Skip to content

[BUG] XML Schema Violation: externalReferences.hashes included in XML BOM schema versions 1.1 and 1.2 #152

@madpah

Description

@madpah

Example BOM generation:

bom = Bom(components=[
        Component(
            name='toml', version='0.10.2', bom_ref='pkg:pypi/[email protected]?extension=tar.gz',
            purl=PackageURL(
                type='pypi', name='toml', version='0.10.2', qualifiers='extension=tar.gz'
            ), hashes=[
                HashType.from_composite_str('sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b')
            ], external_references=[
                get_external_reference_1()
            ]
        )
    ])

Generates

...
<externalReferences>
                <reference type="distribution">
                    <url>https://cyclonedx.org</url>
                    <comment>No comment</comment>
                    <hashes>
                        <hash alg="SHA-256">806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b</hash>
                    </hashes>
                </reference>
            </externalReferences>
...

.externalReferences.hashes is not part of the schema prior to version 1.3.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions