feat: adopt bomly-sdk v0.7.0 - #1
Merged
Merged
Conversation
Migration to the typed GraphNode union. It reaches furthest here: this detector builds the graph, and it carries a vendored copy of the SBOM codec. Identity is minted by the constructor now (ADR-0041), so Syft's own artifact ID no longer travels into the graph and the StableID fallback is gone with it. A Syft package with no coordinates a node can be minted from is skipped rather than admitted under a synthetic ID. That change has a consequence the tests caught: Syft's relationships are keyed by its artifact IDs while nodes are keyed by canonical package URLs, and the two are no longer the same string, so every edge looked up an ID no node had. The mapping is now kept explicitly while packages are added rather than assumed, and an edge whose end was skipped for want of identity is dropped rather than erroring -- it has nothing to connect. Document refs are canonical package URLs as a result: a CycloneDX affects ref that was "react@18.2.0" is "pkg:npm/react@18.2.0". This is the one-time ref change the phase-2 release notes call out. The codec's component walk uses DependencyNodes(), and its dependency list uses WalkTypedEdges and emits only depends-on edges -- a manifest-to-module edge is structural and would assert a relationship no detector made. Delegation: the vendored codec's parsePURL moves to purlkit, the kit over the official packageurl-go. plugin/graph.go keeps anchore/packageurl-go deliberately, and says why: its result is compared against Syft's own package URLs and Syft's API speaks that type, so converting twice to hand it back would be churn, not delegation. Bomly-side identity is the constructor's either way.
The migration was developed against the release candidate through a go.work overlay; this pins the published tag. v0.8.0 rather than v0.7.1 because the SDK fixes added exported API, which is a minor bump under semver -- gorelease named the version. Full suite green under -race against the real tag, with no overlay.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migration to the typed
GraphNodeunion. This reaches furthest of the nine: this detector builds the graph, and it carries a vendored copy of the SBOM codec.Identity is minted, not carried
Syft's own artifact ID no longer travels into the graph, and the
StableIDfallback is gone with it — a node's ID is its canonical package URL. A Syft package with no coordinates a node can be minted from is skipped rather than admitted under a synthetic ID.The consequence the tests caught
Syft's relationships are keyed by artifact IDs while nodes are now keyed by canonical package URLs. The two are no longer the same string, so every edge looked up an ID no node had —
graph node not found: 5190c1b85ae15af2.The mapping is now kept explicitly while packages are added, rather than assumed. An edge whose end was skipped for want of identity is dropped rather than erroring: it has nothing to connect.
Visible ref change
Document refs are canonical package URLs as a result — a CycloneDX
affectsref that wasreact@18.2.0is nowpkg:npm/react@18.2.0. This is the one-time ref change the phase-2 release notes call out; worth a look during review since it shows up in emitted SBOMs.Codec
The component walk uses
DependencyNodes(); the dependency list usesWalkTypedEdgesand emits onlydepends-onedges — a manifest-to-module edge is structural and would assert a relationship no detector made.Delegation, including one deliberate non-delegation
The vendored codec's
parsePURLmoves topurlkit.plugin/graph.gokeepsanchore/packageurl-go, and says why in the code: its result is compared against Syft's own package URLs and Syft's API speaks that type, so converting to purlkit and back would translate a value twice to hand it to a library that wanted the original. That's Syft interop, not a Bomly identity decision — Bomly-side identity is the constructor's either way.Verification
go vet,gofmt,go mod tidy, full suite under-race— clean.🤖 Generated with Claude Code