feat: deserialize single ComponentEvidence.identity (#900)

---------

Signed-off-by: Quentin Kaiser <quentin.kaiser@onekey.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Co-authored-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Author: qkaiser

cyclonedx/model/component_evidence.py

@@ -752,7 +752,10 @@ def __repr__(self) -> str:
 
 
 class _ComponentEvidenceSerializationHelper(serializable.helpers.BaseHelper):
-    """THIS CLASS IS NON-PUBLIC API"""
+    """THIS CLASS IS NON-PUBLIC API
+
+    This helper takes care of :attr:`ComponentEvidence.identity`.
+    """
 
     @classmethod
     def json_normalize(cls, o: ComponentEvidence, *,
@@ -761,13 +764,16 @@ def json_normalize(cls, o: ComponentEvidence, *,
         data: dict[str, Any] = json_loads(o.as_json(view))  # type:ignore[attr-defined]
         if view is SchemaVersion1Dot5:
             identities = data.get('identity', [])
-            if il := len(identities) > 1:
-                warn(f'CycloneDX 1.5 does not support multiple identity items; dropping {il - 1} items.')
+            if identities:
+                if (il := len(identities)) > 1:
+                    warn(f'CycloneDX 1.5 does not support multiple identity items; dropping {il - 1} items.')
                 data['identity'] = identities[0]
         return data
 
     @classmethod
     def json_denormalize(cls, o: dict[str, Any], **__: Any) -> Any:
+        if isinstance(identity := o.get('identity'), dict):
+            o = {**o, 'identity': [identity]}
         return ComponentEvidence.from_json(o)  # type:ignore[attr-defined]
 
     @classmethod
@@ -779,7 +785,7 @@ def xml_normalize(cls, o: ComponentEvidence, *,
         normalized: 'XmlElement' = o.as_xml(view, False, element_name, xmlns)  # type:ignore[attr-defined]
         if view is SchemaVersion1Dot5:
             identities = normalized.findall(f'./{{{xmlns}}}identity' if xmlns else './identity')
-            if il := len(identities) > 1:
+            if (il := len(identities)) > 1:
                 warn(f'CycloneDX 1.5 does not support multiple identity items; dropping {il - 1} items.')
                 for i in identities[1:]:
                     normalized.remove(i)

tests/_data/own/json/1.5/component_evidence_identity.json

@@ -127,3 +127,12 @@ def test_regression_issue690(self) -> None:
             json = json_loads(f.read())
         bom: Bom = Bom.from_json(json)  # <<< is expected to not crash
         self.assertIsNotNone(bom)
+
+    def test_component_evidence_identity(self) -> None:
+        json_file = join(OWN_DATA_DIRECTORY, 'json',
+                         SchemaVersion.V1_6.to_version(),
+                         'component_evidence_identity.json')
+        with open(json_file) as f:
+            json = json_loads(f.read())
+        bom: Bom = Bom.from_json(json)  # <<< is expected to not crash
+        self.assertIsNotNone(bom)

tests/_data/own/json/1.6/component_evidence_identity.json

@@ -16,6 +16,7 @@
 # Copyright (c) OWASP Foundation. All Rights Reserved.
 
 from collections.abc import Callable
+from os.path import join
 from typing import Any
 from unittest import TestCase
 from unittest.mock import patch
@@ -24,7 +25,7 @@
 
 from cyclonedx.model.bom import Bom
 from cyclonedx.schema import OutputFormat, SchemaVersion
-from tests import DeepCompareMixin, SnapshotMixin, mksname
+from tests import OWN_DATA_DIRECTORY, DeepCompareMixin, SnapshotMixin, mksname
 from tests._data.models import (
     all_get_bom_funct_valid_immut,
     all_get_bom_funct_valid_reversible_migrate,
@@ -46,3 +47,11 @@ def test_prepared(self, get_bom: Callable[[], Bom], *_: Any, **__: Any) -> None:
             bom = Bom.from_xml(s)
         self.assertBomDeepEqual(expected, bom,
                                 fuzzy_deps=get_bom in all_get_bom_funct_with_incomplete_deps)
+
+    def test_component_evidence_identity(self) -> None:
+        xml_file = join(OWN_DATA_DIRECTORY, 'xml',
+                        SchemaVersion.V1_6.to_version(),
+                        'component_evidence_identity.xml')
+        with open(xml_file) as f:
+            bom: Bom = Bom.from_xml(f)  # <<< is expected to not crash
+        self.assertIsNotNone(bom)

tests/_data/own/xml/1.5/component_evidence_identity.xml

@@ -37,9 +37,9 @@ class TestModelComponentEvidence(TestCase):
     def test_no_params(self) -> None:
         ComponentEvidence()  # Does not raise `NoPropertiesProvidedException`
 
-    def test_identity(self) -> None:
+    def test_identity_single(self) -> None:
         identity = Identity(field=IdentityField.NAME, confidence=Decimal('1'), concluded_value='test')
-        ce = ComponentEvidence(identity=[identity])
+        ce = ComponentEvidence(identity=identity)
         self.assertEqual(len(ce.identity), 1)
         self.assertEqual(ce.identity.pop().field, 'name')