feat(spec1-5): add additional external reference types

Signed-off-by: nscuro <nscuro@protonmail.com>
CycloneDX · Jun 17, 2023 · 781a647 · 781a647
1 parent 0eb6205
commit 781a647
Show file tree

Hide file tree

Showing 2 changed files with 56 additions and 20 deletions.
diff --git a/convert.go b/convert.go
@@ -84,6 +84,10 @@ func (b *BOM) convert(specVersion SpecVersion) {
 		}
 	}
 
+	if b.ExternalReferences != nil {
+		convertExternalReferences(b.ExternalReferences, specVersion)
+	}
+
 	b.SpecVersion = specVersion
 	b.XMLNS = xmlNamespaces[specVersion]
 	b.JSONSchema = jsonSchemas[specVersion]
@@ -141,9 +145,15 @@ func convertExternalReferences(extRefs *[]ExternalReference, specVersion SpecVer
 		return
 	}
 
-	if specVersion < SpecVersion1_3 {
-		for i := range *extRefs {
-			(*extRefs)[i].Hashes = nil
+	for i := range *extRefs {
+		extRef := &(*extRefs)[i]
+
+		if !specVersion.supportsExternalReferenceType(extRef.Type) {
+			extRef.Type = ERTypeOther
+		}
+
+		if specVersion < SpecVersion1_3 {
+			extRef.Hashes = nil
 		}
 	}
 }
@@ -290,6 +300,18 @@ func (sv SpecVersion) supportsComponentType(cType ComponentType) bool {
 	return false
 }
 
+func (sv SpecVersion) supportsExternalReferenceType(ert ExternalReferenceType) bool {
+	switch ert {
+	case ERTypeAttestation, ERTypeCertificationReport, ERTypeCodifiedInfrastructure, ERTypeComponentAnalysisReport,
+		ERTypeDistributionIntake, ERTypeDynamicAnalysisReport, ERTypeExploitabilityStatement, ERTypeMaturityReport,
+		ERTypePentestReport, ERTypeQualityMetrics, ERTypeRuntimeAnalysisReport, ERTypeStaticAnalysisReport,
+		ERTypeThreatModel, ERTypeVulnerabilityAssertion:
+		return sv >= SpecVersion1_5
+	}
+
+	return sv >= SpecVersion1_1
+}
+
 func (sv SpecVersion) supportsHashAlgorithm(algo HashAlgorithm) bool {
 	switch algo {
 	case HashAlgoMD5, HashAlgoSHA1, HashAlgoSHA256, HashAlgoSHA384, HashAlgoSHA512, HashAlgoSHA3_256, HashAlgoSHA3_512:

diff --git a/cyclonedx.go b/cyclonedx.go
@@ -213,23 +213,37 @@ type ExternalReference struct {
 type ExternalReferenceType string
 
 const (
-	ERTypeAdvisories      ExternalReferenceType = "advisories"
-	ERTypeBOM             ExternalReferenceType = "bom"
-	ERTypeBuildMeta       ExternalReferenceType = "build-meta"
-	ERTypeBuildSystem     ExternalReferenceType = "build-system"
-	ERTypeChat            ExternalReferenceType = "chat"
-	ERTypeDistribution    ExternalReferenceType = "distribution"
-	ERTypeDocumentation   ExternalReferenceType = "documentation"
-	ERTypeLicense         ExternalReferenceType = "license"
-	ERTypeMailingList     ExternalReferenceType = "mailing-list"
-	ERTypeOther           ExternalReferenceType = "other"
-	ERTypeIssueTracker    ExternalReferenceType = "issue-tracker"
-	ERTypeReleaseNotes    ExternalReferenceType = "release-notes"
-	ERTypeSecurityContact ExternalReferenceType = "security-contact"
-	ERTypeSocial          ExternalReferenceType = "social"
-	ERTypeSupport         ExternalReferenceType = "support"
-	ERTypeVCS             ExternalReferenceType = "vcs"
-	ERTypeWebsite         ExternalReferenceType = "website"
+	ERTypeAdvisories              ExternalReferenceType = "advisories"
+	ERTypeAttestation             ExternalReferenceType = "attestation"
+	ERTypeBOM                     ExternalReferenceType = "bom"
+	ERTypeBuildMeta               ExternalReferenceType = "build-meta"
+	ERTypeBuildSystem             ExternalReferenceType = "build-system"
+	ERTypeCertificationReport     ExternalReferenceType = "certification-report"
+	ERTypeChat                    ExternalReferenceType = "chat"
+	ERTypeCodifiedInfrastructure  ExternalReferenceType = "codified-infrastructure"
+	ERTypeComponentAnalysisReport ExternalReferenceType = "component-analysis-report"
+	ERTypeDistribution            ExternalReferenceType = "distribution"
+	ERTypeDistributionIntake      ExternalReferenceType = "distribution-intake"
+	ERTypeDocumentation           ExternalReferenceType = "documentation"
+	ERTypeDynamicAnalysisReport   ExternalReferenceType = "dynamic-analysis-report"
+	ERTypeExploitabilityStatement ExternalReferenceType = "exploitability-statement"
+	ERTypeIssueTracker            ExternalReferenceType = "issue-tracker"
+	ERTypeLicense                 ExternalReferenceType = "license"
+	ERTypeMailingList             ExternalReferenceType = "mailing-list"
+	ERTypeMaturityReport          ExternalReferenceType = "maturity-report"
+	ERTypeOther                   ExternalReferenceType = "other"
+	ERTypePentestReport           ExternalReferenceType = "pentest-report"
+	ERTypeQualityMetrics          ExternalReferenceType = "quality-metrics"
+	ERTypeReleaseNotes            ExternalReferenceType = "release-notes"
+	ERTypeRuntimeAnalysisReport   ExternalReferenceType = "runtime-analysis-report"
+	ERTypeSecurityContact         ExternalReferenceType = "security-contact"
+	ERTypeSocial                  ExternalReferenceType = "social"
+	ERTypeStaticAnalysisReport    ExternalReferenceType = "static-analysis-report"
+	ERTypeSupport                 ExternalReferenceType = "support"
+	ERTypeThreatModel             ExternalReferenceType = "threat-model"
+	ERTypeVCS                     ExternalReferenceType = "vcs"
+	ERTypeVulnerabilityAssertion  ExternalReferenceType = "vulnerability-assertion"
+	ERTypeWebsite                 ExternalReferenceType = "website"
 )
 
 type Hash struct {