JSON output does not guarantee component.version value

[dmuse89]

I was using the JSON output of this tool as an input for another tool. I implemented a validation function in python for my other tool in order to ensure its correctness before processing the file, and can be seen as follows:

import json
import jsonschema
import pkg_resources

def validate_bom(filename):
    bom = json.load(open(filename, "r"))
    spec_version = bom.get("specVersion", None)
    schema_path = pkg_resources.resource_filename('cyclonedx', f'schema/bom-{spec_version}.schema.json')
    bom_schema = json.load(open(schema_path, "r"))
    try:
        jsonschema.validate(instance=bom, schema=bom_schema)
    except jsonschema.exceptions.ValidationError as err:
        raise err
    return True

In this case I was using I created a BoM using schema v1.3 and noticed that there was a version value missing from the component within the optional metadata property, and was throwing an error as invalid.

In the schema file bom-1.3.schema.json, the optional metadata section, allows for components to be listed and references the component in the #/definitions/component section, where a version is required. In this case, there was no version associated with the component found in the metadata secion.

The output is therefore non-compliant to the v1.3 schema standard, and the output should be verified to ensure that it is compliant before outputting to the user.

[jkowalleck]

according to the specs JSON schema v1.3 the component.version is required and must be a string.
see https://github.com/CycloneDX/specification/blob/c710388b96501867c6e3119fca4fbea139711d56/schema/bom-1.3.schema.json#L231
see https://github.com/CycloneDX/specification/blob/c710388b96501867c6e3119fca4fbea139711d56/schema/bom-1.3.xsd#L266

therefore described behavior is clearly a bug

[jkowalleck]

thanks for the report.
@dmuse89 could you review #247 ? this should fix the issue