Feat/bsi2: add bomlinks for BSI:2.0

pkg/compliance/bsi.go

@@ -81,6 +81,7 @@ const (
 	SBOM_TYPE
 	PACK_EXT_REF
 	SBOM_VULNERABILITES
+	SBOM_BOM_LINKS
 )
 
 func bsiResult(ctx context.Context, doc sbom.Document, fileName string, outFormat string, colorOutput bool) {

pkg/compliance/bsiV2.go

@@ -44,10 +44,10 @@ func bsiV2Result(ctx context.Context, doc sbom.Document, fileName string, outFor
 	dtb.AddRecord(bsiCreator(doc))
 	dtb.AddRecord(bsiTimestamp(doc))
 	dtb.AddRecord(bsiSbomURI(doc))
+	dtb.AddRecord(bsiV2SbomLinks(doc))
 	dtb.AddRecords(bsiV2Components(doc))
 	// New SBOM fields
 	// dtb.AddRecord(bsiSbomSignature(doc))
-	// dtb.AddRecord(bsiSbomLinks(doc))
 
 	if outFormat == "json" {
 		bsiV2JSONReport(dtb, fileName)
@@ -62,6 +62,20 @@ func bsiV2Result(ctx context.Context, doc sbom.Document, fileName string, outFor
 	}
 }
 
+func bsiV2SbomLinks(doc sbom.Document) *db.Record {
+	result, score := "", 0.0
+
+	bom := doc.Spec().GetExtDocRef()
+	if bom != nil {
+		result = strings.Join(bom, ", ")
+		score = 10.0
+	}
+	wrappedURL := common.WrapText(result, 80)
+	result = wrappedURL
+
+	return db.NewRecordStmt(SBOM_BOM_LINKS, "doc", result, score, "")
+}
+
 func bsiV2Vulnerabilities(doc sbom.Document) *db.Record {
 	result, score := "no-vulnerability", 10.0
 

pkg/compliance/bsiV2_test.go

@@ -3,6 +3,7 @@ package compliance
 import (
 	"testing"
 
+	"github.com/interlynk-io/sbomqs/pkg/compliance/common"
 	db "github.com/interlynk-io/sbomqs/pkg/compliance/db"
 	"github.com/interlynk-io/sbomqs/pkg/sbom"
 	"gotest.tools/assert"
@@ -116,3 +117,162 @@ func TestBSIV2CDXSbomVulnerability(t *testing.T) {
 		assert.Equal(t, test.expected.result, test.actual.CheckValue, "Result mismatch for %s", test.name)
 	}
 }
+
+func spdxDocWithNoExtDocumentRefs() sbom.Document {
+	s := sbom.NewSpec()
+
+	s.ExternalDocReference = nil
+	doc := sbom.SpdxDoc{
+		SpdxSpec: s,
+	}
+	return doc
+}
+
+func spdxDocWithOneExtDocumentRefs() sbom.Document {
+	s := sbom.NewSpec()
+	spdxDocument := []string{"https://example.com/spdx/docs/toolsetX-v1.2"}
+	s.ExternalDocReference = spdxDocument
+	doc := sbom.SpdxDoc{
+		SpdxSpec: s,
+	}
+	return doc
+}
+
+func spdxDocWithMultipleExtDocumentRefs() sbom.Document {
+	s := sbom.NewSpec()
+	spdxDocument := []string{"https://interlynk.io/github.com%2Finterlynk-io%2Fsbomqs/0.0.15/qIP32aoJi0u5M_EjHeJHAg", "https://example.com/spdx/docs/toolsetX-v1.2"}
+	s.ExternalDocReference = spdxDocument
+	doc := sbom.SpdxDoc{
+		SpdxSpec: s,
+	}
+	return doc
+}
+
+func TestBSIV2SPDXSbomBomLinks(t *testing.T) {
+	value := "https://interlynk.io/github.com%2Finterlynk-io%2Fsbomqs/0.0.15/qIP32aoJi0u5M_EjHeJHAg, https://example.com/spdx/docs/toolsetX-v1.2"
+	wrappedURL := common.WrapText(value, 80)
+
+	testCases := []struct {
+		name     string
+		actual   *db.Record
+		expected desired
+	}{
+		{
+			name:   "SPDX SBOM with no bom links",
+			actual: bsiV2SbomLinks(spdxDocWithNoExtDocumentRefs()),
+			expected: desired{
+				score:  0.0,
+				result: "",
+				key:    SBOM_BOM_LINKS,
+				id:     "doc",
+			},
+		},
+		{
+			name:   "SPDX SBOM with one bom links",
+			actual: bsiV2SbomLinks(spdxDocWithOneExtDocumentRefs()),
+			expected: desired{
+				score:  10.0,
+				result: "https://example.com/spdx/docs/toolsetX-v1.2",
+				key:    SBOM_BOM_LINKS,
+				id:     "doc",
+			},
+		},
+		{
+			name:   "SPDX SBOM with two bom links vulnerability",
+			actual: bsiV2SbomLinks(spdxDocWithMultipleExtDocumentRefs()),
+			expected: desired{
+				score:  10.0,
+				result: wrappedURL,
+				key:    SBOM_BOM_LINKS,
+				id:     "doc",
+			},
+		},
+	}
+	for _, test := range testCases {
+		assert.Equal(t, test.expected.score, test.actual.Score, "Score mismatch for %s", test.name)
+		assert.Equal(t, test.expected.key, test.actual.CheckKey, "Key mismatch for %s", test.name)
+		assert.Equal(t, test.expected.id, test.actual.ID, "ID mismatch for %s", test.name)
+		assert.Equal(t, test.expected.result, test.actual.CheckValue, "Result mismatch for %s", test.name)
+	}
+}
+
+func cdxDocWithNoExtDocumentRefs() sbom.Document {
+	s := sbom.NewSpec()
+
+	s.ExternalDocReference = nil
+	doc := sbom.CdxDoc{
+		CdxSpec: s,
+	}
+	return doc
+}
+
+func cxDocWithOneExtDocumentRefs() sbom.Document {
+	s := sbom.NewSpec()
+	extRefs := []string{"https://raw.githubusercontent.com/bomctl/bomctl-playground/main/examples/bomctl-container-image/app/bomctl_0.3.0_linux_amd64.tar.gz.spdx.json"}
+	s.ExternalDocReference = extRefs
+	doc := sbom.SpdxDoc{
+		SpdxSpec: s,
+	}
+	return doc
+}
+
+func cxDocWithMultipleExtDocumentRefs() sbom.Document {
+	s := sbom.NewSpec()
+	extRefs := []string{"https://raw.githubusercontent.com/bomctl/bomctl-playground/main/examples/bomctl-container-image/app/bomctl_0.3.0_linux_amd64.tar.gz.spdx.json", "https://interlynk.io/github.com%2Finterlynk-io%2Fsbomqs/0.0.15/qIP32aoJi0u5M_EjHeJHAg"}
+	s.ExternalDocReference = extRefs
+	doc := sbom.SpdxDoc{
+		SpdxSpec: s,
+	}
+	return doc
+}
+
+func TestBSIV2CDXSbomBomLinks(t *testing.T) {
+	value := "https://raw.githubusercontent.com/bomctl/bomctl-playground/main/examples/bomctl-container-image/app/bomctl_0.3.0_linux_amd64.tar.gz.spdx.json"
+	wrappedURL := common.WrapText(value, 80)
+
+	value2 := "https://raw.githubusercontent.com/bomctl/bomctl-playground/main/examples/bomctl-container-image/app/bomctl_0.3.0_linux_amd64.tar.gz.spdx.json, https://interlynk.io/github.com%2Finterlynk-io%2Fsbomqs/0.0.15/qIP32aoJi0u5M_EjHeJHAg"
+	wrappedURL2 := common.WrapText(value2, 80)
+
+	testCases := []struct {
+		name     string
+		actual   *db.Record
+		expected desired
+	}{
+		{
+			name:   "CDX SBOM with no bom links",
+			actual: bsiV2SbomLinks(cdxDocWithNoExtDocumentRefs()),
+			expected: desired{
+				score:  0.0,
+				result: "",
+				key:    SBOM_BOM_LINKS,
+				id:     "doc",
+			},
+		},
+		{
+			name:   "CDX SBOM with one bom links",
+			actual: bsiV2SbomLinks(cxDocWithOneExtDocumentRefs()),
+			expected: desired{
+				score:  10.0,
+				result: wrappedURL,
+				key:    SBOM_BOM_LINKS,
+				id:     "doc",
+			},
+		},
+		{
+			name:   "CDX SBOM with one bom links",
+			actual: bsiV2SbomLinks(cxDocWithMultipleExtDocumentRefs()),
+			expected: desired{
+				score:  10.0,
+				result: wrappedURL2,
+				key:    SBOM_BOM_LINKS,
+				id:     "doc",
+			},
+		},
+	}
+	for _, test := range testCases {
+		assert.Equal(t, test.expected.score, test.actual.Score, "Score mismatch for %s", test.name)
+		assert.Equal(t, test.expected.key, test.actual.CheckKey, "Key mismatch for %s", test.name)
+		assert.Equal(t, test.expected.id, test.actual.ID, "ID mismatch for %s", test.name)
+		assert.Equal(t, test.expected.result, test.actual.CheckValue, "Result mismatch for %s", test.name)
+	}
+}

pkg/compliance/bsi_report.go

@@ -47,6 +47,7 @@ var bsiSectionDetails = map[int]bsiSection{
 	COMP_SOURCE_HASH:     {Title: "Additional fields components", ID: "5.3.2", Required: false, DataField: "Hash value of the source code of the component"},
 	COMP_OTHER_UNIQ_IDS:  {Title: "Additional fields components", ID: "5.3.2", Required: false, DataField: "Other unique identifiers"},
 	SBOM_VULNERABILITES:  {Title: "Definition of SBOM", ID: "3.1", Required: true, DataField: "vuln"},
+	SBOM_BOM_LINKS:       {Title: "Optional SBOM fields", ID: "8.1.12", Required: false, DataField: "bomlinks"},
 }
 
 type run struct {

pkg/compliance/common/common.go

@@ -448,3 +448,17 @@ func GetScoreColor(score float64) tablewriter.Colors {
 	}
 	return tablewriter.Colors{tablewriter.FgGreenColor, tablewriter.Bold}
 }
+
+func WrapText(input string, maxWidth int) string {
+	var result []string
+	for len(input) > maxWidth {
+		splitPoint := strings.LastIndex(input[:maxWidth], "/")
+		if splitPoint == -1 {
+			splitPoint = maxWidth
+		}
+		result = append(result, input[:splitPoint])
+		input = input[splitPoint:]
+	}
+	result = append(result, input)
+	return strings.Join(result, "\n")
+}

pkg/sbom/cdx.go

@@ -213,6 +213,14 @@ func (c *CdxDoc) parseSpec() {
 		sp.Uri = fmt.Sprintf("%s/%d", c.doc.SerialNumber, c.doc.Version)
 	}
 
+	if c.doc.ExternalReferences != nil {
+		for _, extRefs := range *c.doc.ExternalReferences {
+			if extRefs.Type == "bom" {
+				sp.ExternalDocReference = append(sp.ExternalDocReference, extRefs.URL)
+			}
+		}
+	}
+
 	c.CdxSpec = sp
 }
 

pkg/sbom/spdx.go

@@ -197,6 +197,12 @@ func (s *SpdxDoc) parseSpec() {
 	sp.SpecType = string(SBOMSpecSPDX)
 	sp.Name = s.doc.DocumentName
 
+	if s.doc.ExternalDocumentReferences != nil {
+		for _, bom := range s.doc.ExternalDocumentReferences {
+			sp.ExternalDocReference = append(sp.ExternalDocReference, bom.URI)
+		}
+	}
+
 	sp.isReqFieldsPresent = s.requiredFields()
 
 	if s.doc.CreationInfo != nil {

pkg/sbom/spec.go

@@ -32,21 +32,23 @@ type Spec interface {
 	GetOrganization() string
 	GetComment() string
 	GetSpdxID() string
+	GetExtDocRef() []string
 }
 
 type Specs struct {
-	Version            string
-	Format             string
-	SpecType           string
-	Name               string
-	isReqFieldsPresent bool
-	Licenses           []licenses.License
-	CreationTimestamp  string
-	Namespace          string
-	Uri                string
-	Organization       string
-	Comment            string
-	Spdxid             string
+	Version              string
+	Format               string
+	SpecType             string
+	Name                 string
+	isReqFieldsPresent   bool
+	Licenses             []licenses.License
+	CreationTimestamp    string
+	Namespace            string
+	Uri                  string
+	Organization         string
+	Comment              string
+	Spdxid               string
+	ExternalDocReference []string
 }
 
 func NewSpec() *Specs {
@@ -104,3 +106,7 @@ func (s Specs) GetNamespace() string {
 func (s Specs) URI() string {
 	return s.Uri
 }
+
+func (s Specs) GetExtDocRef() []string {
+	return s.ExternalDocReference
+}