sbom 0.4.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea09b1deb0550d9a03da739b170da712b89c73415462752f51cb133c43639978
-  data.tar.gz: '019af2723634da6944d51280f8b8fb9b3bd8155135d01ad1464a102b1efc31a1'
+  metadata.gz: 91a2d7468e5e306cb02358a3d4c55d5169cb54e1b022d9ef1cd99f9795713b27
+  data.tar.gz: 6bc9e80848847c7f9cd535acc4b2747f03e6e944982da35c1b5bcfcad9a55c99
 SHA512:
-  metadata.gz: dd10cb7772869ca0e7a22f60668cdaa76b5fcdd5dabf938894078c3a0936f2ad7897b0cf00487d47b1b191815025c2c722007d7a6a77d03e2d788a42388c6c89
-  data.tar.gz: 4696e6a8d0bebdcb97f8022e9a4c25f52f5e7930fa040391432e2e28bf2ef013b6c1c1d76bf4931e7fb69605a74cf457db76be92eaea2cc76a7a63b5ccac8159
+  metadata.gz: 30b94e777404ed7bf30f3a4f4911079e391a1c51a046175a31a1333b4635a7e4aa16d52d85ff9ccbbc3ecbee29326b89cbd84e78eabb2a4b38a38e42731cddec
+  data.tar.gz: f6ee5ca68429f3bce881b7213e92fab8e030182ecf0cbdffa8ee94799d32cf6ef87c91b9bff589ed99e0792313c826eb8db24355ec7b55637335fc85ea1a2492

data/.ruby-version

@@ -1 +1 @@
-4.0.0
+4.0.5

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 ## [Unreleased]
 
+## [0.5.0] - 2026-06-26
+
+- CycloneDX generator: support `analysis` on vulnerabilities (`state`, `justification`, `response`, `detail`, `firstIssued`, `lastUpdated`)
+- CycloneDX generator: support `pedigree` on components (`patches` with `type`/`diff`/`resolves`, and `notes`)
+
 ## [0.4.1] - 2026-01-14
 
 - Include CycloneDX and SPDX schema files in published gem

data/README.md

@@ -63,6 +63,7 @@ data = {
       ratings: [{ severity: "high", score: 8.1, method: "CVSSv31" }],
       description: "A critical vulnerability",
       affects: [{ ref: "pkg:npm/lodash@4.17.20" }],
+      analysis: { state: "resolved", detail: "Patched by distro" },
       published: "2024-01-15T00:00:00Z",
       updated: "2024-01-20T12:00:00Z"
     }

data/lib/sbom/cyclonedx/generator.rb

@@ -207,9 +207,68 @@ module Sbom
           end
         end
 
+        pedigree = generate_pedigree(pkg[:pedigree])
+        component["pedigree"] = pedigree if pedigree
+
         @components << component
       end
 
+      def generate_pedigree(pedigree)
+        return nil unless pedigree
+
+        result = {}
+
+        if pedigree[:patches]&.any?
+          patches = pedigree[:patches].map { |p| generate_pedigree_patch(p) }.compact
+          result["patches"] = patches if patches.any?
+        end
+        result["notes"] = pedigree[:notes] if pedigree[:notes]
+
+        result.empty? ? nil : result
+      end
+
+      def generate_pedigree_patch(patch)
+        # CycloneDX requires `type` on patch objects; drop entries without one
+        # rather than emit `{}` or an empty-string type that fails validation.
+        return nil unless patch && patch[:type]
+
+        result = { "type" => patch[:type].to_s }
+
+        if patch[:diff]
+          diff = {}
+          diff["text"] = patch[:diff][:text] if patch[:diff][:text]
+          diff["url"] = patch[:diff][:url] if patch[:diff][:url]
+          result["diff"] = diff if diff.any?
+        end
+
+        if patch[:resolves]&.any?
+          resolves = patch[:resolves].map { |i| generate_issue(i) }.compact
+          result["resolves"] = resolves if resolves.any?
+        end
+
+        result
+      end
+
+      def generate_issue(issue)
+        # `type` is required on CycloneDX issue objects.
+        return nil unless issue && issue[:type]
+
+        result = { "type" => issue[:type].to_s }
+        result["id"] = issue[:id] if issue[:id]
+        result["name"] = issue[:name] if issue[:name]
+        result["description"] = issue[:description] if issue[:description]
+
+        if issue[:source]
+          source = {}
+          source["name"] = issue[:source][:name] if issue[:source][:name]
+          source["url"] = issue[:source][:url] if issue[:source][:url]
+          result["source"] = source if source.any?
+        end
+
+        result["references"] = Array(issue[:references]) if issue[:references]
+        result
+      end
+
       def generate_dependencies(relationships_data)
         return unless relationships_data&.any?
 
@@ -274,12 +333,29 @@ module Sbom
           end
         end
 
+        analysis = generate_analysis(vuln[:analysis])
+        vulnerability["analysis"] = analysis if analysis
+
         vulnerability["published"] = vuln[:published] if vuln[:published]
         vulnerability["updated"] = vuln[:updated] if vuln[:updated]
 
         @vulnerabilities << vulnerability
       end
 
+      def generate_analysis(analysis)
+        return nil unless analysis
+
+        result = {}
+        result["state"] = analysis[:state] if analysis[:state]
+        result["justification"] = analysis[:justification] if analysis[:justification]
+        result["response"] = Array(analysis[:response]) if analysis[:response]
+        result["detail"] = analysis[:detail] if analysis[:detail]
+        result["firstIssued"] = analysis[:first_issued] if analysis[:first_issued]
+        result["lastUpdated"] = analysis[:last_updated] if analysis[:last_updated]
+
+        result.empty? ? nil : result
+      end
+
       def finalize_output
         @output["components"] = @components if @components.any?
         @output["dependencies"] = @dependencies if @dependencies.any?

data/lib/sbom/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sbom
-  VERSION = "0.4.1"
+  VERSION = "0.5.0"
 end

data/spec/cyclonedx/schema/bom-1.6.schema.json

@@ -536,7 +536,7 @@
       "description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.",
       "type": "string",
       "minLength": 1,
-      "$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'"
+      "$comment": "TODO (breaking change): add a format constraint that prevents the value from starting with 'urn:cdx:'"
     },
     "refLinkType": {
       "description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.",
@@ -1161,7 +1161,7 @@
         "contentType": {
           "type": "string",
           "title": "Content-Type",
-          "description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
+          "description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
           "default": "text/plain",
           "examples": [
             "text/plain",
@@ -2681,7 +2681,7 @@
         "ratings": {
           "type": "array",
           "title": "Ratings",
-          "description": "List of vulnerability ratings",
+          "description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
           "items": {
             "$ref": "#/definitions/rating"
           }

data/spec/cyclonedx/schema/bom-1.7.schema.json

@@ -555,7 +555,7 @@
       "description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.",
       "type": "string",
       "minLength": 1,
-      "$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'"
+      "$comment": "TODO (breaking change): add a format constraint that prevents the value from starting with 'urn:cdx:'"
     },
     "refLinkType": {
       "title": "BOM Reference",
@@ -1248,7 +1248,7 @@
         "contentType": {
           "type": "string",
           "title": "Content-Type",
-          "description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
+          "description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
           "default": "text/plain",
           "examples": [
             "text/plain",
@@ -2841,7 +2841,7 @@
         "ratings": {
           "type": "array",
           "title": "Ratings",
-          "description": "List of vulnerability ratings",
+          "description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
           "items": {
             "$ref": "#/definitions/rating"
           }

data/spec/spdx/schemas/spdx-schema.json

@@ -20,7 +20,8 @@
         "properties" : {
           "annotationDate" : {
             "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
-            "type" : "string"
+            "type" : "string",
+            "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
           },
           "annotationType" : {
             "description" : "Type of the annotation.",
@@ -51,7 +52,8 @@
         },
         "created" : {
           "description" : "Identify when the SPDX document was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard.",
-          "type" : "string"
+          "type" : "string",
+          "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
         },
         "creators" : {
           "description" : "Identify who (or what, in the case of a tool) created the SPDX document. If the SPDX document was created by an individual, indicate the person's name. If the SPDX document was created on behalf of a company or organization, indicate the entity name. If the SPDX document was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.",
@@ -149,7 +151,8 @@
                 },
                 "timestamp" : {
                   "description" : "Timestamp",
-                  "type" : "string"
+                  "type" : "string",
+                  "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
                 },
                 "url" : {
                   "description" : "URL Reference",
@@ -201,7 +204,8 @@
           },
           "reviewDate" : {
             "description" : "The date and time at which the SpdxDocument was reviewed. This value must be in UTC and have 'Z' as its timezone indicator.",
-            "type" : "string"
+            "type" : "string",
+            "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
           },
           "reviewer" : {
             "description" : "The name and, optionally, contact information of the person who performed the review. Values of this property must conform to the agent and tool syntax.  The reviewer property is deprecated in favor of Annotation with an annotationType review.",
@@ -249,7 +253,8 @@
               "properties" : {
                 "annotationDate" : {
                   "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
-                  "type" : "string"
+                  "type" : "string",
+                  "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
                 },
                 "annotationType" : {
                   "description" : "Type of the annotation.",
@@ -279,7 +284,8 @@
           },
           "builtDate" : {
             "description" : "This field provides a place for recording the actual date the package was built.",
-            "type" : "string"
+            "type" : "string",
+            "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
           },
           "checksums" : {
             "description" : "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.",
@@ -421,7 +427,8 @@
           },
           "releaseDate" : {
             "description" : "This field provides a place for recording the date the package was released.",
-            "type" : "string"
+            "type" : "string",
+            "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
           },
           "sourceInfo" : {
             "description" : "Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.",
@@ -437,7 +444,8 @@
           },
           "validUntilDate" : {
             "description" : "This field provides a place for recording the end of the support period for a package from the supplier.",
-            "type" : "string"
+            "type" : "string",
+            "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
           },
           "versionInfo" : {
             "description" : "Provides an indication of the version of the package that is described by this SpdxDocument.",
@@ -466,7 +474,8 @@
               "properties" : {
                 "annotationDate" : {
                   "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
-                  "type" : "string"
+                  "type" : "string",
+                  "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
                 },
                 "annotationType" : {
                   "description" : "Type of the annotation.",
@@ -603,7 +612,8 @@
               "properties" : {
                 "annotationDate" : {
                   "description" : "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.",
-                  "type" : "string"
+                  "type" : "string",
+                  "pattern" : "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T(([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]|23:59:60)Z$"
                 },
                 "annotationType" : {
                   "description" : "Type of the annotation.",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sbom
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.0
 platform: ruby
 authors:
 - Andrew Nesbitt
@@ -123,7 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.12
 specification_version: 4
 summary: Parse, generate, and validate Software Bill of Materials (SBOM)
 test_files: []