ExtensibleTypes

[wrgoff]

I added an extensible type to a component. Code wise it looks good. I see the extensible type. XML wise looks a little wierd.

<component>
      .....
     </externalReferences>
     <packageManager unixPackageManager="apt"/>
</component>

I would have expected it to be

<component>
     .....
     </externalReferences>
     <extensibleTypes>
          <extensibleType>
               <attributes>
                    <attribute>
                         <packageManager unixPackageManager="apt"/>
                    </attribute>
               </attributes>
         </extensibleType>
     </extensibleTypes>
</component>

And when attempting to read back in the bom.xml file, sure enough the extensible type is no where to be found.

[wrgoff]

Java code to produce the attributes (extensibleType).

List<Attribute> attributes = new ArrayList<Attribute>();
Attribute packageManagerAttribute = new Attribute("unixPackageManager", packageManager);
attributes.add(packageManagerAttribute);
ExtensibleType et = new ExtensibleType("manager", "packageManager", attributes);
List<ExtensibleType> ets = component.getExtensibleTypes();
if(ets == null)
	ets = new ArrayList<ExtensibleType>();
ets.add(et);
component.setExtensibleTypes(ets);

[wrgoff]

Any chance we can get a base constructor (and getters for fields in) in the ExtensibleType class. This will allow the user of other generators, such as Jackson to be used.

Thanks.

[stevespringett]

Getters are already there, but certainly, a non arg constructor could be added. PRs welcome.

Also based on the type of data you're adding, you may be interested in https://github.com/CycloneDX/specification/issues/31 and https://github.com/CycloneDX/specification/issues/42

[wrgoff]

Sorry. Not getters, but setters. For jackson to work correctly we would need getters and setters. I actually have a clone of the ExtensibleType class, but just had to make those changes. This way we can read in actaully what was in the bom, and reproduce it with the "ExtensibleType" not getting lost.

Thanks a bunch. This is a great product. Keep up the good work.

[wrgoff]

On another note, if you are interested. I created a standalone application (java) that can be used to produce a Bom for Unix environments. To include Alpine, Centos, Debian, Redhat, and Ubuntu. It currently only uses the PackageManger (yum, apt, apk) to produce the boms. I am also working on a "non" package manger bom creator.

[wrgoff]

I can also just give you my changes to the ExtensibleType class if you would like? Just let me know.