wip to use py-serializable for output to XML

Signed-off-by: Paul Horton <[email protected]>

Author: madpah

cyclonedx/model/__init__.py

@@ -493,7 +493,8 @@ def __init__(self, *, type_: ExternalReferenceType, url: XsUri, comment: Optiona
         self.type_ = type_
         self.hashes = hashes or []  # type: ignore
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(1)
     def url(self) -> XsUri:
         """
         The URL to the external reference.
@@ -931,7 +932,8 @@ def text(self) -> NoteText:
     def text(self, text: NoteText) -> None:
         self._text = text
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(1)
     def locale(self) -> Optional[str]:
         """
         Get the ISO locale of this Note.
@@ -993,7 +995,8 @@ def __init__(self, *, name: Optional[str] = None, phone: Optional[str] = None, e
         self.email = email
         self.phone = phone
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(1)
     def name(self) -> Optional[str]:
         """
         Get the name of the contact.
@@ -1007,7 +1010,8 @@ def name(self) -> Optional[str]:
     def name(self, name: Optional[str]) -> None:
         self._name = name
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(2)
     def email(self) -> Optional[str]:
         """
         Get the email of the contact.
@@ -1021,7 +1025,8 @@ def email(self) -> Optional[str]:
     def email(self, email: Optional[str]) -> None:
         self._email = email
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(3)
     def phone(self) -> Optional[str]:
         """
         Get the phone of the contact.
@@ -1073,7 +1078,8 @@ def __init__(self, *, name: Optional[str] = None, urls: Optional[Iterable[XsUri]
         self.urls = urls or []  # type: ignore
         self.contacts = contacts or []  # type: ignore
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(1)
     def name(self) -> Optional[str]:
         """
         Get the name of the organization.
@@ -1089,6 +1095,7 @@ def name(self, name: Optional[str]) -> None:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.FLAT, 'url')
+    @serializable.xml_sequence(2)
     def urls(self) -> "SortedSet[XsUri]":
         """
         Get a list of URLs of the organization. Multiple URLs are allowed.
@@ -1104,6 +1111,7 @@ def urls(self, urls: Iterable[XsUri]) -> None:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.FLAT, 'contact')
+    @serializable.xml_sequence(3)
     def contacts(self) -> "SortedSet[OrganizationalContact]":
         """
         Get a list of contact person at the organization. Multiple contacts are allowed.
@@ -1154,7 +1162,8 @@ def __init__(self, *, vendor: Optional[str] = None, name: Optional[str] = None,
         self.hashes = hashes or []  # type: ignore
         self.external_references = external_references or []  # type: ignore
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(1)
     def vendor(self) -> Optional[str]:
         """
         The name of the vendor who created the tool.
@@ -1168,7 +1177,8 @@ def vendor(self) -> Optional[str]:
     def vendor(self, vendor: Optional[str]) -> None:
         self._vendor = vendor
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(2)
     def name(self) -> Optional[str]:
         """
         The name of the tool.
@@ -1182,7 +1192,8 @@ def name(self) -> Optional[str]:
     def name(self, name: Optional[str]) -> None:
         self._name = name
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(3)
     def version(self) -> Optional[str]:
         """
         The version of the tool.
@@ -1196,7 +1207,9 @@ def version(self) -> Optional[str]:
     def version(self, version: Optional[str]) -> None:
         self._version = version
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'hash')
+    @serializable.xml_sequence(4)
     def hashes(self) -> "SortedSet[HashType]":
         """
         The hashes of the tool (if applicable).
@@ -1212,6 +1225,7 @@ def hashes(self, hashes: Iterable[HashType]) -> None:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'reference')
+    @serializable.xml_sequence(5)
     def external_references(self) -> "SortedSet[ExternalReference]":
         """
         External References provide a way to document systems, sites, and information that may be relevant but which

cyclonedx/model/bom.py

@@ -22,13 +22,15 @@
 from uuid import UUID, uuid4
 
 import serializable
+from cyclonedx.serialization import UrnUuidHelper
 from sortedcontainers import SortedSet
 
 from ..exception.model import UnknownComponentDependencyException
 from ..parser import BaseParser
 from . import ExternalReference, LicenseChoice, OrganizationalContact, OrganizationalEntity, Property, ThisTool, Tool
 from .bom_ref import BomRef
 from .component import Component
+from .dependency import Dependable, Dependency
 from .service import Service
 from .vulnerability import Vulnerability
 
@@ -63,6 +65,7 @@ def __init__(self, *, tools: Optional[Iterable[Tool]] = None,
 
     @property  # type: ignore[misc]
     @serializable.type_mapping(serializable.helpers.XsdDateTime)
+    @serializable.xml_sequence(1)
     def timestamp(self) -> datetime:
         """
         The date and time (in UTC) when this BomMetaData was created.
@@ -78,6 +81,7 @@ def timestamp(self, timestamp: datetime) -> None:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'tool')
+    @serializable.xml_sequence(2)
     def tools(self) -> "SortedSet[Tool]":
         """
         Tools used to create this BOM.
@@ -93,6 +97,7 @@ def tools(self, tools: Iterable[Tool]) -> None:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'author')
+    @serializable.xml_sequence(3)
     def authors(self) -> "SortedSet[OrganizationalContact]":
         """
         The person(s) who created the BOM.
@@ -110,7 +115,8 @@ def authors(self) -> "SortedSet[OrganizationalContact]":
     def authors(self, authors: Iterable[OrganizationalContact]) -> None:
         self._authors = SortedSet(authors)
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(4)
     def component(self) -> Optional[Component]:
         """
         The (optional) component that the BOM describes.
@@ -134,7 +140,8 @@ def component(self, component: Component) -> None:
         """
         self._component = component
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(5)
     def manufacture(self) -> Optional[OrganizationalEntity]:
         """
         The organization that manufactured the component that the BOM describes.
@@ -148,7 +155,8 @@ def manufacture(self) -> Optional[OrganizationalEntity]:
     def manufacture(self, manufacture: Optional[OrganizationalEntity]) -> None:
         self._manufacture = manufacture
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(6)
     def supplier(self) -> Optional[OrganizationalEntity]:
         """
         The organization that supplied the component that the BOM describes.
@@ -166,6 +174,7 @@ def supplier(self, supplier: Optional[OrganizationalEntity]) -> None:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.FLAT, '')
+    @serializable.xml_sequence(7)
     def licenses(self) -> "SortedSet[LicenseChoice]":
         """
         A optional list of statements about how this BOM is licensed.
@@ -181,6 +190,7 @@ def licenses(self, licenses: Iterable[LicenseChoice]) -> None:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'property')
+    @serializable.xml_sequence(8)
     def properties(self) -> "SortedSet[Property]":
         """
         Provides the ability to document properties in a key/value store. This provides flexibility to include data not
@@ -248,7 +258,8 @@ def __init__(self, *, components: Optional[Iterable[Component]] = None,
                  services: Optional[Iterable[Service]] = None,
                  external_references: Optional[Iterable[ExternalReference]] = None,
                  serial_number: Optional[UUID] = None, version: int = 1,
-                 metadata: Optional[BomMetaData] = None) -> None:
+                 metadata: Optional[BomMetaData] = None,
+                 dependencies: Optional[Iterable[Dependency]] = None) -> None:
         """
         Create a new Bom that you can manually/programmatically add data to later.
 
@@ -262,22 +273,27 @@ def __init__(self, *, components: Optional[Iterable[Component]] = None,
         self.external_references = external_references or []  # type: ignore
         self.vulnerabilities = SortedSet()
         self.version = version
+        self.dependencies = dependencies or []  # type: ignore
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.type_mapping(UrnUuidHelper)
+    @serializable.xml_attribute()
     def serial_number(self) -> UUID:
         """
         Unique UUID for this BOM
 
         Returns:
             `UUID` instance
+            `UUID` instance
         """
         return self._serial_number
 
     @serial_number.setter
     def serial_number(self, serial_number: UUID) -> None:
         self._serial_number = serial_number
 
-    @property
+    @property  # type: ignore[misc]
+    @serializable.xml_sequence(1)
     def metadata(self) -> BomMetaData:
         """
         Get our internal metadata object for this Bom.
@@ -296,6 +312,7 @@ def metadata(self, metadata: BomMetaData) -> None:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'component')
+    @serializable.xml_sequence(2)
     def components(self) -> "SortedSet[Component]":
         """
         Get all the Components currently in this Bom.
@@ -351,6 +368,7 @@ def has_component(self, component: Component) -> bool:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'service')
+    @serializable.xml_sequence(3)
     def services(self) -> "SortedSet[Service]":
         """
         Get all the Services currently in this Bom.
@@ -366,6 +384,7 @@ def services(self, services: Iterable[Service]) -> None:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'reference')
+    @serializable.xml_sequence(4)
     def external_references(self) -> "SortedSet[ExternalReference]":
         """
         Provides the ability to document external references related to the BOM or to the project the BOM describes.
@@ -418,6 +437,7 @@ def has_vulnerabilities(self) -> bool:
 
     @property  # type: ignore[misc]
     @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'vulnerability')
+    @serializable.xml_sequence(8)
     def vulnerabilities(self) -> "SortedSet[Vulnerability]":
         """
         Get all the Vulnerabilities in this BOM.
@@ -432,13 +452,36 @@ def vulnerabilities(self, vulnerabilities: Iterable[Vulnerability]) -> None:
         self._vulnerabilities = SortedSet(vulnerabilities)
 
     @property
+    @serializable.xml_attribute()
     def version(self) -> int:
         return self._version
 
     @version.setter
     def version(self, version: int) -> None:
         self._version = version
 
+    @property
+    @serializable.xml_array(serializable.XmlArraySerializationType.NESTED, 'dependency')
+    @serializable.xml_sequence(5)
+    def dependencies(self) -> "SortedSet[Dependency]":
+        return self._dependencies
+
+    @dependencies.setter
+    def dependencies(self, dependencies: Iterable[Dependency]) -> None:
+        self._dependencies = SortedSet(dependencies)
+
+    def register_dependency(self, target: Dependable, depends_on: Optional[Iterable[Dependable]] = None) -> None:
+        _d = next(filter(lambda _d: _d.ref == target.bom_ref, self.dependencies), None)
+
+        if _d and depends_on:
+            _d.dependencies = _d.dependencies + set(
+                map(lambda _d: Dependency(ref=_d), depends_on)) if depends_on else []
+        else:
+            self._dependencies.add(Dependency(
+                ref=target.bom_ref,
+                dependencies=list(map(lambda _d: Dependency(ref=_d), depends_on)) if depends_on else []
+            ))
+
     def urn(self) -> str:
         return f'urn:cdx:{self.serial_number}/{self.version}'
 
@@ -450,20 +493,27 @@ def validate(self) -> bool:
         Returns:
              `bool`
         """
+        # 0. Make sure all Dependable have a Dependency entry
+        if self.metadata.component:
+            self.register_dependency(target=self.metadata.component)
+        for _c in self.components:
+            self.register_dependency(target=_c)
+        for _s in self.services:
+            self.register_dependency(target=_s)
 
         # 1. Make sure dependencies are all in this Bom.
         all_bom_refs = set(map(lambda c: c.bom_ref, self._get_all_components())) | set(
             map(lambda s: s.bom_ref, self.services))
+        all_dependency_bom_refs = set().union(*(d.dependencies_as_bom_refs() for d in self.dependencies))
 
-        all_dependency_bom_refs = set().union(*(c.dependencies for c in self.components))
         dependency_diff = all_dependency_bom_refs - all_bom_refs
         if len(dependency_diff) > 0:
             raise UnknownComponentDependencyException(
                 f'One or more Components have Dependency references to Components/Services that are not known in this '
                 f'BOM. They are: {dependency_diff}')
 
         # 2. Dependencies should exist for the Component this BOM is describing, if one is set
-        if self.metadata.component and not self.metadata.component.dependencies:
+        if self.metadata.component and filter(lambda _d: _d.ref == self.metadata.component.bom_ref, self.dependencies):
             warnings.warn(
                 f'The Component this BOM is describing {self.metadata.component.purl} has no defined dependencies '
                 f'which means the Dependency Graph is incomplete - you should add direct dependencies to this Component'