Strip fields newer than the target spec version when downgrading - #278
Open
sueun-dev wants to merge 1 commit into
Open
Strip fields newer than the target spec version when downgrading#278sueun-dev wants to merge 1 commit into
sueun-dev wants to merge 1 commit into
Conversation
BOM.convert already clears most fields introduced after the target spec version, but a few slip through, so encoding some BOMs to an older version produces output that fails that version's own JSON schema: - component.cryptoProperties (added in 1.6) survived a downgrade below 1.6; convertCryptoProperties only trims its inner 1.7 fields. - composition.bom-ref and composition.vulnerabilities (added in 1.5) survived a downgrade below 1.5. - vulnerability.analysis.firstIssued and lastUpdated (added in 1.5) survived a downgrade below 1.5. Each is now cleared alongside the fields the surrounding code already clears for the same versions. Adds Test_convert_stripsFieldsNewerThanTargetSpec, which downgrades the existing fixtures and validates the result against the target version's bundled schema. Signed-off-by: Sueun Cho <sueun.dev@gmail.com>
Up to standards ✅🟢 Issues
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BOM.convertalready clears most fields that were introduced after the target spec version, but a few slip through, so encoding some BOMs to an older version produces output that fails that version's own JSON schema.Three cases:
component.cryptoProperties(added in 1.6) survives a downgrade below 1.6.convertCryptoPropertiesonly trims its inner 1.7 fields, so a downgraded CBOM keeps the wholecryptoPropertiesobject.composition.bom-refandcomposition.vulnerabilities(added in 1.5) survive a downgrade below 1.5, whereconvertCompositionsonly normalized the aggregate.vulnerability.analysis.firstIssuedandlastUpdated(added in 1.5) survive a downgrade below 1.5.Each is now cleared next to the fields the surrounding code already clears for the same versions (
Tags,ProofOfConcept, and the rest). This is the same class as #248.Test_convert_stripsFieldsNewerThanTargetSpecdecodes the existingvalid-cryptographic-asset/valid-compositions/valid-vulnerabilityfixtures, re-encodes them at the older version, and validates the result against that version's bundled schema with the existingassertValidBOMhelper. Each subtest fails on master (the schema rejects the leftover field) and passes with the change.go test ./...andgo vet ./...are clean.