transformer: add component metadata following BSI TR-03183-2 taxonomy#1
transformer: add component metadata following BSI TR-03183-2 taxonomy#1charludo wants to merge 1 commit into
Conversation
| .strip_prefix("/nix/store/") | ||
| .unwrap_or(&derivation.path), | ||
| ), | ||
| Property::new("bsi:component:archive", "no archive"), |
There was a problem hiding this comment.
I wonder if this is the right classification: the TR seems to distinguish individual files and archives, so archive may be appropriate unless the store path is a file?
There was a problem hiding this comment.
Yeah this is debatable. And just one of the cases there the BSI spec doesn't really match our usecase well. I found this a rather useful overview: https://github.com/BSI-Bund/tr-03183-cyclonedx-property-taxonomy - sadly pretty explicitly states that we MUST set this field.
Since a nix store path is always a dir, IMO "no archive" is more correct than "archive". Though to be fair: "An archive is a combination of multiple components."
This isn't just an issue with archive, a lot of the values are hard to set/guess.
Edit: hold on
| .unwrap_or(&derivation.path), | ||
| ), | ||
| Property::new("bsi:component:archive", "no archive"), | ||
| Property::new("bsi:component:structured", "structured"), |
There was a problem hiding this comment.
Technically, the store path does not have the metadata anymore. Are we setting this to structured because the metadata is still available, but elsewhere?
| } | ||
| Some(OrganizationalEntity { | ||
| bom_ref: None, | ||
| name: Some(NormalizedString::new(&names.join(", "))), |
There was a problem hiding this comment.
From 5.2.1 and 5.2.2:
Email address of the entity that created and, if applicable, maintains the
respective component. If no email address is available this MUST be a
“Uniform Resource Locator (URL)”, e.g. the creator’s home page or the
project’s web page.
Should this try the email field and fall back to constructing a Github link instead? Does the spec allow multiple entities?
2 participants
Upstream PR: nikstur#207