Skip to content

Commit c5032b8

Browse files
stevespringettstevespringett
authored
[WIP] v1.6 (#323)
## Added * Core enhancement: Attestation ([#192](#192) via [#348](#348)) * Core enhancement: Cryptography Bill of Materials — CBOM ([#171](#171), [#291](#291) via [#347](#347)) * Feature to express the URL to source distribution ([#98](#98) via [#269](#269)) * Feature to express the URL to RFC 9116 compliant documents ([#380](#380) via [#381](#381)) * Feature to express tags/keywords for services and components (via [#383](#383)) * Feature to express details for component authors ([#335](#335) via [#379](#379)) * Feature to express details for component and BOM manufacturer ([#346](#346) via [#379](#379)) * Feature to express communicate concluded values from observed evidences ([#411](#411) via [#412](#412)) * Features to express license acknowledgement ([#407](#407) via [#408](#408)) * Feature to express environmental consideration information for model cards ([#396](#396) via [#395](#395)) * Feature to express the address of organizational entities (via [#395](#395)) * Feature to express additional component identifiers: Universal Bill Of Receipts Identifier and Software Heritage persistent IDs ([#413](#413) via [#414](#414)) ## Fixed * Allow multiple evidence identities by XML/JSON schema ([#272](#272) via [#359](#359)) This was already correct via ProtoBuff schema. * Prevent empty `license` entities by XML schema ([#288](#288) via [#292](#292)) This was already correct in JSON/ProtoBuff schema. * Prevent empty or malformed `property` entities by JSON schema ([#371](#371) via [#375](#375)) This was already correct in XML/ProtoBuff schema. * Allow multiple `licenses` in `Metadata` by ProtoBuff schema ([#264](#264) via [#401](#401)) This was already correct in XML/JSON schema. ## Changed * Allow arbitrary `$schema` values by JSON schema ([#402](#402) via [#403](#403)) * Increased max length of `versionRange` (via [`3e01ce6`](3e01ce6)) * Harmonized length of `version` (via [#417](#417)) ## Deprecated * Data model "Component"'s field `author` was deprecated. (via [#379](#379)) Use field `authors` or field `manufacturer` instead. * Data model "Metadata"'s field `manufacture` was deprecated. ([#346](#346) via [#379](#379)) Use "Metadata"'s field `component`'s field `manufacturer` instead. - for XML: `/bom/metadata/component/manufacturer` - for JSON: `$.metadata.component.manufacturer` - for ProtoBuf: `Bom:metadata.component.manufacturer` ## Documentation * Centralize version and version-range (via [#322](#322)) * Streamlined SPDX expression related descriptions (via [#327](#327)) * Enhanced descriptions of `bom-ref`/`refType` ([#336](#336) via [#344](#344)) * Enhanced readability of enum documentation in JSON schema ([#361](#361) via [#362](#362)) * Fixed typo "compliment" -> "complement" (via [#369](#369)) * Added documentation for enum "ComponentScope"'s values in JSON schema ([#293](#293) via [`d92e58e`](d92e58e)) Texts were a taken from the existing ones in XML/ProtoBuff schema. * Added documentation for enum "TaskType"'s values ([#245](#245) via [#377](#377)) * Improve documentation for data model "Metadata"'s field `licenses` ([#273](#273) via [#378](#378)) * Added documentation for enum "MachineLearningApproachType"'s values ([#351](#351) via [#416](#416)) * Rephrased some texts here and there. ## Test data * Added test data for newly added use cases * Added quality assurance for our ProtoBuf schemas ([#384](#384) via [#385](#385))
2 parents 8af880d + 4017ce4 commit c5032b8

301 files changed

Lines changed: 27569 additions & 97 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/dependabot.yml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
2-
1+
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
32
version: 2
43
updates:
54
- package-ecosystem: 'github-actions'
@@ -12,3 +11,13 @@ updates:
1211
prefix: 'chore' ## prefix maximum string length of 15
1312
include: 'scope'
1413
open-pull-requests-limit: 999
14+
- package-ecosystem: 'docker'
15+
directory: '/'
16+
schedule:
17+
interval: 'weekly'
18+
day: 'saturday'
19+
labels: [ 'dependencies' ]
20+
commit-message:
21+
prefix: 'chore' ## prefix maximum string length of 15
22+
include: 'scope'
23+
open-pull-requests-limit: 999

‎.github/workflows/test_proto.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions
2+
3+
name: CT ProtoBuf
4+
5+
on:
6+
push:
7+
branches: ['master', 'main']
8+
pull_request:
9+
workflow_dispatch:
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
defaults:
16+
run:
17+
working-directory: tools/src/test/proto
18+
19+
jobs:
20+
test:
21+
timeout-minutes: 30
22+
runs-on: ubuntu-latest
23+
steps:
24+
- name: Checkout
25+
# see https://github.com/actions/checkout
26+
uses: actions/checkout@v4
27+
- name: Run test
28+
run: ./test.sh

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
.idea/
2-
tools/target/
2+
.vscode/
3+
tools/target/

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,9 +68,9 @@ The officially supported media type for Protocol Buffer format is `application/x
6868
## Related Work
6969
[SPDX (Software Package Data Exchange)][spdx-url] is a specification that provides low-level details of components, including all files, hashes, authors, and copyrights. SPDX also defines over 300 open source license IDs. CycloneDX builds on top of the work SPDX has accomplished with license IDs, but varies greatly in its approach towards building a software bill of material specification.
7070

71-
[SWID (ISO/IEC 19770-2:2015)][swid-url] is used primarily to identify installed software and is the preferred format of the NVD. SWID tags are used in the National Vulnerability Database to describe vulnerable components. The CycloneDX specification compliments this work as CycloneDX documents can incorporate SWID tags and other high-level SWID metadata and optionally include entire SWID documents. Use of SWID tag ID's are useful in determining if a specific component has known vulnerabilities.
71+
[SWID (ISO/IEC 19770-2:2015)][swid-url] is used primarily to identify installed software and is the preferred format of the NVD. SWID tags are used in the National Vulnerability Database to describe vulnerable components. The CycloneDX specification complements this work as CycloneDX documents can incorporate SWID tags and other high-level SWID metadata and optionally include entire SWID documents. Use of SWID tag ID's are useful in determining if a specific component has known vulnerabilities.
7272

73-
[CPE (Common Platform Enumeration)][cpe-url] is a specification that describes the vendor, name, and version for an application, operating system, or hardware device. CPE identifiers are used in the National Vulnerability Database to describe vulnerable components. The CycloneDX specification compliments this work as CycloneDX documents can easily be used to construct exact CPE identifiers that are useful in determining if a specific component has known vulnerabilities.
73+
[CPE (Common Platform Enumeration)][cpe-url] is a specification that describes the vendor, name, and version for an application, operating system, or hardware device. CPE identifiers are used in the National Vulnerability Database to describe vulnerable components. The CycloneDX specification complements this work as CycloneDX documents can easily be used to construct exact CPE identifiers that are useful in determining if a specific component has known vulnerabilities.
7474

7575
## Copyright & License
7676

‎docgen/json/gen.sh‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
#!/bin/bash
22
rm -f -R docs
3-
mkdir -p docs/{1.2,1.3,1.4,1.5}
3+
mkdir -p docs/{1.2,1.3,1.4,1.5,1.6}
44

55
# Check to see if generate-schema-doc is executable and is in the path. If not, install JSON Schema for Humans.
66
if ! [ -x "$(command -v generate-schema-doc)" ]; then
7-
pip3 install json-schema-for-humans==0.44.3
7+
pip3 install json-schema-for-humans==0.47
88
fi
99

1010
generate () {
@@ -27,4 +27,5 @@ generate () {
2727
generate 1.2
2828
generate 1.3
2929
generate 1.4
30-
generate 1.5
30+
generate 1.5
31+
generate 1.6

‎docgen/json/templates/cyclonedx/base.html‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@
1818
<meta property="og:type" content="website" />
1919
<meta property="og:image" content="https://cyclonedx.org/theme/assets/images/CycloneDX-Twitter-Card.png" />
2020
<link rel="icon" href="https://cyclonedx.org/cyclonedx-icon.png" type="image/png"/>
21-
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.0/css/bootstrap.min.css" integrity="sha512-P5MgMn1jBN01asBgU0z60Qk4QxiXo86+wlFahKrsQf37c9cro517WzVSPPV1tDKzhku2iJ2FVgL67wG03SGnNA==" crossorigin="anonymous" referrerpolicy="no-referrer" />
21+
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.2/css/bootstrap.min.css" integrity="sha512-rt/SrQ4UNIaGfDyEXZtNcyWvQeOq0QLygHluFQcSjaGB04IxWhal71tKuzP6K8eYXYB6vJV4pHkXcmFGGQ1/0w==" crossorigin="anonymous" referrerpolicy="no-referrer" />
2222
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css" integrity="sha512-SfTiTlX6kk+qitfevl/7LibUOeJWlt9rbyDn92a1DqWOw9vWG2MFoays0sgObmWazO5BQPiFucnnEAjpAB+/Sw==" crossorigin="anonymous" referrerpolicy="no-referrer" />
2323
<link rel="stylesheet" type="text/css" href="schema_doc.css">
24-
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.slim.js" integrity="sha512-HNbo1d4BaJjXh+/e6q4enTyezg5wiXvY3p/9Vzb20NIvkJghZxhzaXeffbdJuuZSxFhJP87ORPadwmU9aN3wSA==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
25-
<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.0/js/bootstrap.min.js" integrity="sha512-XKa9Hemdy1Ui3KSGgJdgMyYlUg1gM+QhL6cnlyTe2qzMCYm4nAZ1PsVerQzTTXzonUR+dmswHqgJPuwCq1MaAg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
26-
<script src="https://cdnjs.cloudflare.com/ajax/libs/markdown-it/12.2.0/markdown-it.min.js" integrity="sha512-cTQeM/op796Fp1ZUxfech8gSMLT/HvrXMkRGdGZGQnbwuq/obG0UtcL04eByVa99qJik7WlnlQOr5/Fw5B36aw==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
24+
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.slim.js" integrity="sha512-docBEeq28CCaXCXN7cINkyQs0pRszdQsVBFWUd+pLNlEk3LDlSDDtN7i1H+nTB8tshJPQHS0yu0GW9YGFd/CRg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
25+
<script src="https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.2/js/bootstrap.min.js" integrity="sha512-7rusk8kGPFynZWu26OKbTeI+QPoYchtxsmPeBqkHIEXJxeun4yJ4ISYe7C6sz9wdxeE1Gk3VxsIWgCZTc+vX3g==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
26+
<script src="https://cdnjs.cloudflare.com/ajax/libs/markdown-it/13.0.2/markdown-it.min.js" integrity="sha512-ohlWmsCxOu0bph1om5eDL0jm/83eH09fvqLDhiEdiqfDeJbEvz4FSbeY0gLJSVJwQAp0laRhTXbUQG+ZUuifUQ==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
2727
<script src="schema_doc.min.js"></script>
2828
</head>
2929
<body class="blue" data-spy="scroll" data-target=".js-scrollspy" onload="anchorOnLoad();" id="root">
@@ -40,11 +40,13 @@
4040
v${version} (JSON)
4141
</a>
4242
<ul class="dropdown-menu" aria-labelledby="navbarScrollingDropdown">
43+
<li><a class="dropdown-item" href="https://cyclonedx.org/docs/1.6/json/">v1.6 (JSON)</a></li>
4344
<li><a class="dropdown-item" href="https://cyclonedx.org/docs/1.5/json/">v1.5 (JSON)</a></li>
4445
<li><a class="dropdown-item" href="https://cyclonedx.org/docs/1.4/json/">v1.4 (JSON)</a></li>
4546
<li><a class="dropdown-item" href="https://cyclonedx.org/docs/1.3/json/">v1.3 (JSON)</a></li>
4647
<li><a class="dropdown-item" href="https://cyclonedx.org/docs/1.2/json/">v1.2 (JSON)</a></li>
4748
<li><hr class="dropdown-divider"/></li>
49+
<li><a class="dropdown-item" href="https://cyclonedx.org/docs/1.6/xml/">v1.6 (XML)</a></li>
4850
<li><a class="dropdown-item" href="https://cyclonedx.org/docs/1.5/xml/">v1.5 (XML)</a></li>
4951
<li><a class="dropdown-item" href="https://cyclonedx.org/docs/1.4/xml/">v1.4 (XML)</a></li>
5052
<li><a class="dropdown-item" href="https://cyclonedx.org/docs/1.3/xml/">v1.3 (XML)</a></li>

‎docgen/json/templates/cyclonedx/content.html‎

Lines changed: 70 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,17 @@
1717

1818
{# Display type #}
1919
{%- if not schema is combining -%}
20-
<span class="badge value-type">Type: {{ type_name }}</span>
20+
<span class="badge badge-dark value-type">Type: {{ type_name }}</span>
21+
{%- endif -%}
22+
23+
{%- if schema.format -%}
24+
<span class="badge badge-info value-type">Format: {{ schema.format }}</span>
2125
{%- endif -%}
2226

2327
{# Display default #}
2428
{%- set default_value = schema.default_value -%}
2529
{%- if default_value -%}
26-
{{ " " }}<span class="badge default-value">Default: {{ default_value }}</span>
30+
{{ " " }}<span class="badge badge-success default-value">Default: {{ default_value }}</span>
2731
{%- endif -%}
2832
<br/>
2933

@@ -37,80 +41,78 @@
3741
{%- elif schema.refers_to -%}
3842
{{ content(schema.refers_to_merged, True) }}
3943
{%- else -%}
40-
{# Handle having oneOf or allOf with only one condition #}
41-
{%- if schema.kw_all_of and (schema.kw_all_of.array_items | length) == 1 -%}
42-
{{ content(schema.kw_all_of.array_items[0]) }}
43-
{%- elif schema.kw_any_of and (schema.kw_any_of.array_items | length) == 1 -%}
44-
{{ content(schema.kw_any_of.array_items[0]) }}
45-
{%- else -%}
46-
{%- if schema.explicit_no_additional_properties -%}
47-
{{ " " }}<span class="badge no-additional">No Additional Properties</span>
48-
{%- endif -%}
49-
50-
{# Combining: allOf, anyOf, oneOf, not #}
51-
{%- if schema.kw_all_of -%}
52-
<div class="all-of-value" id="{{ schema.kw_all_of.html_id }}">{{ tabbed_section("allOf", schema.kw_all_of) }}</div>
53-
{%- endif -%}
54-
{%- if schema.kw_any_of -%}
55-
<div class="any-of-value" id="{{ schema.kw_any_of.html_id }}">{{ tabbed_section("anyOf", schema.kw_any_of) }}</div>
56-
{%- endif -%}
57-
{%- if schema.kw_one_of -%}
58-
<div class="one-of-value" id="{{ schema.kw_one_of.html_id }}">{{ tabbed_section("oneOf", schema.kw_one_of) }}</div>
59-
{%- endif -%}
60-
{%- if schema.kw_not -%}
61-
{% include "section_not.html" %}
62-
{%- endif -%}
63-
64-
{# Enum and const #}
65-
{%- if schema.kw_enum -%}
66-
<div class="enum-value" id="{{ schema.kw_enum.html_id }}">
67-
<h4>Must be one of:</h4>
68-
<ul class="list-group">
69-
{%- for enum_choice in schema.kw_enum.array_items -%}
70-
<li class="list-group-item enum-item">{{ enum_choice.literal | python_to_json }}</li>
71-
{%- endfor -%}
72-
</ul>
73-
</div>
74-
{%- endif -%}
75-
{%- if schema.kw_const -%}
76-
<span class="const-value" id="{{ schema.kw_const.html_id }}">Specific value: <code>{{ schema.kw_const.raw | python_to_json }}</code></span>
77-
{%- endif -%}
44+
{%- if schema.explicit_no_additional_properties -%}
45+
{{ " " }}<span class="badge badge-info no-additional">No Additional Properties</span>
46+
{%- endif -%}
7847

79-
{# Pattern (Regular Expression) #}
80-
{%- if schema.kw_pattern -%}
81-
<span class="pattern-value" id="{{ schema.kw_pattern.html_id }}">Must match regular expression: <code>{{ schema.kw_pattern.literal | escape }}</code></span>
82-
{%- endif -%}
48+
{# Combining: allOf, anyOf, oneOf, not #}
49+
{%- if schema.kw_all_of -%}
50+
<div class="all-of-value" id="{{ schema.kw_all_of.html_id }}">{{ tabbed_section("allOf", schema.kw_all_of) }}</div>
51+
{%- endif -%}
52+
{%- if schema.kw_any_of -%}
53+
<div class="any-of-value" id="{{ schema.kw_any_of.html_id }}">{{ tabbed_section("anyOf", schema.kw_any_of) }}</div>
54+
{%- endif -%}
55+
{%- if schema.kw_one_of -%}
56+
<div class="one-of-value" id="{{ schema.kw_one_of.html_id }}">{{ tabbed_section("oneOf", schema.kw_one_of) }}</div>
57+
{%- endif -%}
58+
{%- if schema.kw_not -%}
59+
{% include "section_not.html" %}
60+
{%- endif -%}
8361

84-
{# Conditional subschema, or if-then-else section #}
85-
{%- if schema.has_conditional -%}
86-
{% include "section_conditional_subschema.html" %}
87-
{%- endif -%}
62+
{# Enum and const #}
63+
{%- if schema.kw_enum -%}
64+
<div class="enum-value" id="{{ schema.kw_enum.html_id }}">
65+
<h4>Must be one of:</h4>
66+
<ul class="list-group">
67+
{%- for enum_choice in schema.kw_enum.array_items -%}
68+
<li class="list-group-item enum-item">
69+
{%- if schema.kw_meta_enum -%}<strong>{%- endif -%}
70+
{{ enum_choice.literal | python_to_json }}
71+
{%- if schema.kw_meta_enum -%}</strong>
72+
: {{ (schema.enum_description(enum_choice.literal) | get_description_literal) }}
73+
{%- endif -%}
74+
</li>
75+
{%- endfor -%}
76+
</ul>
77+
</div>
78+
{%- endif -%}
79+
{%- if schema.kw_const -%}
80+
<span class="const-value" id="{{ schema.kw_const.html_id }}">Specific value: <code>{{ schema.kw_const.raw | python_to_json }}</code></span>
81+
{%- endif -%}
8882

89-
{# Required properties that are not defined under "properties". They will only be listed #}
90-
{% include "section_undocumented_required_properties.html" %}
83+
{# Pattern (Regular Expression) #}
84+
{%- if schema.kw_pattern -%}
85+
<span class="pattern-value" id="{{ schema.kw_pattern.html_id }}">Must match regular expression: <code>{{ schema.kw_pattern.literal | escape }}</code></span>
86+
{%- endif -%}
9187

92-
{# Show the requested type(s) #}
93-
{% include "badge_type.html" %}
88+
{# Conditional subschema, or if-then-else section #}
89+
{%- if schema.has_conditional -%}
90+
{% include "section_conditional_subschema.html" %}
91+
{%- endif -%}
9492

95-
{# Show array restrictions #}
96-
{%- if type_name.startswith("array") -%}
97-
{% include "section_array.html" %}
98-
{%- endif -%}
93+
{# Required properties that are not defined under "properties". They will only be listed #}
94+
{% include "section_undocumented_required_properties.html" %}
9995

100-
{# Display examples #}
101-
{%- set examples = schema.examples -%}
102-
{%- if examples -%}
103-
{% include "section_examples.html" %}
104-
{%- endif -%}
96+
{# Show the requested type(s) #}
97+
{% include "badge_type.html" %}
10598

106-
{# Properties, pattern properties, additional properties #}
107-
{%- for sub_property in schema.iterate_properties -%}
108-
{# Custom modification to remove $ properties from documentation #}
109-
{%- if not sub_property.property_display_name.startswith("$") -%}
110-
{% include "section_properties.html" %}
111-
{%- endif -%}
112-
{%- endfor -%}
99+
{# Show array restrictions #}
100+
{%- if type_name.startswith("array") -%}
101+
{% include "section_array.html" %}
102+
{%- endif -%}
113103

104+
{# Display examples #}
105+
{%- set examples = schema.examples -%}
106+
{%- if examples -%}
107+
{% include "section_examples.html" %}
114108
{%- endif -%}
109+
110+
{# Properties, pattern properties, additional properties #}
111+
{%- for sub_property in schema.iterate_properties -%}
112+
{# Custom modification to remove $ properties from documentation #}
113+
{%- if not sub_property.property_display_name.startswith("$") -%}
114+
{% include "section_properties.html" %}
115+
{%- endif -%}
116+
{%- endfor -%}
115117
{%- endif -%}
116118
{%- endmacro -%}

‎docgen/json/templates/cyclonedx/schema_doc.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ function setAnchor(anchorLinkDestination) {
1919

2020
function anchorOnLoad() {
2121
// Added to onload on body, checks if there is an anchor link and if so, expand
22-
let linkTarget = window.location.hash.split("?")[0].split("&")[0];
22+
let linkTarget = decodeURIComponent(window.location.hash.split("?")[0].split("&")[0]);
2323
if (linkTarget[0] === "#") {
2424
linkTarget = linkTarget.substr(1);
2525
}
@@ -37,7 +37,7 @@ function anchorLink(linkTarget) {
3737
if($( this ).hasClass("collapse")) {
3838
$( this ).collapse("show");
3939
} else if ($( this ).hasClass("tab-pane")) {
40-
// We have the pane and not the the tab itself, find the tab
40+
// We have the pane and not the tab itself, find the tab
4141
const tabToShow = $( "a[href='#" + $( this ).attr("id") + "']" );
4242
if (tabToShow) {
4343
tabToShow.tab("show");

‎docgen/json/templates/cyclonedx/schema_doc.min.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)