From 906dec07d8342e4148a22eee066bd8c57efcc93d Mon Sep 17 00:00:00 2001 From: abhinavgautam01 Date: Thu, 27 Aug 2026 10:13:44 +0530 Subject: [PATCH] Preserve package properties in CycloneDX output --- encode.go | 6 ++++++ encode_test.go | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/encode.go b/encode.go index 9f8e464..53c82cc 100644 --- a/encode.go +++ b/encode.go @@ -100,6 +100,12 @@ func packageToCDX(p *Package) cdxComponent { if lic := firstNonEmpty(p.LicenseDeclared, p.LicenseConcluded); lic != "" { c.Licenses = []cdxLicense{{License: &cdxLicenseID{ID: lic}, ID: lic}} } + if len(p.Properties) > 0 { + c.Properties = make([]cdxProperty, len(p.Properties)) + for i := range p.Properties { + c.Properties[i] = cdxProperty(p.Properties[i]) + } + } return c } diff --git a/encode_test.go b/encode_test.go index 1725132..40bb09c 100644 --- a/encode_test.go +++ b/encode_test.go @@ -3,6 +3,7 @@ package sbom import ( "bytes" "encoding/json" + "slices" "strings" "testing" ) @@ -18,6 +19,7 @@ func sampleSBOM() *SBOM { s.AddPackage(Package{ Name: "lodash", Version: "4.17.21", LicenseDeclared: "MIT", ExternalRefs: []ExternalRef{{Category: "PACKAGE_MANAGER", Type: "purl", Locator: "pkg:npm/lodash@4.17.21"}}, + Properties: []Property{{Name: "location", Value: "package.json"}}, }) s.AddPackage(Package{Name: "left-pad", Version: "1.3.0"}) return s @@ -59,6 +61,9 @@ func TestEncodeRoundTrip(t *testing.T) { if p.LicenseDeclared != want.LicenseDeclared { t.Errorf("LicenseDeclared = %q, want %q", p.LicenseDeclared, want.LicenseDeclared) } + if f == FormatCycloneDXJSON && !slices.Equal(p.Properties, want.Properties) { + t.Errorf("Properties = %#v, want %#v", p.Properties, want.Properties) + } }) } } @@ -74,6 +79,7 @@ func TestEncodeCycloneDXXML(t *testing.T) { `lodash`, `pkg:npm/lodash@4.17.21`, `MIT`, + `package.json`, } { if !strings.Contains(out, want) { t.Errorf("missing %q in:\n%s", want, out)