BOM Validation: RFC 3987 External References

[setchy]

DTrack: 4.11.1

We've seen a handful of BOMs (generated by cdxgen) being rejected by the new BOM Validation Process due to invalid URLs (or IRI References)

Example below

"externalReferences": [
      {
          "type": "vcs",
          "url": "https://github.com/follow-redirects/follow-redirects"
      },
      {
          "type": "vcs",
          "url": "[email protected]:follow-redirects/follow-redirects.git"
      }
  ],

The second reference is the one that doesn't pass.

I'd like to confirm that this is an expected rejection before I look to do any changes within cdxgen

[nscuro]

That's not something DT decides, this is how it's defined in the CycloneDX schema: https://cyclonedx.org/docs/1.5/json/#components_items_externalReferences_items_url

CC @stevespringett @jkowalleck

[nscuro]

The iri-reference format of JSON Schema is described here: https://json-schema.org/understanding-json-schema/reference/string#resource-identifiers

[setchy]

Thanks @nscuro - that's all i needed :)

I'll look to fix upstream

[jkowalleck]

I'll look to fix upstream

I'd suggest approaching the cdxgen project via bug report, and ask them to use https://www.npmjs.com/package/hosted-git-info to get the git urls fixed.

This worked for other JavaScript-based CycloneDX generators.

[setchy]

Thanks @jkowalleck