class

CycloneDX::Validator

Inherits Reference / Object

Constants

BOM_LINK_PREFIX = "urn:cdx:"

A reference into a different BOM (urn:cdx:<serial>/<version>#<bom-ref>) rather than a local bom-ref. Those cannot be resolved from here.

CPE_PATTERN = /\A(cpe:\/[aho]?(:[^:]*){0,6}|cpe:2\.3(:[^:]*){11})\z/i

A CPE 2.2 URI (cpe:/part:vendor:…) or a CPE 2.3 formatted string (cpe:2.3: plus eleven colon-separated components).

A shape check, not the XSD's full pattern: it exists to reject a value that is plainly not a CPE, which is the mistake that actually happens. Fields containing escaped colons (\:) are rare and not accounted for.

REF_KEYS = {"ref", "dependsOn", "provides", "assemblies", "dependencies", "vulnerabilities", "subjects"}

Keys whose values are bom-ref references rather than definitions.

Restricted to the ones this object model can actually populate. Notably absent are the declarations cross-links, whose targets (declaration evidence, attestations) are not modelled yet, so every such reference would look dangling.

Constructors

Instance methods

errors

Problems that make the serialized document invalid. validate fails on these.

Source
validate(bom : BOM) : Bool
Source
warnings

Places where the BOM was valid but over-specified for its declared specVersion, and the version gate downgraded it on the way out: a field stripped, an enum value swapped for its catch-all, a repeated element collapsed. The output is schema-valid, so these do not fail validate, but they are the record of what the declared version could not carry.

Source