class

Vex::Component

Inherits JSON::Serializable < Reference < Object

Component captures the fields shared by Product and Subcomponent. On the wire there is no Component type — only product and subcomponent shapes that share these keys. The spec lists subcomponents as a Component field, so a subcomponent can itself nest further subcomponents.

Constructors

new(pull : JSON::PullParser)
Source
new(id : String | Nil = nil, identifiers : Hash(String, String) | Nil = nil, hashes : Hash(String, String) | Nil = nil, subcomponents : Array(Subcomponent) | Nil = nil)
Source
new(*, __pull_for_json_serializable pull : JSON::PullParser)
Source

Instance methods

==(other : self)

Returns true if this reference is the same as other. Invokes same?.

hash(hasher)

See Object#hash(hasher)

hashes

Cryptographic hashes keyed by algorithm (sha-256, sha-512, ...).

Source
hashes=(hashes : Hash(String, String) | Nil)

Cryptographic hashes keyed by algorithm (sha-256, sha-512, ...).

Source
id

IRI identifying the component (recommended: a Package URL).

Source
id=(id : String | Nil)

IRI identifying the component (recommended: a Package URL).

Source
identified?

A component is identifiable when it carries at least one of @id, identifiers, or hashes. Spec: "Product details MUST include [product_id]" — and subcomponents inherit the same requirement from the Component fields table.

Source
identifiers

Software identifiers keyed by type (purl, cpe22, cpe23).

Source
identifiers=(identifiers : Hash(String, String) | Nil)

Software identifiers keyed by type (purl, cpe22, cpe23).

Source
matches?(identifier : String) : Bool

True when this component's @id, any identifier value, OR any (recursive) subcomponent matches. Used by Document lookups so a consumer asking about a named subcomponent hits the parent statement.

Source
subcomponents

Nested subcomponents. The spec defines subcomponents on Component, so this is available on both Product and Subcomponent (allowing nesting).

Source
subcomponents=(subcomponents : Array(Subcomponent) | Nil)

Nested subcomponents. The spec defines subcomponents on Component, so this is available on both Product and Subcomponent (allowing nesting).

Source
warnings

Spec-recommended keys are listed in Appendix A (hashes) and Appendix B (identifiers). Unrecognized keys are not errors — the spec uses SHOULD — but tooling consuming the document may not know how to interpret them. Returns one warning string per unrecognized key, plus an @id-not-an-IRI warning when the @id lacks a scheme (e.g. a bare purl missing its pkg: prefix, or a CVE name in the wrong slot).

Source