Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: SPDX relationships in sbom #6868

Closed
wants to merge 1 commit into from
Closed

fix: SPDX relationships in sbom #6868

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/lib/content/commands/npm-sbom.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,9 +196,9 @@ dependencies for the current project. SBOMs can be generated in either
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-simple-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-lodash-4.17.21",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-lodash-4.17.21",
"relatedSpdxElement": "SPDXRef-Package-simple-1.0.0",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down
8 changes: 4 additions & 4 deletions lib/utils/sbom-spdx.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,10 @@ const SPDX_IDENTIFER = 'SPDXRef-DOCUMENT'
const NO_ASSERTION = 'NOASSERTION'

const REL_DESCRIBES = 'DESCRIBES'
const REL_PREREQ = 'HAS_PREREQUISITE'
const REL_PREREQ = 'PREREQUISITE_FOR'
const REL_OPTIONAL = 'OPTIONAL_DEPENDENCY_OF'
const REL_DEV = 'DEV_DEPENDENCY_OF'
const REL_DEP = 'DEPENDS_ON'
const REL_DEP = 'DEPENDENCY_OF'

const REF_CAT_PACKAGE_MANAGER = 'PACKAGE-MANAGER'
const REF_TYPE_PURL = 'purl'
Expand Down Expand Up @@ -140,8 +140,8 @@ const toSpdxRelationship = (node, edge) => {
}

return {
spdxElementId: toSpdxID(node),
relatedSpdxElement: toSpdxID(edge.to),
spdxElementId: toSpdxID(edge.to),
relatedSpdxElement: toSpdxID(node),
relationshipType: type,
}
}
Expand Down
216 changes: 108 additions & 108 deletions tap-snapshots/test/lib/commands/sbom.js.test.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,14 +82,14 @@ exports[`test/lib/commands/sbom.js TAP sbom --omit dev > must match snapshot 1`]
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-dog-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-dog-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down Expand Up @@ -155,9 +155,9 @@ exports[`test/lib/commands/sbom.js TAP sbom --omit optional > must match snapsho
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-chai-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-chai-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down Expand Up @@ -223,9 +223,9 @@ exports[`test/lib/commands/sbom.js TAP sbom --omit peer > must match snapshot 1`
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-chai-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-chai-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down Expand Up @@ -435,19 +435,19 @@ exports[`test/lib/commands/sbom.js TAP sbom basic sbom - spdx > must match snaps
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-chai-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-chai-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-sbom-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-dog-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-dog-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down Expand Up @@ -547,18 +547,18 @@ exports[`test/lib/commands/sbom.js TAP sbom extraneous dep > must match snapshot
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-ls-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-ls-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-dog-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-dog-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-ls-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-chai-1.0.0",
"spdxElementId": "SPDXRef-Package-chai-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-ls-1.0.0",
"relationshipType": "OPTIONAL_DEPENDENCY_OF"
}
]
Expand Down Expand Up @@ -710,39 +710,39 @@ exports[`test/lib/commands/sbom.js TAP sbom loading a tree containing workspaces
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-a-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-a-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-d-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-d-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-a-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-c-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-c-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-a-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-a-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-d-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-d-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-a-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-a-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-baz-1.0.0",
"spdxElementId": "SPDXRef-Package-baz-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-a-1.0.0",
"relationshipType": "DEV_DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-d-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.1.1",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-foo-1.1.1",
"relatedSpdxElement": "SPDXRef-Package-d-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-foo-1.1.1",
"relatedSpdxElement": "SPDXRef-Package-bar-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-bar-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.1.1",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down Expand Up @@ -825,14 +825,14 @@ exports[`test/lib/commands/sbom.js TAP sbom loading a tree containing workspaces
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-e-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-e-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-f-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-f-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down Expand Up @@ -1051,59 +1051,59 @@ exports[`test/lib/commands/sbom.js TAP sbom loading a tree containing workspaces
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-a-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-a-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-b-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-b-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-d-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-d-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-e-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-e-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-f-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-f-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-pacote-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-pacote-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-a-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-c-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-c-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-a-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-a-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-d-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-d-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-a-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-a-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-baz-1.0.0",
"spdxElementId": "SPDXRef-Package-baz-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-a-1.0.0",
"relationshipType": "DEV_DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-d-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.1.1",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-foo-1.1.1",
"relatedSpdxElement": "SPDXRef-Package-d-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-foo-1.1.1",
"relatedSpdxElement": "SPDXRef-Package-bar-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-bar-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.1.1",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down Expand Up @@ -1169,9 +1169,9 @@ exports[`test/lib/commands/sbom.js TAP sbom loading a tree containing workspaces
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-workspaces-tree-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-pacote-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-pacote-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-workspaces-tree-1.0.0",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down Expand Up @@ -1275,19 +1275,19 @@ exports[`test/lib/commands/sbom.js TAP sbom lock file only > must match snapshot
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-ls-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-ls-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-ls-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-chai-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-chai-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-ls-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-dog-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-dog-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down Expand Up @@ -1387,19 +1387,19 @@ exports[`test/lib/commands/sbom.js TAP sbom missing (optional) dep > must match
"relationshipType": "DESCRIBES"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-ls-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-ls-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-test-npm-ls-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-chai-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-chai-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-test-npm-ls-1.0.0",
"relationshipType": "DEPENDENCY_OF"
},
{
"spdxElementId": "SPDXRef-Package-foo-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-dog-1.0.0",
"relationshipType": "DEPENDS_ON"
"spdxElementId": "SPDXRef-Package-dog-1.0.0",
"relatedSpdxElement": "SPDXRef-Package-foo-1.0.0",
"relationshipType": "DEPENDENCY_OF"
}
]
}
Expand Down
2 changes: 1 addition & 1 deletion tap-snapshots/test/lib/docs.js.test.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1421,7 +1421,7 @@ SBOM format to use when generating SBOMs.
* Type: "library", "application", or "framework"

The type of package described by the generated SBOM. For SPDX, this is the
value for the \`primaryPackagePurpose\` fieled. For CycloneDX, this is the
value for the \`primaryPackagePurpose\` field. For CycloneDX, this is the
value for the \`type\` field.


Expand Down
Loading