class CycloneDX::Validator

Defined in:

cyclonedx/validator.cr

Constant Summary

BOM_LINK_PREFIX = "urn:cdx:"

A reference into a different BOM (urn:cdx:<serial>/<version>#<bom-ref>) rather than a local bom-ref. Those cannot be resolved from here.

CPE_PATTERN = /\A(cpe:\/[aho]?(:[^:]*){0,6}|cpe:2\.3(:[^:]*){11})\z/i

A CPE 2.2 URI (cpe:/part:vendor:…) or a CPE 2.3 formatted string (cpe:2.3: plus eleven colon-separated components).

A shape check, not the XSD's full pattern: it exists to reject a value that is plainly not a CPE, which is the mistake that actually happens. Fields containing escaped colons (\:) are rare and not accounted for.

REF_KEYS = {"ref", "dependsOn", "provides", "assemblies", "dependencies", "vulnerabilities", "subjects"}

Keys whose values are bom-ref references rather than definitions.

Restricted to the ones this object model can actually populate. Notably absent are the declarations cross-links, whose targets (declaration evidence, attestations) are not modelled yet, so every such reference would look dangling.

Constructors

Instance Method Summary

Constructor Detail

def self.new #

[View source]

Instance Method Detail

def errors : Array(ValidationError) #

Problems that make the serialized document invalid. #validate fails on these.


[View source]
def validate(bom : BOM) : Bool #

[View source]
def warnings : Array(ValidationError) #

Places where the BOM was valid but over-specified for its declared specVersion, and the version gate downgraded it on the way out: a field stripped, an enum value swapped for its catch-all, a repeated element collapsed. The output is schema-valid, so these do not fail #validate, but they are the record of what the declared version could not carry.


[View source]