From 47fa7939c655692308b4c023d1c114a653fd17d2 Mon Sep 17 00:00:00 2001
From: Wleeaf <179125857+wleeaf@users.noreply.github.com>
Date: Sun, 25 Oct 2026 10:39:05 +0000
Subject: [PATCH] Write metadata distribution constraints

Metadata.distributionConstraints (CycloneDX 1.7) is parsed from JSON
and XML, but MetadataSerializer writes every metadata field by hand and
had no case for it, so the TLP classification was dropped from every
generated BOM. Re-generating the spec test file
valid-metadata-distribution-1.7.json gave an empty metadata object.

Write it after the properties, where the 1.7 XSD expects it, for the
versions its @VersionFilter allows.

Signed-off-by: Wleeaf <179125857+wleeaf@users.noreply.github.com>
---
 .../util/serializer/MetadataSerializer.java         |  4 ++++
 .../java/org/cyclonedx/BomJsonGeneratorTest.java    | 13 +++++++++++++
 .../java/org/cyclonedx/BomXmlGeneratorTest.java     | 10 ++++++++++
 3 files changed, 27 insertions(+)

diff --git a/src/main/java/org/cyclonedx/util/serializer/MetadataSerializer.java b/src/main/java/org/cyclonedx/util/serializer/MetadataSerializer.java
index 2e7fea9de..a3ef8ae41 100644
--- a/src/main/java/org/cyclonedx/util/serializer/MetadataSerializer.java
+++ b/src/main/java/org/cyclonedx/util/serializer/MetadataSerializer.java
@@ -112,6 +112,10 @@ private void createMetadataInfo(
       }
     }
 
+    if (metadata.getDistributionConstraints() != null && shouldSerializeField(metadata, version, "distributionConstraints")) {
+      jsonGenerator.writeObjectField("distributionConstraints", metadata.getDistributionConstraints());
+    }
+
     jsonGenerator.writeEndObject();
   }
 
diff --git a/src/test/java/org/cyclonedx/BomJsonGeneratorTest.java b/src/test/java/org/cyclonedx/BomJsonGeneratorTest.java
index 6ce4755aa..244468222 100644
--- a/src/test/java/org/cyclonedx/BomJsonGeneratorTest.java
+++ b/src/test/java/org/cyclonedx/BomJsonGeneratorTest.java
@@ -120,6 +120,19 @@ public void schema12MultipleDependenciesJsonTest() throws Exception {
         assertTrue(jsonParser.isValid(file, Version.VERSION_12));
     }
 
+    @Test
+    public void schema17MetadataDistributionConstraintsJsonTest() throws Exception {
+        final byte[] bomBytes = Objects.requireNonNull(this.getClass().getResourceAsStream("/1.7/valid-metadata-distribution-1.7.json")).readAllBytes();
+        final Bom bom = new JsonParser().parse(bomBytes);
+
+        BomJsonGenerator generator = BomGeneratorFactory.createJson(Version.VERSION_17, bom);
+        JsonNode metadata = generator.toJsonNode().get("metadata");
+        assertEquals("RED", metadata.get("distributionConstraints").get("tlp").asText());
+
+        generator = BomGeneratorFactory.createJson(Version.VERSION_16, bom);
+        assertNull(generator.toJsonNode().get("metadata").get("distributionConstraints"));
+    }
+
     @Test
     public void schema13EmptyComponentsJsonTest() throws Exception {
         final Bom bom =  new Bom();
diff --git a/src/test/java/org/cyclonedx/BomXmlGeneratorTest.java b/src/test/java/org/cyclonedx/BomXmlGeneratorTest.java
index f04e1f0d4..42846342a 100644
--- a/src/test/java/org/cyclonedx/BomXmlGeneratorTest.java
+++ b/src/test/java/org/cyclonedx/BomXmlGeneratorTest.java
@@ -1335,6 +1335,16 @@ private File writeToFile(String xmlString) throws Exception {
         return tempFile;
     }
 
+    @Test
+    public void schema17MetadataDistributionConstraintsGenerationTest() throws Exception {
+        BomXmlGenerator generator = BomGeneratorFactory.createXml(Version.VERSION_17, createCommonBomXml("/1.7/valid-metadata-distribution-1.7.xml"));
+        String xml = generator.toXmlString();
+        assertTrue(xml.contains("<tlp>RED</tlp>"), xml);
+        File file = writeToFile(xml);
+        XmlParser parser = new XmlParser();
+        assertTrue(parser.isValid(file, Version.VERSION_17));
+    }
+
     private Bom createCommonBomXml(String resource) throws Exception {
         final byte[] bomBytes = Objects.requireNonNull(this.getClass().getResourceAsStream(resource)).readAllBytes();
         XmlParser parser = new XmlParser();