fix: change Component.Evidence.Identity to array

convert.go

@@ -195,6 +195,13 @@ func convertEvidence(c *Component, specVersion SpecVersion) {
 	}
 
 	if specVersion < SpecVersion1_6 {
+		// Spec version 1.5 uses only one Identity.
+		// cf. https://cyclonedx.org/docs/1.5/json/#components_items_evidence_identity
+		if c.Evidence.Identity != nil {
+			ids := *c.Evidence.Identity
+			ids = ids[:1]
+			c.Evidence.Identity = &ids
+		}
 		if c.Evidence.Occurrences != nil {
 			for i := range *c.Evidence.Occurrences {
 				occ := &(*c.Evidence.Occurrences)[i]

convert_test.go

@@ -42,7 +42,7 @@ func Test_componentConverter_convertEvidence(t *testing.T) {
 
 		comp := Component{
 			Evidence: &Evidence{
-				Identity:    &EvidenceIdentity{},
+				Identity:    &[]EvidenceIdentity{},
 				Occurrences: &[]EvidenceOccurrence{},
 				Callstack:   &Callstack{},
 				Copyright:   &[]Copyright{{Text: "foo"}},
@@ -63,6 +63,14 @@ func Test_componentConverter_convertEvidence(t *testing.T) {
 
 		comp := Component{
 			Evidence: &Evidence{
+				Identity: &[]EvidenceIdentity{
+					{
+						Field: EvidenceIdentityFieldTypePURL,
+					},
+					{
+						Field: EvidenceIdentityFieldTypeName,
+					},
+				},
 				Occurrences: &[]EvidenceOccurrence{
 					{
 						BOMRef:            "foo",
@@ -78,6 +86,7 @@ func Test_componentConverter_convertEvidence(t *testing.T) {
 
 		convert(&comp)
 
+		require.Len(t, *comp.Evidence.Identity, 1)
 		require.Len(t, *comp.Evidence.Occurrences, 1)
 		occ := (*comp.Evidence.Occurrences)[0]
 		assert.Nil(t, occ.Line)

cyclonedx.go

@@ -623,11 +623,11 @@ type Event struct {
 }
 
 type Evidence struct {
-	Identity    *EvidenceIdentity     `json:"identity,omitempty" xml:"identity,omitempty"`
-	Occurrences *[]EvidenceOccurrence `json:"occurrences,omitempty" xml:"occurrences>occurrence,omitempty"`
-	Callstack   *Callstack            `json:"callstack,omitempty" xml:"callstack,omitempty"`
-	Licenses    *Licenses             `json:"licenses,omitempty" xml:"licenses,omitempty"`
-	Copyright   *[]Copyright          `json:"copyright,omitempty" xml:"copyright>text,omitempty"`
+	Identity    *[]EvidenceIdentity   `json:"identity,omitempty" xml:"-"`
+	Occurrences *[]EvidenceOccurrence `json:"occurrences,omitempty" xml:"-"`
+	Callstack   *Callstack            `json:"callstack,omitempty" xml:"-"`
+	Licenses    *Licenses             `json:"licenses,omitempty" xml:"-"`
+	Copyright   *[]Copyright          `json:"copyright,omitempty" xml:"-"`
 }
 
 type EvidenceIdentity struct {

cyclonedx_json.go

@@ -187,6 +187,53 @@ func (tc *ToolsChoice) UnmarshalJSON(bytes []byte) error {
 	return nil
 }
 
+func (ev *Evidence) UnmarshalJSON(bytes []byte) error {
+	type Alias Evidence
+	var aux = &struct {
+		Identity json.RawMessage `json:"identity"`
+		*Alias
+	}{
+		Alias: (*Alias)(ev),
+	}
+
+	if err := json.Unmarshal(bytes, &aux); err != nil {
+		return err
+	}
+
+	// Try to unmarshal Identity field as struct
+	if aux.Identity != nil {
+		var identity EvidenceIdentity
+		err := json.Unmarshal(aux.Identity, &identity)
+		if err != nil {
+			var typeErr *json.UnmarshalTypeError
+			if !errors.As(err, &typeErr) || typeErr.Value != "array" {
+				return err
+			}
+
+			// Try to unmarshal Identity field as array
+			var identities []EvidenceIdentity
+			err = json.Unmarshal(aux.Identity, &identities)
+			if err != nil {
+				return err
+			}
+
+			if len(identities) > 0 {
+				ev.Identity = &identities
+			}
+			return nil
+		}
+
+		// The field is required, so we can check for emptiness using this field.
+		// cf. https://cyclonedx.org/docs/1.6/json/#metadata_component_evidence_identity_oneOf_i0_items_field
+		if identity.Field != "" {
+			ev.Identity = &[]EvidenceIdentity{
+				identity,
+			}
+		}
+	}
+	return nil
+}
+
 var jsonSchemas = map[SpecVersion]string{
 	SpecVersion1_0: "",
 	SpecVersion1_1: "",

cyclonedx_json_test.go

@@ -19,8 +19,9 @@ package cyclonedx
 
 import (
 	"encoding/json"
-	"github.com/stretchr/testify/require"
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
 func TestEnvironmentVariableChoice_MarshalJSON(t *testing.T) {
@@ -166,3 +167,166 @@ func TestMLDatasetChoice_UnmarshalJSON(t *testing.T) {
 		require.Nil(t, choice.ComponentData)
 	})
 }
+
+func TestEvidence_MarshalJSON(t *testing.T) {
+	t.Run("Empty", func(t *testing.T) {
+		evidence := Evidence{}
+		jsonBytes, err := json.Marshal(evidence)
+		require.NoError(t, err)
+		require.Equal(t, "{}", string(jsonBytes))
+	})
+
+	t.Run("WithOccurrences", func(t *testing.T) {
+		evidence := Evidence{
+			Occurrences: &[]EvidenceOccurrence{
+				{
+					BOMRef:   "d6bf237e-4e11-4713-9f62-56d18d5e2079",
+					Location: "/path/to/component",
+				},
+				{
+					BOMRef:   "b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175",
+					Location: "/another/path/to/component",
+				},
+			},
+		}
+		jsonBytes, err := json.Marshal(evidence)
+		require.NoError(t, err)
+		require.Equal(t, `{"occurrences":[{"bom-ref":"d6bf237e-4e11-4713-9f62-56d18d5e2079","location":"/path/to/component"},{"bom-ref":"b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175","location":"/another/path/to/component"}]}`, string(jsonBytes))
+	})
+
+	t.Run("WithIdentify", func(t *testing.T) {
+		evidence := Evidence{
+			Identity: &[]EvidenceIdentity{
+				{
+					Field:      EvidenceIdentityFieldTypePURL,
+					Confidence: toPointer(t, float32(1)),
+					Methods: &[]EvidenceIdentityMethod{
+						{
+							Technique:  "filename",
+							Confidence: toPointer(t, float32(0.1)),
+							Value:      "findbugs-project-3.0.0.jar",
+						},
+						{
+							Technique:  "ast-fingerprint",
+							Confidence: toPointer(t, float32(0.9)),
+							Value:      "61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab",
+						},
+					},
+					Tools: &[]BOMReference{
+						"bom-ref-of-tool-that-performed-analysis",
+					},
+				},
+			},
+		}
+		jsonBytes, err := json.Marshal(evidence)
+		require.NoError(t, err)
+		require.Equal(t, `{"Identity":[{"field":"purl","confidence":1,"methods":[{"technique":"filename","confidence":0.1,"value":"findbugs-project-3.0.0.jar"},{"technique":"ast-fingerprint","confidence":0.9,"value":"61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab"}],"tools":["bom-ref-of-tool-that-performed-analysis"]}]}`, string(jsonBytes))
+	})
+}
+
+func TestEvidence_UnmarshalJSON(t *testing.T) {
+	t.Run("Empty", func(t *testing.T) {
+		var evidence Evidence
+		err := json.Unmarshal([]byte(`{}`), &evidence)
+		require.NoError(t, err)
+		require.Equal(t, Evidence{}, evidence)
+	})
+
+	t.Run("WithOccurrences", func(t *testing.T) {
+		var evidence Evidence
+		err := json.Unmarshal([]byte(`{
+"occurrences": [
+  {
+	"bom-ref": "d6bf237e-4e11-4713-9f62-56d18d5e2079",
+	"location": "/path/to/component"
+  },
+  {
+	"bom-ref": "b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175",
+	"location": "/another/path/to/component"
+  }
+]}`), &evidence)
+		require.NoError(t, err)
+		require.Equal(t, &[]EvidenceOccurrence{
+			{
+				BOMRef:   "d6bf237e-4e11-4713-9f62-56d18d5e2079",
+				Location: "/path/to/component",
+			},
+			{
+				BOMRef:   "b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175",
+				Location: "/another/path/to/component",
+			},
+		}, evidence.Occurrences)
+	})
+
+	t.Run("WithIdentityAsStruct", func(t *testing.T) {
+		var evidence Evidence
+		err := json.Unmarshal([]byte(`{
+"identity": {
+  "field": "purl",
+  "confidence": 1,
+  "methods": [
+	{
+	  "technique": "filename",
+	  "confidence": 0.1,
+	  "value": "findbugs-project-3.0.0.jar"
+	},
+	{
+	  "technique": "ast-fingerprint",
+	  "confidence": 0.9,
+	  "value": "61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab"
+	}
+  ],
+  "tools": [
+	"bom-ref-of-tool-that-performed-analysis"
+  ]
+}}`), &evidence)
+		require.NoError(t, err)
+		require.Equal(t, &[]EvidenceIdentity{
+			{
+				Field:      EvidenceIdentityFieldTypePURL,
+				Confidence: toPointer(t, float32(1)),
+				Methods: &[]EvidenceIdentityMethod{
+					{
+						Technique:  "filename",
+						Confidence: toPointer(t, float32(0.1)),
+						Value:      "findbugs-project-3.0.0.jar",
+					},
+					{
+						Technique:  "ast-fingerprint",
+						Confidence: toPointer(t, float32(0.9)),
+						Value:      "61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab",
+					},
+				},
+				Tools: &[]BOMReference{
+					"bom-ref-of-tool-that-performed-analysis",
+				},
+			},
+		}, evidence.Identity)
+	})
+
+	t.Run("WithIdentityAsArray", func(t *testing.T) {
+		var evidence Evidence
+		err := json.Unmarshal([]byte(`{
+"identity": [
+	{
+		"field": "purl",
+		"confidence": 1
+	},
+	{
+		"field": "name",
+		"confidence": 0.1
+	}
+]}`), &evidence)
+		require.NoError(t, err)
+		require.Equal(t, &[]EvidenceIdentity{
+			{
+				Field:      EvidenceIdentityFieldTypePURL,
+				Confidence: toPointer(t, float32(1)),
+			},
+			{
+				Field:      EvidenceIdentityFieldTypeName,
+				Confidence: toPointer(t, float32(0.1)),
+			},
+		}, evidence.Identity)
+	})
+}