@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/helpers/bomSigner.js

@@ -63,9 +63,10 @@ const NESTED_TARGETS = ["components", "services", "annotations"];
 export const MAX_SIGNATURE_ENTRIES = 32;
 
 /**
- * Members the CycloneDX 1.4 to 1.7 and 2.0 schemas define at the root of a
- * BOM. A root signature is only accepted on an object made of these members,
- * so a signed component, service, or annotation cannot pass as a signed BOM.
+ * Members the CycloneDX 1.4 to 1.7 schemas define at the root of a BOM, plus
+ * `specFormat`, which an early 2.0 draft used in place of `bomFormat`. A JSF
+ * root signature is only accepted on an object made of these members, so a
+ * signed component, service, or annotation cannot pass as a signed BOM.
  */
 export const BOM_ROOT_MEMBERS = Object.freeze([
   "$schema",
@@ -90,6 +91,39 @@ export const BOM_ROOT_MEMBERS = Object.freeze([
   "signature",
 ]);
 
+/**
+ * Members the CycloneDX 2.0 draft schema defines at the root of a document.
+ * A JSS root signature (lib/helpers/jssSigner.js) is only accepted on an
+ * object made of these members.
+ */
+export const BOM_20_ROOT_MEMBERS = Object.freeze([
+  "$schema",
+  "$comment",
+  "specFormat",
+  "specVersion",
+  "serialNumber",
+  "version",
+  "metadata",
+  "inventories",
+  "dependencies",
+  "compositions",
+  "vulnerabilities",
+  "threats",
+  "risks",
+  "controls",
+  "annotations",
+  "formulation",
+  "declarations",
+  "definitions",
+  "blueprints",
+  "profiles",
+  "citations",
+  "perspectives",
+  "properties",
+  "externalReferences",
+  "signatures",
+]);
+
 const BOM_ROOT_MEMBER_SET = new Set(BOM_ROOT_MEMBERS);
 
 // Members that identify a BOM. Components, services, and annotations never hold
@@ -163,7 +197,7 @@ function bomIdentityMembers(item) {
  * @param {any} value - The JSON object/value to canonicalize
  * @returns {string|undefined} - Canonicalized JSON string, or undefined for values JSON omits
  */
-function canonicalize(value) {
+export function canonicalizeJson(value) {
   if (typeof value?.toJSON === "function") {
     value = value.toJSON();
   }
@@ -171,11 +205,11 @@ function canonicalize(value) {
     return JSON.stringify(value);
   }
   if (Array.isArray(value)) {
-    return `[${value.map((item) => canonicalize(item) ?? "null").join(",")}]`;
+    return `[${value.map((item) => canonicalizeJson(item) ?? "null").join(",")}]`;
   }
   const members = [];
   for (const key of Object.keys(value).sort()) {
-    const member = canonicalize(value[key]);
+    const member = canonicalizeJson(value[key]);
     if (member !== undefined) {
       members.push(`${JSON.stringify(key)}:${member}`);
     }
@@ -196,12 +230,12 @@ function canonicalize(value) {
 function signedViewSerializer(content) {
   if (typeof content.toJSON === "function") {
     return (signature) =>
-      Buffer.from(canonicalize({ ...content, signature }), "utf8");
+      Buffer.from(canonicalizeJson({ ...content, signature }), "utf8");
   }
   const before = [];
   const after = [];
   for (const name of Object.keys(content).sort()) {
-    const member = canonicalize(content[name]);
+    const member = canonicalizeJson(content[name]);
     if (member !== undefined) {
       (name < "signature" ? before : after).push(
         `${JSON.stringify(name)}:${member}`,
@@ -216,7 +250,7 @@ function signedViewSerializer(content) {
   return (signature) =>
     Buffer.concat([
       head,
-      Buffer.from(`"signature":${canonicalize(signature)}`, "utf8"),
+      Buffer.from(`"signature":${canonicalizeJson(signature)}`, "utf8"),
       tail,
     ]);
 }