Vers Support

.credo.exs

@@ -48,7 +48,6 @@
           {Credo.Check.Readability.AliasOrder, []},
           {Credo.Check.Readability.FunctionNames, []},
           {Credo.Check.Readability.LargeNumbers, []},
-          {Credo.Check.Readability.MaxLineLength, [priority: :low, max_length: 120]},
           {Credo.Check.Readability.ModuleAttributeNames, []},
           {Credo.Check.Readability.ModuleDoc, []},
           {Credo.Check.Readability.ModuleNames, []},
@@ -157,6 +156,9 @@
           {Credo.Check.Warning.MixEnv, []},
           {Credo.Check.Refactor.MapInto, []},
 
+          # Done by formatter
+          {Credo.Check.Readability.MaxLineLength, [priority: :low, max_length: 120]},
+
           #
           # Custom checks can be created using `mix credo.gen.check`.
           #

lib/sbom/cyclonedx.ex

@@ -307,6 +307,7 @@ defmodule SBoM.CycloneDX do
       name: name,
       group: component[:group],
       version: component_version(component, schema_version),
+      versionRange: version_range(component),
       purl: to_string(component.package_url),
       scope: dependency_scope(component),
       hashes: hashes,
@@ -325,6 +326,17 @@ defmodule SBoM.CycloneDX do
     )
   end
 
+  @spec version_range(component :: Fetcher.dependency()) :: String.t() | nil
+  defp version_range(component) do
+    with nil <- component[:version],
+         range when not is_nil(range) <- component[:version_requirement],
+         {:ok, vers} <- Version.Requirement.Vers.to_vers(range, "hex") do
+      vers
+    else
+      _version_or_no_range -> nil
+    end
+  end
+
   @spec source_url_reference(
           source_url :: String.t(),
           schema_version()
@@ -577,7 +589,7 @@ defmodule SBoM.CycloneDX do
   defp component_version(component, schema_version) do
     case schema_version do
       "1.3" -> component[:version] || component[:version_requirement] || "unknown"
-      # TODO: Handle VersionRequirement separately in 1.7+
+      "1.7" -> component[:version]
       _schema_version -> component[:version] || component[:version_requirement]
     end
   end

lib/sbom/cyclonedx/xml/decodable.ex

@@ -171,6 +171,7 @@ defimpl Decodable,
     {:group, :string, "child::group/text()"},
     {:name, :string, "child::name/text()"},
     {:version, :string, "child::version/text()"},
+    {:versionRange, :string, "child::versionRange/text()"},
     {:description, :string, "child::description/text()"},
     {:scope, :string, "child::scope/text()"},
     {:hashes, {:list, hash_module}, "child::hashes/child::hash"},

lib/sbom/cyclonedx/xml/encodable.ex

@@ -135,7 +135,7 @@ defimpl SBoM.CycloneDX.XML.Encodable,
           {:group, :group, :wrap},
           {:name, :name, :wrap},
           {:version, :version, :wrap},
-          {:versionRange, :version_range, :wrap},
+          {:versionRange, :versionRange, :wrap},
           {:description, :description, :wrap},
           {:scope, :scope, :wrap},
           {:hashes, :hashes, :wrap},

lib/sbom/scm/hex/scm.ex

@@ -51,11 +51,28 @@ defmodule SBoM.SCM.Hex.SCM do
         ^repository_url -> %{"repository_url" => repository_url}
       end
 
+    {version, qualifiers} =
+      case {version, requirement} do
+        # Deps given as `{app, opts}` carry no requirement at all.
+        {nil, nil} ->
+          {nil, qualifiers}
+
+        {nil, requirement} ->
+          case {Version.parse(requirement), Version.Requirement.Vers.to_vers(requirement, "hex")} do
+            {{:ok, %Version{} = ver}, _vers} -> {to_string(ver), qualifiers}
+            {:error, {:ok, vers}} -> {nil, Map.put(qualifiers, "vers", vers)}
+            {:error, :error} -> {nil, qualifiers}
+          end
+
+        {version, _requirement} ->
+          {version, qualifiers}
+      end
+
     Purl.new!(%Purl{
       type: "hex",
       namespace: hex_namespace(opts[:repo]),
       name: opts |> Keyword.fetch!(:hex) |> to_string(),
-      version: version || requirement,
+      version: version,
       qualifiers: qualifiers
     })
   end