Skip to content

Commit 453b306

Browse files
jkowalleckjkowalleck
authored
feat: support CycloneDX v1.6 (#477)
* bump deps Signed-off-by: Jan Kowalleck <[email protected]> * docs Signed-off-by: Jan Kowalleck <[email protected]> * docs Signed-off-by: Jan Kowalleck <[email protected]> * docs Signed-off-by: Jan Kowalleck <[email protected]> * tests Signed-off-by: Jan Kowalleck <[email protected]> * docs Signed-off-by: Jan Kowalleck <[email protected]> * test res Signed-off-by: Jan Kowalleck <[email protected]> * demo Signed-off-by: Jan Kowalleck <[email protected]> * demo Signed-off-by: Jan Kowalleck <[email protected]> * demo res Signed-off-by: Jan Kowalleck <[email protected]> * demo res Signed-off-by: Jan Kowalleck <[email protected]> * test res Signed-off-by: Jan Kowalleck <[email protected]> --------- Signed-off-by: Jan Kowalleck <[email protected]>
1 parent 72c9d5c commit 453b306

File tree

18 files changed

+9841
-28
lines changed

18 files changed

+9841
-28
lines changed

‎HISTORY.md

+11
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,19 @@ All notable changes to this project will be documented in this file.
44

55
## unreleased
66

7+
<!-- add unreleased items here -->
8+
9+
Added _basic_ support for [_CycloneDX_ Specification-1.6](https://github.com/CycloneDX/specification/releases/tag/1.6).
10+
11+
* Changed
12+
* This tool supports _CycloneDX_ Specification-1.6 now (via [#])
13+
* Added
14+
* CLI switch `--spec-version` now supports value `1.6` to reflect _CycloneDX_ Specification-1.6 (via [#])
15+
Default value for that switch is unchanged - still `1.5`.
716
* Style
817
* Applied latest PHP Coding Standards (via [#469])
18+
* Dependencies
19+
* Raised dependency `cyclonedx/cyclonedx-library:^3.2`, was `:^3.1` (via [#])
920

1021
[#469]: https://github.com/CycloneDX/cyclonedx-php-composer/pull/469
1122

‎README.md

+8-4
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,17 @@ Arguments:
6565

6666
Options:
6767
--output-format=OUTPUT-FORMAT Which output format to use.
68-
{choices: "JSON", "XML"} [default: "XML"]
68+
{choices: "JSON", "XML"}
69+
[default: "XML"]
6970
--output-file=OUTPUT-FILE Path to the output file.
70-
Set to "-" to write to STDOUT [default: "-"]
71+
Set to "-" to write to STDOUT
72+
[default: "-"]
7173
--omit=OMIT Omit dependency types.
72-
{choices: "dev", "plugin"} (multiple values allowed)
74+
{choices: "dev", "plugin"}
75+
(multiple values allowed)
7376
--spec-version=SPEC-VERSION Which version of CycloneDX spec to use.
74-
{choices: "1.1", "1.2", "1.3", "1.4", "1.5"} [default: "1.5"]
77+
{choices: "1.1", "1.2", "1.3", "1.4", "1.5", "1.6"}
78+
[default: "1.5"]
7579
--output-reproducible|--no-output-reproducible Whether to go the extra mile and make the output reproducible.
7680
This might result in loss of time- and random-based-values.
7781
--validate|--no-validate Formal validate the resulting BOM.

‎composer.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
"require": {
3636
"php": "^8.1",
3737
"composer-plugin-api": "^2.3",
38-
"cyclonedx/cyclonedx-library": "^3.1",
38+
"cyclonedx/cyclonedx-library": "^3.2",
3939
"package-url/packageurl-php": "^1.0"
4040
},
4141
"require-dev": {

‎demo/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ and how the generated output will look like.
2626

2727
## Maintenance
2828

29+
Resulting SBOM data may be generated during [integration tests](../tests/Integration/CommandMakeSbomAsExpectedTest.php).
30+
2931
Files in `**/project/**` are marked as `linguist-vendored` in the `.gitattributes`.
3032
Therefore, the requirements/dependencies are
3133
[not maintained by dependabot](https://docs.github.com/en/code-security/supply-chain-security/configuration-options-for-dependency-updates#vendor).

‎demo/devReq/project/composer.json

+2
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
"@putenv CDX_CP_TOOLS_VERSION_OVERRIDE=in-dev",
4040
"@putenv CDX_CP_TOOLS_EXCLUDE_LIBS=1",
4141
"@putenv CDX_CP_TOOLS_EXCLUDE_COMPOSER=1",
42+
"@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.6 --output-reproducible --output-format=JSON --output-file=$PWD/../results/bom.1.6.json $PWD/composer.json",
4243
"@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.5 --output-reproducible --output-format=JSON --output-file=$PWD/../results/bom.1.5.json $PWD/composer.json",
4344
"@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.4 --output-reproducible --output-format=JSON --output-file=$PWD/../results/bom.1.4.json $PWD/composer.json",
4445
"@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.3 --output-reproducible --output-format=JSON --output-file=$PWD/../results/bom.1.3.json $PWD/composer.json",
@@ -48,6 +49,7 @@
4849
"@putenv CDX_CP_TOOLS_VERSION_OVERRIDE=in-dev",
4950
"@putenv CDX_CP_TOOLS_EXCLUDE_LIBS=1",
5051
"@putenv CDX_CP_TOOLS_EXCLUDE_COMPOSER=1",
52+
"@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.6 --output-reproducible --output-format=XML --output-file=$PWD/../results/bom.1.6.xml $PWD/composer.json",
5153
"@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.5 --output-reproducible --output-format=XML --output-file=$PWD/../results/bom.1.5.xml $PWD/composer.json",
5254
"@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.4 --output-reproducible --output-format=XML --output-file=$PWD/../results/bom.1.4.xml $PWD/composer.json",
5355
"@composer -d ../../.tool CycloneDX:make-sbom --validate --spec-version=1.3 --output-reproducible --output-format=XML --output-file=$PWD/../results/bom.1.3.xml $PWD/composer.json",

0 commit comments

Comments
 (0)