cyclonedx-python-lib

cyclonedx-python-lib copied to clipboard

Example

import json
from cyclonedx.model.bom import Bom
from cyclonedx.validation.json import JsonStrictValidator
from cyclonedx.schema import OutputFormat, SchemaVersion
specification = {
    "bomFormat": "CycloneDX",
    "specVersion": "1.6",
    "serialNumber": "urn:uuid:835142d8-05ce-4729-bcb9-ff39cb67eb37",
    "version": 1,
    "metadata": {
        "timestamp": "2025-03-10T17:25:47Z",
        "tools": {
            "services": [
                {
                    "provider": {
                        "name": "Example",
                        "url": [
                            "https://example.com/"
                        ],
                        "bom-ref": "Example"
                    },
                    "name": "Example",
                }
            ]
        },
        "properties": []
    }
}
validator = JsonStrictValidator(SchemaVersion.V1_6)
if validator.validate_str(json.dumps(specification)) is not None:
  raise Exception("Validation failed")

Bom.from_json(specification)  # raises an error

The error that Bom.from_json throws is ValueError: Unexpected key bom-ref/bom-ref in data being serialized to cyclonedx.model.contact.OrganizationalEntity

Cause

I believe OrganizationEntity is missing the attribute bom_ref. It seems that the schema includes it, so the example specification above is correct: https://cyclonedx.org/docs/1.6/xml/#type_organizationalEntity

Fix

Adding bom_ref to OrganizationalEntity should resolve the issue. The attribute should be attached to the bom-ref key, similar to the class cyclonedx.model.contact.PostalAddress.

Environment

I ran into the error using python 3.10.12 and also in 3.13.2. I used version 9.1.0 of the package cyclonedx-python-lib. Hashes:

files = [
    {file = "cyclonedx_python_lib-9.1.0-py3-none-any.whl", hash = "sha256:55693fca8edaecc3363b24af14e82cc6e659eb1e8353e58b587c42652ce0fb52"},
    {file = "cyclonedx_python_lib-9.1.0.tar.gz", hash = "sha256:86935f2c88a7b47a529b93c724dbd3e903bc573f6f8bd977628a7ca1b5dadea1"},
]