initial dependency graph work

Signed-off-by: Jan Kowalleck <[email protected]>

Author: jkowalleck

src/models/bom.ts

@@ -3,12 +3,15 @@ import { Metadata } from './metadata'
 import { ComponentRepository } from './component'
 
 export class Bom {
-  // property `bomFormat` is not part of model, it is a runtime information
-  // property `specVersion` is not part of model, it is a runtime information
-
   metadata = new Metadata()
   components = new ComponentRepository()
 
+  // Property `bomFormat` is not part of model, it is a runtime information.
+  // Property `specVersion` is not part of model, it is a runtime information.
+
+  // Property `dependencies` is not part of this model, but part of `Component` and other models.
+  // The dependency grapth can be normalized on rendertime, no need to store it in the bom model.
+
   #version: PositiveInteger = 1
   get version (): PositiveInteger {
     return this.#version

src/models/component.ts

@@ -2,7 +2,7 @@ import { PackageURL } from 'packageurl-js'
 
 import { CPE, isCPE } from '../types'
 import { ComponentScope, ComponentType } from '../enums'
-import { BomRef } from './bomRef'
+import { BomRef, BomRefRepository } from './bomRef'
 import { HashRepository } from './hash'
 import { OrganizationalEntity } from './organizationalEntity'
 import { ExternalReferenceRepository } from './externalReference'
@@ -48,6 +48,15 @@ export class Component {
     this.#cpe = value
   }
 
+  #dependencies = new BomRefRepository()
+  get dependencies (): BomRefRepository {
+    return this.#dependencies
+  }
+
+  set dependencies (value: BomRefRepository) {
+    this.#dependencies = value
+  }
+
   compare (other: Component): number {
     const bomRefCompare = this.bomRef.compare(other.bomRef)
     if (bomRefCompare !== 0) { return bomRefCompare }

src/serialize/JSON.normalize.ts

@@ -86,7 +86,11 @@ export class BomNormalizer extends Base {
       metadata: this.factory.makeForMetadata().normalize(data.metadata, options),
       components: data.components.size > 0
         ? this.factory.makeForComponent().normalizeIter(data.components, options)
-        : [] // spec < 1.4 requires `component` to be array
+        // spec < 1.4 requires `component` to be array
+        : [],
+      dependencies: this.factory.spec.supportsDependencyGraph
+        ? undefined // @TODO: render dependency graph
+        : undefined
     }
   }
 }

src/serialize/JSON.types.ts

@@ -1,7 +1,7 @@
 import * as Enums from '../enums'
 import { SpdxId } from '../SPDX'
 import { CPE, PositiveInteger, UrnUuid } from '../types'
-import { HashContent } from '../models'
+import { BomRef, HashContent } from '../models'
 
 type IriReference = string
 type IdnEmail = string
@@ -18,6 +18,7 @@ export interface Bom {
   metadata?: Metadata
   components?: Component[]
   externalReferences?: ExternalReference[]
+  dependencies?: Depndency[]
 }
 
 export interface Metadata {
@@ -121,3 +122,8 @@ export interface Attachment {
   contentType?: string
   encoding?: Enums.AttachmentEncoding
 }
+
+export interface Depndency {
+  ref: BomRef
+  dependsOn?: BomRef[]
+}

src/spec.ts

@@ -29,6 +29,8 @@ export interface Protocol {
   supportsHashValue: (hv: HashContent | any) => boolean
 
   supportsExternalReferenceType: (ert: ExternalReferenceType | any) => boolean
+
+  readonly supportsDependencyGraph: boolean
 }
 
 class Spec implements Protocol {
@@ -38,21 +40,24 @@ class Spec implements Protocol {
   readonly #hashAlgorithms: ReadonlySet<HashAlgorithm>
   readonly #hashValuePattern: RegExp
   readonly #externalReferenceTypes: ReadonlySet<ExternalReferenceType>
+  readonly #supportsDependencyGraph: boolean
 
   constructor (
     version: Version,
     formats: Iterable<Format>,
     componentTypes: Iterable<ComponentType>,
     hashAlgorithms: Iterable<HashAlgorithm>,
     hashValuePattern: RegExp,
-    externalReferenceTypes: Iterable<ExternalReferenceType>
+    externalReferenceTypes: Iterable<ExternalReferenceType>,
+    supportsDependencyGraph: boolean
   ) {
     this.#version = version
     this.#formats = new Set(formats)
     this.#componentTypes = new Set(componentTypes)
     this.#hashAlgorithms = new Set(hashAlgorithms)
     this.#hashValuePattern = hashValuePattern
     this.#externalReferenceTypes = new Set(externalReferenceTypes)
+    this.#supportsDependencyGraph = supportsDependencyGraph
   }
 
   get version (): Version {
@@ -79,6 +84,10 @@ class Spec implements Protocol {
   supportsExternalReferenceType (ert: ExternalReferenceType | any): boolean {
     return this.#externalReferenceTypes.has(ert)
   }
+
+  get supportsDependencyGraph (): boolean {
+    return this.#supportsDependencyGraph
+  }
 }
 
 /** Specification v1.2 */
@@ -129,7 +138,8 @@ export const Spec1dot2: Protocol = Object.freeze(new Spec(
     ExternalReferenceType.BuildMeta,
     ExternalReferenceType.BuildSystem,
     ExternalReferenceType.Other
-  ]
+  ],
+  true
 ))
 
 /** Specification v1.3 */
@@ -180,7 +190,8 @@ export const Spec1dot3: Protocol = Object.freeze(new Spec(
     ExternalReferenceType.BuildMeta,
     ExternalReferenceType.BuildSystem,
     ExternalReferenceType.Other
-  ]
+  ],
+  true
 ))
 
 /** Specification v1.4 */
@@ -232,7 +243,8 @@ export const Spec1dot4: Protocol = Object.freeze(new Spec(
     ExternalReferenceType.BuildSystem,
     ExternalReferenceType.ReleaseNotes,
     ExternalReferenceType.Other
-  ]
+  ],
+  true
 ))
 
 export const SpecVersionDict: { readonly [key in Version]?: Protocol } = Object.freeze(Object.fromEntries([