Skip to content

Commit 07376a1

Browse files
stevespringettstevespringett
authored
Migrate enveloped signature support from JSF to JSS (#858)
# Migrate enveloped signature support from JSF to JSS (ITU-T X.590) ## Summary - Replaced legacy JSON Signature Format (JSF) with JSON Signature Scheme (JSS) per ITU-T X.590 (10/2023). Added CycloneDX 2.0 model schema that implements JSS - Updated all schema files referencing signatures to use the new `signatures` array (JSS) instead of singular `signature` object (JSF) - Removed old JSF test (`valid-signatures-2.0.json`) and added 18 targeted JSS test cases (8 valid, 10 invalid) This PR closes #851 All tests are **structural validations only**. Keys, certificates, thumbprints, and signature values are illustrative and may not be cryptographically valid. No content validation is performed.
2 parents dd0a040 + 6e2c045 commit 07376a1

29 files changed

Lines changed: 715 additions & 133 deletions

‎schema/2.0/cyclonedx-2.0.schema.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,8 @@
8888
"externalReferences": {
8989
"$ref": "model/cyclonedx-common-2.0.schema.json#/$defs/externalReferences"
9090
},
91-
"signature": {
92-
"$ref": "model/cyclonedx-common-2.0.schema.json#/$defs/signature"
91+
"signatures": {
92+
"$ref": "model/cyclonedx-common-2.0.schema.json#/$defs/signatures"
9393
}
9494
},
9595
"allOf": [

‎schema/2.0/model/cyclonedx-annotation-2.0.schema.json‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,10 +104,8 @@
104104
"title": "Text",
105105
"description": "The textual content of the annotation."
106106
},
107-
"signature": {
108-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
109-
"title": "Signature",
110-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
107+
"signatures": {
108+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures"
111109
}
112110
}
113111
}

‎schema/2.0/model/cyclonedx-citation-2.0.schema.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,8 @@
6565
"title": "Note",
6666
"description": "A description or comment about the context or quality of the data attribution."
6767
},
68-
"signature": {
69-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
68+
"signatures": {
69+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures",
7070
"title": "Signature",
7171
"description": "A digital signature verifying the authenticity or integrity of the attribution."
7272
}

‎schema/2.0/model/cyclonedx-common-2.0.schema.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -771,10 +771,10 @@
771771
"title": "Locale",
772772
"description": "Defines a syntax for representing two character language code (ISO-639) followed by an optional two character country code. The language code must be lower case. If the country code is specified, the country code must be upper case. The language code and country code must be separated by a minus sign. Examples: en, en-US, fr, fr-CA"
773773
},
774-
"signature": {
775-
"$ref": "../jsf-0.82.schema.json#/definitions/signature",
776-
"title": "Signature",
777-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
774+
"signatures": {
775+
"$ref": "cyclonedx-jss_X590_2023_10-2.0.schema.json#/$defs/signatures",
776+
"title": "Signatures",
777+
"description": "Enveloped signatures in [JSON Signature Scheme (JSS/ITU-T X.590)](https://www.itu.int/epublications/publication/itu-t-x-590-2023-10-json-signature-scheme-jss)."
778778
}
779779
}
780780
}

‎schema/2.0/model/cyclonedx-component-2.0.schema.json‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -224,10 +224,8 @@
224224
"externalReferences": {
225225
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReferences"
226226
},
227-
"signature": {
228-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
229-
"title": "Signature",
230-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
227+
"signatures": {
228+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures"
231229
}
232230
},
233231
"allOf": [

‎schema/2.0/model/cyclonedx-composition-2.0.schema.json‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,8 @@
6666
"title": "BOM references",
6767
"description": "The bom-ref identifiers of the vulnerabilities being described."
6868
},
69-
"signature": {
70-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
71-
"title": "Signature",
72-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
69+
"signatures": {
70+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures"
7371
}
7472
}
7573
},

‎schema/2.0/model/cyclonedx-declaration-2.0.schema.json‎

Lines changed: 14 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -133,11 +133,9 @@
133133
}
134134
}
135135
},
136-
"signature": {
137-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
138-
"title": "Signature",
139-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
140-
}
136+
"signatures": {
137+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures"
138+
}
141139
}
142140
}
143141
},
@@ -191,10 +189,8 @@
191189
"externalReferences": {
192190
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReferences"
193191
},
194-
"signature": {
195-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
196-
"title": "Signature",
197-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
192+
"signatures": {
193+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures"
198194
}
199195
}
200196
}
@@ -296,11 +292,9 @@
296292
"title": "Reviewer",
297293
"description": "The reviewer of the evidence."
298294
},
299-
"signature": {
300-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
301-
"title": "Signature",
302-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
303-
}
295+
"signatures": {
296+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures"
297+
}
304298
}
305299
}
306300
},
@@ -369,10 +363,8 @@
369363
"title": "Role",
370364
"description": "The signatory's role within an organization."
371365
},
372-
"signature": {
373-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
374-
"title": "Signature",
375-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
366+
"signatures": {
367+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures"
376368
},
377369
"organization": {
378370
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntity",
@@ -385,17 +377,13 @@
385377
}
386378
}
387379
},
388-
"signature": {
389-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
390-
"title": "Signature",
391-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
380+
"signatures": {
381+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures"
392382
}
393383
}
394384
},
395-
"signature": {
396-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signature",
397-
"title": "Signature",
398-
"description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
385+
"signatures": {
386+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures"
399387
}
400388
}
401389
}

0 commit comments

Comments
 (0)