Skip to content

Commit d823abb

Browse files
stevespringettstevespringett
authored
Merge branch '2.0-dev' into 2.0-dev-conditional-components
2 parents af32aca + ab843c6 commit d823abb

44 files changed

Lines changed: 4135 additions & 492 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎schema/2.0/cyclonedx-2.0-bundled.min.schema.json‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎schema/2.0/cyclonedx-2.0-bundled.schema.json‎

Lines changed: 1716 additions & 213 deletions
Large diffs are not rendered by default.

‎schema/2.0/model/cyclonedx-common-2.0.schema.json‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,14 @@
5454
"additionalProperties": false,
5555
"properties": {
5656
"alg": {
57-
"$ref": "#/$defs/hashAlgorithm"
57+
"$ref": "#/$defs/hashAlgorithm",
58+
"title": "Hash Algorithm",
59+
"description": "The standard, well-known algorithm used to compute the hash."
5860
},
5961
"content": {
60-
"$ref": "#/$defs/hashValue"
62+
"$ref": "#/$defs/hashValue",
63+
"title": "Hash Value",
64+
"description": "The value of the hash computed using the standard, well-known algorithm."
6165
}
6266
}
6367
},
@@ -223,6 +227,7 @@
223227
"patent-family",
224228
"patent-assertion",
225229
"citation",
230+
"swid-tag",
226231
"other"
227232
],
228233
"meta:enum": {
@@ -273,6 +278,7 @@
273278
"patent-family": "References information about a patent family which may be defined in human-readable documents or in machine-readable formats such as CycloneDX or ST.96. A patent family is a group of related patent applications or granted patents that cover the same or similar invention. For detailed patent family information or to reference the information provided directly by patent offices, it is recommended to leverage standards from the World Intellectual Property Organization (WIPO) such as [ST.96](https://www.wipo.int/standards/en/st96).",
274279
"patent-assertion" : "References assertions made regarding patents associated with a component or service. Assertions distinguish between ownership, licensing, and other relevant interactions with patents.",
275280
"citation": "A reference to external citations applicable to the object identified by this BOM entry or the BOM itself. When used with a BOM-Link, this allows offloading citations into a separate CycloneDX BOM.",
281+
"swid-tag": "A Software Identification (SWID) tag document conforming to ISO/IEC 19770-2. The reference resolves to the XML SoftwareIdentity document itself, including all of its metadata (entities, evidence, payload, links, and meta elements). This is distinct from the `swid` identifier scheme, which carries only the tagId of a SWID tag.",
276282
"other": "Use this if no other types accurately describe the purpose of the external reference."
277283
}
278284
},

‎schema/2.0/model/cyclonedx-component-2.0.schema.json‎

Lines changed: 152 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -68,27 +68,8 @@
6868
"title": "BOM Reference",
6969
"description": "An identifier which can be used to reference the component elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
7070
},
71-
"supplier": {
72-
"title": "Component Supplier",
73-
"description": " The organization that supplied the component. The supplier may often be the manufacturer, but may also be a distributor or repackager.",
74-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntity"
75-
},
76-
"manufacturer": {
77-
"title": "Component Manufacturer",
78-
"description": "The organization that created the component.\nManufacturer is common in components created through automated processes. Components created through manual means may have `@.authors` instead.",
79-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntity"
80-
},
81-
"authors" :{
82-
"type": "array",
83-
"title": "Component Authors",
84-
"description": "The person(s) who created the component.\nAuthors are common in components created through manual processes. Components created through automated means may have `@.manufacturer` instead.",
85-
"items": {"$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalContact"}
86-
},
87-
"publisher": {
88-
"type": "string",
89-
"title": "Component Publisher",
90-
"description": "The person(s) or organization(s) that published the component",
91-
"examples": ["Acme Inc"]
71+
"parties": {
72+
"$ref": "cyclonedx-party-2.0.schema.json#/$defs/parties"
9273
},
9374
"group": {
9475
"type": "string",
@@ -156,39 +137,8 @@
156137
"$ref": "cyclonedx-patent-2.0.schema.json#/$defs/patentAssertions",
157138
"title": "Component Patent(s)"
158139
},
159-
"cpe": {
160-
"type": "string",
161-
"title": "Common Platform Enumeration (CPE)",
162-
"description": "Asserts the identity of the component using CPE. The CPE must conform to the CPE 2.2 or 2.3 specification. See [https://nvd.nist.gov/products/cpe](https://nvd.nist.gov/products/cpe). Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the component's identity.",
163-
"examples": ["cpe:2.3:a:acme:component_framework:-:*:*:*:*:*:*:*"]
164-
},
165-
"purl": {
166-
"type": "string",
167-
"title": "Package URL (purl)",
168-
"description": "Asserts the identity of the component using package-url (purl). The purl, if specified, must be valid and conform to the specification defined at: [https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec). Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the component's identity.",
169-
"examples": ["pkg:maven/com.acme/tomcat-catalina@9.0.14?packaging=jar"]
170-
},
171-
"omniborId": {
172-
"type": "array",
173-
"title": "OmniBOR Artifact Identifier (gitoid)",
174-
"description": "Asserts the identity of the component using the OmniBOR Artifact ID. The OmniBOR, if specified, must be valid and conform to the specification defined at: [https://www.iana.org/assignments/uri-schemes/prov/gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid). Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the component's identity.",
175-
"items": { "type": "string" },
176-
"examples": [
177-
"gitoid:blob:sha1:a94a8fe5ccb19ba61c4c0873d391e987982fbbd3",
178-
"gitoid:blob:sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
179-
]
180-
},
181-
"swhid": {
182-
"type": "array",
183-
"title": "Software Heritage Identifier",
184-
"description": "Asserts the identity of the component using the Software Heritage persistent identifier (SWHID). The SWHID, if specified, must be valid and conform to the specification defined at: [https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html](https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html). Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the component's identity.",
185-
"items": { "type": "string" },
186-
"examples": ["swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2"]
187-
},
188-
"swid": {
189-
"$ref": "#/$defs/swid",
190-
"title": "SWID Tag",
191-
"description": "Asserts the identity of the component using [ISO-IEC 19770-2 Software Identification (SWID) Tags](https://www.iso.org/standard/65666.html). Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the component's identity."
140+
"identifiers": {
141+
"$ref": "#/$defs/identifiers"
192142
},
193143
"pedigree": {
194144
"type": "object",
@@ -425,57 +375,6 @@
425375
}
426376
}
427377
},
428-
"swid": {
429-
"type": "object",
430-
"title": "SWID Tag",
431-
"description": "Specifies metadata and content for ISO-IEC 19770-2 Software Identification (SWID) Tags.",
432-
"required": [
433-
"tagId",
434-
"name"
435-
],
436-
"additionalProperties": false,
437-
"properties": {
438-
"tagId": {
439-
"type": "string",
440-
"title": "Tag ID",
441-
"description": "Maps to the tagId of a SoftwareIdentity."
442-
},
443-
"name": {
444-
"type": "string",
445-
"title": "Name",
446-
"description": "Maps to the name of a SoftwareIdentity."
447-
},
448-
"version": {
449-
"type": "string",
450-
"title": "Version",
451-
"default": "0.0",
452-
"description": "Maps to the version of a SoftwareIdentity."
453-
},
454-
"tagVersion": {
455-
"type": "integer",
456-
"title": "Tag Version",
457-
"default": 0,
458-
"description": "Maps to the tagVersion of a SoftwareIdentity."
459-
},
460-
"patch": {
461-
"type": "boolean",
462-
"title": "Patch",
463-
"default": false,
464-
"description": "Maps to the patch of a SoftwareIdentity."
465-
},
466-
"text": {
467-
"title": "Attachment text",
468-
"description": "Specifies the metadata and content of the SWID tag.",
469-
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment"
470-
},
471-
"url": {
472-
"type": "string",
473-
"title": "URL",
474-
"description": "The URL to the SWID file.",
475-
"format": "iri-reference"
476-
}
477-
}
478-
},
479378
"componentEvidence": {
480379
"type": "object",
481380
"title": "Evidence",
@@ -633,16 +532,11 @@
633532
"type": "object",
634533
"title": "Identity Evidence",
635534
"description": "Evidence that substantiates the identity of a component.",
636-
"required": [ "field" ],
535+
"required": [ "scheme" ],
637536
"additionalProperties": false,
638537
"properties": {
639-
"field": {
640-
"type": "string",
641-
"enum": [
642-
"group", "name", "version", "purl", "cpe", "omniborId", "swhid", "swid", "hash"
643-
],
644-
"title": "Field",
645-
"description": "The identity field of the component which the evidence describes."
538+
"scheme": {
539+
"$ref": "#/$defs/identityScheme"
646540
},
647541
"confidence": {
648542
"type": "number",
@@ -654,7 +548,7 @@
654548
"concludedValue": {
655549
"type": "string",
656550
"title": "Concluded Value",
657-
"description": "The value of the field (cpe, purl, etc) that has been concluded based on the aggregate of all methods (if available)."
551+
"description": "The value of the scheme that has been concluded based on the aggregate of all methods (if available)."
658552
},
659553
"methods": {
660554
"type": "array",
@@ -805,6 +699,150 @@
805699
"$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataGovernance"
806700
}
807701
}
702+
},
703+
"identifiers": {
704+
"type": "array",
705+
"title": "Identifiers",
706+
"description": "Identifiers asserted by one or more parties to identify this component. Each entry groups one or more identity claims by the party asserting them. Identifiers carry positive claims of identity. For unverified or inferred identity data, use evidence.",
707+
"items": {
708+
"$ref": "#/$defs/identifier"
709+
},
710+
"uniqueItems": true
711+
},
712+
"identifier": {
713+
"type": "object",
714+
"title": "Identifier",
715+
"description": "A set of identifiers attributed to a single asserting party.",
716+
"required": [
717+
"party",
718+
"identities"
719+
],
720+
"additionalProperties": false,
721+
"properties": {
722+
"bom-ref": {
723+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
724+
},
725+
"party": {
726+
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
727+
"title": "Asserting Party",
728+
"description": "Reference using bom-link or bom-ref to the party making the identity assertion."
729+
},
730+
"identities": {
731+
"type": "array",
732+
"title": "Identities",
733+
"description": "The discrete identity claims asserted by the party.",
734+
"items": {
735+
"$ref": "#/$defs/identity"
736+
},
737+
"minItems": 1,
738+
"uniqueItems": true
739+
}
740+
}
741+
},
742+
"identity": {
743+
"type": "object",
744+
"title": "Identity",
745+
"description": "A single identity claim, pairing a typed identifier scheme with the value asserted under that scheme.",
746+
"required": [
747+
"scheme",
748+
"value"
749+
],
750+
"additionalProperties": false,
751+
"properties": {
752+
"scheme": { "$ref": "#/$defs/identityScheme" },
753+
"value": { "$ref": "#/$defs/identityValue" }
754+
}
755+
},
756+
"identityScheme": {
757+
"title": "Identifier Scheme",
758+
"description": "The scheme under which an identifier is asserted. Either a predefined value or a custom scheme described by name and description.",
759+
"oneOf": [
760+
{
761+
"type": "string",
762+
"enum": [
763+
"purl",
764+
"cpe",
765+
"swid",
766+
"swhid",
767+
"omniborid",
768+
"epc-rfid",
769+
"giai",
770+
"gln",
771+
"gmn",
772+
"gtin-8",
773+
"gtin-12",
774+
"gtin-13",
775+
"gtin-14",
776+
"mpn",
777+
"part-number",
778+
"model-number",
779+
"sku",
780+
"serial-number",
781+
"asset-tag",
782+
"udi-di",
783+
"udi-pi",
784+
"fcc-id",
785+
"imei",
786+
"mac-address",
787+
"tei"
788+
],
789+
"meta:enum": {
790+
"purl": "Package-URL identifier, conforming to the Package-URL specification.",
791+
"cpe": "Common Platform Enumeration name, conforming to NIST Interagency Report 7695.",
792+
"swid": "Software Identification tag identifier, conforming to ISO/IEC 19770-2.",
793+
"swhid": "Software Heritage persistent identifier.",
794+
"omniborid": "OmniBOR Artifact Identifier, also known as a gitoid.",
795+
"epc-rfid": "Electronic Product Code - RFID (EPC Tag Data Standard)",
796+
"giai": "Global Individual Asset Identifier (GIAI)",
797+
"gln": "Global Location Number (GLN)",
798+
"gmn": "Global Model Number (GMN)",
799+
"gtin-8": "Global Trade Identification Number (GTIN-8 / EAN/UCC-8)",
800+
"gtin-12": "Global Trade Identification Number (GTIN-12 / UPC-A)",
801+
"gtin-13": "Global Trade Identification Number (GTIN-13 / EAN/UCC-13)",
802+
"gtin-14": "Global Trade Identification Number (GTIN / EAN/UCC-14 or ITF-14)",
803+
"mpn": "Manufacturer Part Number, assigned by the original manufacturer.",
804+
"part-number": "Part number assigned by a distributor, integrator, or operator.",
805+
"model-number": "Product model number assigned by the manufacturer.",
806+
"sku": "Stock Keeping Unit, assigned by a seller or distributor.",
807+
"serial-number": "Unique identifier for an individual instance of a product.",
808+
"asset-tag": "Asset tag assigned by the owning or operating organization.",
809+
"udi-di": "Unique Device Identifier, Device Identifier portion, conforming to ISO/IEC 15459 and applicable regulatory frameworks.",
810+
"udi-pi": "Unique Device Identifier, Production Identifier portion, conforming to ISO/IEC 15459 and applicable regulatory frameworks.",
811+
"fcc-id": "United States Federal Communications Commission equipment identifier.",
812+
"imei": "International Mobile Equipment Identity, conforming to 3GPP TS 23.003.",
813+
"mac-address": "IEEE 802 Media Access Control address.",
814+
"tei": "Transparency Exchange Identifier conforming to the Transparency Exchange API specification."
815+
}
816+
},
817+
{
818+
"type": "object",
819+
"title": "Custom Identifier Scheme",
820+
"description": "A custom identifier scheme not represented in the predefined taxonomy.",
821+
"required": [
822+
"name"
823+
],
824+
"additionalProperties": false,
825+
"properties": {
826+
"name": {
827+
"type": "string",
828+
"minLength": 1,
829+
"title": "Name",
830+
"description": "The name of the custom identifier scheme."
831+
},
832+
"description": {
833+
"type": "string",
834+
"title": "Description",
835+
"description": "A description of the custom identifier scheme."
836+
}
837+
}
838+
}
839+
]
840+
},
841+
"identityValue": {
842+
"type": "string",
843+
"minLength": 1,
844+
"title": "Identifier Value",
845+
"description": "The value of an identifier."
808846
}
809847
}
810848
}

0 commit comments

Comments
 (0)