        end
+      end
+
+      factory :basic_record, class: "SBOM::CycloneDX::Record::MockRecord::Basic", traits: [:string_value]
+
+      factory :all_types_record, class: "SBOM::CycloneDX::Record::MockRecord::AllTypes", traits: %i[
+        string_value
+        integer_value
+        float_value
+        boolean_value
+        basic_record_value
+        array_value
+        datetime_value
+        uri_value
+        union_value
+        email_address_value
+      ]
+
+      factory :required_members_record, class: "SBOM::CycloneDX::Record::MockRecord::RequiredMembers" do
+        trait :valid do
+          always_required { Faker::Lorem.word }
+          any_required_b { Faker::Lorem.word }
+          one_required_b { Faker::Lorem.word }
+        end
+
+        trait :missing_always_required do
+          any_required_b { Faker::Lorem.word }
+          one_required_b { Faker::Lorem.word }
+        end
+
+        trait :missing_any_required do
+          always_required { Faker::Lorem.word }
+          one_required_b { Faker::Lorem.word }
+        end
+
+        trait :missing_one_required do
+          always_required { Faker::Lorem.word }
+          any_required_b { Faker::Lorem.word }
+        end
+
+        trait :both_one_required do
+          always_required { Faker::Lorem.word }
+          any_required_b { Faker::Lorem.word }
+          one_required_a { Faker::Lorem.word }
+          one_required_b { Faker::Lorem.word }
+        end
+
+        trait :having_impl_required do
+          always_required { Faker::Lorem.word }
+          any_required_b { Faker::Lorem.word }
+          one_required_b { Faker::Lorem.word }
+          impl_required_a { Faker::Lorem.word }
+          impl_required_b { Faker::Lorem.word }
+        end
+
+        trait :having_impl_required_missing do
+          always_required { Faker::Lorem.word }
+          any_required_b { Faker::Lorem.word }
+          one_required_b { Faker::Lorem.word }
+          impl_required_a { Faker::Lorem.word }
+        end
+      end
+    end
+  end
+end