(ant-antlibs-cyclonedx) branch main updated: transfer compositionAggregate from linked sbom

[bodewig]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/ant-antlibs-cyclonedx.git


The following commit(s) were added to refs/heads/main by this push:
     new 7402318  transfer compositionAggregate from linked sbom
7402318 is described below

commit 7402318150a232b1325bbf56874386758f824def
Author: Stefan Bodewig <bode...@apache.org>
AuthorDate: Fri Aug 28 17:47:38 2026 +0200

    transfer compositionAggregate from linked sbom
---
 .../apache/ant/cyclonedx/CompositionAggregate.java | 12 ++++++++++++
 .../ant/cyclonedx/SbomLinkComponentResolver.java   | 22 ++++++++++++++++++++++
 src/tests/antunit/component-sbomlink-test.xml      |  8 ++++++++
 src/tests/antunit/shared.xml                       |  1 +
 4 files changed, 43 insertions(+)

diff --git a/src/main/org/apache/ant/cyclonedx/CompositionAggregate.java 
b/src/main/org/apache/ant/cyclonedx/CompositionAggregate.java
index 002e66c..e2da27f 100644
--- a/src/main/org/apache/ant/cyclonedx/CompositionAggregate.java
+++ b/src/main/org/apache/ant/cyclonedx/CompositionAggregate.java
@@ -50,4 +50,16 @@ public class CompositionAggregate extends 
EnumeratedAttribute {
     public Aggregate getAggregate() {
         return EnumUtils.valueOf(Aggregate.class, getValue(), 
Aggregate::getAggregateName);
     }
+
+    /**
+     * Maps a CycloneDX Aggregate.
+     *
+     * @param aggregate CycloneDX aggregate.
+     * @return translated aggregate
+     */
+    public static CompositionAggregate from(Aggregate aggregate) {
+        CompositionAggregate a = new CompositionAggregate();
+        a.setValue(aggregate.getAggregateName());
+        return a;
+    }
 }
diff --git a/src/main/org/apache/ant/cyclonedx/SbomLinkComponentResolver.java 
b/src/main/org/apache/ant/cyclonedx/SbomLinkComponentResolver.java
index a1d877d..5eca81b 100644
--- a/src/main/org/apache/ant/cyclonedx/SbomLinkComponentResolver.java
+++ b/src/main/org/apache/ant/cyclonedx/SbomLinkComponentResolver.java
@@ -25,6 +25,7 @@ import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
+import java.util.stream.Collectors;
 
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.Project;
@@ -35,6 +36,7 @@ import org.apache.tools.ant.types.resources.URLProvider;
 
 import org.cyclonedx.exception.ParseException;
 import org.cyclonedx.model.Bom;
+import org.cyclonedx.model.Composition;
 import org.cyclonedx.parsers.BomParserFactory;
 import org.cyclonedx.parsers.Parser;
 
@@ -102,6 +104,8 @@ public class SbomLinkComponentResolver extends Union 
implements ComponentResolve
             }
         }
 
+        setCompositionAggregate(parent, bom, real.getBomRef());
+
         if (!parent.areDependenciesUnknown() && 
parent.getDependencies().iterator().hasNext()) {
             List<org.cyclonedx.model.Component> additionalComponents = 
bom.getComponents();
             if (additionalComponents != null) {
@@ -166,4 +170,22 @@ public class SbomLinkComponentResolver extends Union 
implements ComponentResolve
         }
         return toReturn;
     }
+
+    private void setCompositionAggregate(Component parent, Bom bom, String 
realBomRef) {
+        if (realBomRef != null && parent.getCompositionAggregate() == null) {
+            List<Composition> allCompositions = bom.getCompositions();
+            if (allCompositions == null) {
+                return;
+            }
+            List<Composition> componentsComposition = allCompositions
+                .stream()
+                .filter(c -> c.getDependencies().stream()
+                        .anyMatch(d -> realBomRef.equals(d.getRef())))
+                .collect(Collectors.toList());
+            if (componentsComposition.size() == 1) {
+                
parent.setCompositionAggregate(CompositionAggregate.from(componentsComposition.get(0).getAggregate()));
+            }
+        }
+    }
+
 }
diff --git a/src/tests/antunit/component-sbomlink-test.xml 
b/src/tests/antunit/component-sbomlink-test.xml
index d7a6a2e..7e10147 100644
--- a/src/tests/antunit/component-sbomlink-test.xml
+++ b/src/tests/antunit/component-sbomlink-test.xml
@@ -156,6 +156,14 @@
         xmlns:au="antlib:org.apache.ant.antunit"
         resource="${output}/merged.xml"
         value='&lt;hash alg="SHA-256"&gt;${ant.file.sha256}&lt;/hash&gt;'/>
+    <au:assertPropertyEquals
+        xmlns:au="antlib:org.apache.ant.antunit"
+        name="bom.compositions.composition.aggregate"
+        value="incomplete"/>
+    <au:assertPropertyEquals
+        xmlns:au="antlib:org.apache.ant.antunit"
+        name="bom.compositions.composition.dependencies.dependency(ref)"
+        value="pkg:maven/org.example/testname@1.0?type=jar"/>
   </target>
 
   <target name="testSbomLinkAddsBomExternalLink" 
depends="createMaximalComponentData">
diff --git a/src/tests/antunit/shared.xml b/src/tests/antunit/shared.xml
index 78f21ec..89bb3ea 100644
--- a/src/tests/antunit/shared.xml
+++ b/src/tests/antunit/shared.xml
@@ -88,6 +88,7 @@
           publisher="test publisher"
           copyright="Copyright 2026 ACME Com"
           mimeType="text/plain"
+          compositionAggregate="incomplete"
           >
         <file file="${ant.file}"/>
         <manufacturer name="Example">