Skip to content

Commit 30b1d70

Browse files
stevespringettstevespringett
authored
Merge pull request #198 from CycloneDX/v1.5-dev-tool-deprecation
Deprecated tool in favor of components and services used as tools
2 parents 1f0978a + bba0493 commit 30b1d70

12 files changed

Lines changed: 351 additions & 90 deletions

‎schema/bom-1.5.proto‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -391,7 +391,7 @@ message Metadata {
391391
// The date and time (timestamp) when the document was created.
392392
optional google.protobuf.Timestamp timestamp = 1;
393393
// The tool(s) used in the creation of the BOM.
394-
repeated Tool tools = 2;
394+
optional Tool tools = 2;
395395
// The person(s) who created the BOM. Authors are common in BOMs created through manual processes. BOMs created through automated means may not have authors.
396396
repeated OrganizationalContact authors = 3;
397397
// The component that the BOM describes.
@@ -522,15 +522,20 @@ message Swid {
522522

523523
// Specifies a tool (manual or automated).
524524
message Tool {
525-
// The vendor of the tool used to create the BOM.
526-
optional string vendor = 1;
527-
// The name of the tool used to create the BOM.
528-
optional string name = 2;
529-
// The version of the tool used to create the BOM.
530-
optional string version = 3;
531-
repeated Hash hashes = 4;
532-
// Provides the ability to document external references related to the tool.
533-
repeated ExternalReference external_references = 5;
525+
// DEPRECATED - DO NOT USE - The vendor of the tool used to create the BOM.
526+
optional string vendor = 1 [deprecated = true];
527+
// DEPRECATED - DO NOT USE - The name of the tool used to create the BOM.
528+
optional string name = 2 [deprecated = true];
529+
// DEPRECATED - DO NOT USE - The version of the tool used to create the BOM.
530+
optional string version = 3 [deprecated = true];
531+
// DEPRECATED - DO NOT USE
532+
repeated Hash hashes = 4 [deprecated = true];
533+
// DEPRECATED - DO NOT USE - Provides the ability to document external references related to the tool.
534+
repeated ExternalReference external_references = 5 [deprecated = true];
535+
// A list of software and hardware components used as tools
536+
repeated Component components = 6;
537+
// A list of services used as tools. This may include microservices, function-as-a-service, and other types of network or intra-process services.
538+
repeated Service services = 7;
534539
}
535540

536541
// Specifies a property
@@ -635,7 +640,7 @@ message Vulnerability {
635640
// Individuals or organizations credited with the discovery of the vulnerability.
636641
optional VulnerabilityCredits credits = 14;
637642
// The tool(s) used to identify, confirm, or score the vulnerability.
638-
repeated Tool tools = 15;
643+
optional Tool tools = 15;
639644
// An assessment of the impact and exploitability of the vulnerability.
640645
optional VulnerabilityAnalysis analysis = 16;
641646
// affects

‎schema/bom-1.5.schema.json‎

Lines changed: 67 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -137,11 +137,39 @@
137137
"description": "The date and time (timestamp) when the BOM was created."
138138
},
139139
"tools": {
140-
"type": "array",
141-
"title": "Creation Tools",
142-
"description": "The tool(s) used in the creation of the BOM.",
143-
"additionalItems": false,
144-
"items": {"$ref": "#/definitions/tool"}
140+
"oneOf": [
141+
{
142+
"type": "object",
143+
"title": "Creation Tools",
144+
"description": "The tool(s) used in the creation of the BOM.",
145+
"additionalProperties": false,
146+
"properties": {
147+
"components": {
148+
"type": "array",
149+
"additionalItems": false,
150+
"items": {"$ref": "#/definitions/component"},
151+
"uniqueItems": true,
152+
"title": "Components",
153+
"description": "A list of software and hardware components used as tools"
154+
},
155+
"services": {
156+
"type": "array",
157+
"additionalItems": false,
158+
"items": {"$ref": "#/definitions/service"},
159+
"uniqueItems": true,
160+
"title": "Services",
161+
"description": "A list of services used as tools. This may include microservices, function-as-a-service, and other types of network or intra-process services."
162+
}
163+
}
164+
},
165+
{
166+
"type": "array",
167+
"title": "Creation Tools (legacy)",
168+
"description": "[Deprecated] The tool(s) used in the creation of the BOM.",
169+
"additionalItems": false,
170+
"items": {"$ref": "#/definitions/tool"}
171+
}
172+
]
145173
},
146174
"authors" :{
147175
"type": "array",
@@ -183,7 +211,7 @@
183211
"tool": {
184212
"type": "object",
185213
"title": "Tool",
186-
"description": "Information about the automated or manual tool used",
214+
"description": "[Deprecated] - DO NOT USE. This will be removed in a future version. This will be removed in a future version. Use component or service instead. Information about the automated or manual tool used",
187215
"additionalProperties": false,
188216
"properties": {
189217
"vendor": {
@@ -1792,11 +1820,39 @@
17921820
}
17931821
},
17941822
"tools": {
1795-
"type": "array",
1796-
"title": "Creation Tools",
1797-
"description": "The tool(s) used to identify, confirm, or score the vulnerability.",
1798-
"additionalItems": false,
1799-
"items": {"$ref": "#/definitions/tool"}
1823+
"oneOf": [
1824+
{
1825+
"type": "object",
1826+
"title": "Tools",
1827+
"description": "The tool(s) used to identify, confirm, or score the vulnerability.",
1828+
"additionalProperties": false,
1829+
"properties": {
1830+
"components": {
1831+
"type": "array",
1832+
"additionalItems": false,
1833+
"items": {"$ref": "#/definitions/component"},
1834+
"uniqueItems": true,
1835+
"title": "Components",
1836+
"description": "A list of software and hardware components used as tools"
1837+
},
1838+
"services": {
1839+
"type": "array",
1840+
"additionalItems": false,
1841+
"items": {"$ref": "#/definitions/service"},
1842+
"uniqueItems": true,
1843+
"title": "Services",
1844+
"description": "A list of services used as tools. This may include microservices, function-as-a-service, and other types of network or intra-process services."
1845+
}
1846+
}
1847+
},
1848+
{
1849+
"type": "array",
1850+
"title": "Tools (legacy)",
1851+
"description": "[Deprecated] The tool(s) used to identify, confirm, or score the vulnerability.",
1852+
"additionalItems": false,
1853+
"items": {"$ref": "#/definitions/tool"}
1854+
}
1855+
]
18001856
},
18011857
"analysis": {
18021858
"type": "object",

‎schema/bom-1.5.xsd‎

Lines changed: 42 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,27 @@ limitations under the License.
5454
<xs:documentation>The tool(s) used in the creation of the BOM.</xs:documentation>
5555
</xs:annotation>
5656
<xs:complexType>
57-
<xs:sequence minOccurs="0" maxOccurs="unbounded">
58-
<xs:element name="tool" minOccurs="0" type="bom:toolType"/>
59-
</xs:sequence>
57+
<xs:choice>
58+
<xs:sequence minOccurs="0" maxOccurs="unbounded">
59+
<xs:element name="tool" minOccurs="0" type="bom:toolType">
60+
<xs:annotation>
61+
<xs:documentation>DEPRECATED. Use tools\components or tools\services instead.</xs:documentation>
62+
</xs:annotation>
63+
</xs:element>
64+
</xs:sequence>
65+
<xs:sequence minOccurs="0" maxOccurs="1">
66+
<xs:element name="components" type="bom:componentsType" minOccurs="0" maxOccurs="1">
67+
<xs:annotation>
68+
<xs:documentation>A list of software and hardware components used as tools.</xs:documentation>
69+
</xs:annotation>
70+
</xs:element>
71+
<xs:element name="services" type="bom:servicesType" minOccurs="0" maxOccurs="1">
72+
<xs:annotation>
73+
<xs:documentation>A list of services used as tools.</xs:documentation>
74+
</xs:annotation>
75+
</xs:element>
76+
</xs:sequence>
77+
</xs:choice>
6078
</xs:complexType>
6179
</xs:element>
6280
<xs:element name="authors" minOccurs="0" maxOccurs="1">
@@ -2306,9 +2324,27 @@ limitations under the License.
23062324
<xs:documentation>The tool(s) used to identify, confirm, or score the vulnerability.</xs:documentation>
23072325
</xs:annotation>
23082326
<xs:complexType>
2309-
<xs:sequence minOccurs="0" maxOccurs="unbounded">
2310-
<xs:element name="tool" minOccurs="0" type="bom:toolType"/>
2311-
</xs:sequence>
2327+
<xs:choice>
2328+
<xs:sequence minOccurs="0" maxOccurs="unbounded">
2329+
<xs:element name="tool" minOccurs="0" type="bom:toolType">
2330+
<xs:annotation>
2331+
<xs:documentation>DEPRECATED. Use tools\components or tools\services instead.</xs:documentation>
2332+
</xs:annotation>
2333+
</xs:element>
2334+
</xs:sequence>
2335+
<xs:sequence minOccurs="0" maxOccurs="1">
2336+
<xs:element name="components" type="bom:componentsType" minOccurs="0" maxOccurs="1">
2337+
<xs:annotation>
2338+
<xs:documentation>A list of software and hardware components used as tools.</xs:documentation>
2339+
</xs:annotation>
2340+
</xs:element>
2341+
<xs:element name="services" type="bom:servicesType" minOccurs="0" maxOccurs="1">
2342+
<xs:annotation>
2343+
<xs:documentation>A list of services used as tools.</xs:documentation>
2344+
</xs:annotation>
2345+
</xs:element>
2346+
</xs:sequence>
2347+
</xs:choice>
23122348
</xs:complexType>
23132349
</xs:element>
23142350
<xs:element name="analysis" minOccurs="0" maxOccurs="1">

‎tools/src/test/resources/1.5/valid-metadata-tool-1.5.json‎

Lines changed: 37 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,44 @@
44
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
55
"version": 1,
66
"metadata": {
7-
"tools": [
8-
{
9-
"vendor": "Awesome Vendor",
10-
"name": "Awesome Tool",
11-
"version": "9.1.2",
12-
"hashes": [
13-
{
14-
"alg": "SHA-1",
15-
"content": "25ed8e31b995bb927966616df2a42b979a2717f0"
7+
"tools": {
8+
"components": [
9+
{
10+
"type": "application",
11+
"group": "Awesome Vendor",
12+
"name": "Awesome Tool",
13+
"version": "9.1.2",
14+
"hashes": [
15+
{
16+
"alg": "SHA-1",
17+
"content": "25ed8e31b995bb927966616df2a42b979a2717f0"
18+
},
19+
{
20+
"alg": "SHA-256",
21+
"content": "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
22+
}
23+
]
24+
}
25+
],
26+
"services": [
27+
{
28+
"provider": {
29+
"name": "Acme Org",
30+
"url": [
31+
"https://example.com"
32+
]
1633
},
17-
{
18-
"alg": "SHA-256",
19-
"content": "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
20-
}
21-
]
22-
}
23-
]
34+
"group": "com.example",
35+
"name": "Acme Signing Server",
36+
"description": "Signs artifacts",
37+
"endpoints": [
38+
"https://example.com/sign",
39+
"https://example.com/verify",
40+
"https://example.com/tsa"
41+
]
42+
}
43+
]
44+
}
2445
},
2546
"components": []
2647
}

‎tools/src/test/resources/1.5/valid-metadata-tool-1.5.textproto‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,35 @@ version: 1
33
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
44
metadata {
55
tools {
6-
vendor: "Awesome Vendor"
7-
name: "Awesome Tool"
8-
version: "9.1.2"
9-
hashes {
10-
alg: HASH_ALG_SHA_1
11-
value: "25ed8e31b995bb927966616df2a42b979a2717f0"
6+
components {
7+
type: CLASSIFICATION_APPLICATION
8+
group: "Awesome Vendor"
9+
name: "Awesome Tool"
10+
version: "9.1.2"
11+
hashes {
12+
alg: HASH_ALG_SHA_1
13+
value: "25ed8e31b995bb927966616df2a42b979a2717f0"
14+
}
15+
hashes {
16+
alg: HASH_ALG_SHA_256
17+
value: "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
18+
}
1219
}
13-
hashes {
14-
alg: HASH_ALG_SHA_256
15-
value: "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
20+
services {
21+
provider: {
22+
name: "Acme Org",
23+
url: [
24+
"https://example.com"
25+
]
26+
},
27+
group: "com.example",
28+
name: "Acme Signing Server",
29+
description: "Signs artifacts",
30+
endpoints: [
31+
"https://example.com/sign",
32+
"https://example.com/verify",
33+
"https://example.com/tsa"
34+
]
1635
}
1736
}
1837
}

‎tools/src/test/resources/1.5/valid-metadata-tool-1.5.xml‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,33 @@
22
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.5">
33
<metadata>
44
<tools>
5-
<tool>
6-
<vendor>Awesome Vendor</vendor>
7-
<name>Awesome Tool</name>
8-
<version>9.1.2</version>
9-
<hashes>
10-
<hash alg="SHA-1">25ed8e31b995bb927966616df2a42b979a2717f0</hash>
11-
<hash alg="SHA-256">a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df</hash>
12-
</hashes>
13-
</tool>
5+
<components>
6+
<component type="application">
7+
<group>Awesome Vendor</group>
8+
<name>Awesome Tool</name>
9+
<version>9.1.2</version>
10+
<hashes>
11+
<hash alg="SHA-1">25ed8e31b995bb927966616df2a42b979a2717f0</hash>
12+
<hash alg="SHA-256">a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df</hash>
13+
</hashes>
14+
</component>
15+
</components>
16+
<services>
17+
<service>
18+
<provider>
19+
<name>Acme Org</name>
20+
<url>https://example.com</url>
21+
</provider>
22+
<group>com.example</group>
23+
<name>Acme Signing Server</name>
24+
<description>Signs artifacts</description>
25+
<endpoints>
26+
<endpoint>https://example.com/sign</endpoint>
27+
<endpoint>https://example.com/verify</endpoint>
28+
<endpoint>https://example.com/tsa</endpoint>
29+
</endpoints>
30+
</service>
31+
</services>
1432
</tools>
1533
</metadata>
1634
<components />

‎tools/src/test/resources/1.5/valid-metadata-tool-deprecated-1.5.json‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.5",
4+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
5+
"version": 1,
6+
"metadata": {
7+
"tools": [
8+
{
9+
"vendor": "Awesome Vendor",
10+
"name": "Awesome Tool",
11+
"version": "9.1.2",
12+
"hashes": [
13+
{
14+
"alg": "SHA-1",
15+
"content": "25ed8e31b995bb927966616df2a42b979a2717f0"
16+
},
17+
{
18+
"alg": "SHA-256",
19+
"content": "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
20+
}
21+
]
22+
}
23+
]
24+
},
25+
"components": []
26+
}

0 commit comments

Comments
 (0)