Skip to content

Commit bf0add8

Browse files
jkowalleckjkowalleck
committed
docs: announce support for CDX v1.5
mini Signed-off-by: Jan Kowalleck <[email protected]>
1 parent 2b8a341 commit bf0add8

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+9567
-103
lines changed

‎HISTORY.md

+3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ All notable changes to this project will be documented in this file.
44

55
## unreleased
66

7+
* Added
8+
* Support [_CycloneDX_ Specification-1.5](https://github.com/CycloneDX/specification/releases/tag/1.5)
9+
710
## 2.1.0 -- 2023-06-10
811

912
* Changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ written in _TypeScript_ and compiled for the target.
7979
* Builders for the following use cases:
8080
* Specific to _Node.js_: create deep data models `Tool` or `Component` from PackageJson-like data structures
8181
* Implementation of the [_CycloneDX_ Specification][CycloneDX-spec] for the following versions:
82+
* `1.5`
8283
* `1.4`
8384
* `1.3`
8485
* `1.2`

‎res/schema/README.md

+4-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# Resources: Schema files
22

33
some schema for offline use as download via [script](../../tools/schema-downloader/download.js).
4-
original sources: <https://github.com/CycloneDX/specification/tree/master/schema>
4+
original sources: <https://github.com/CycloneDX/specification/blob/v1.5-dev>
55

66
Currently using version
7-
[ef71717ae0ecb564c0b4c9536d6e9e57e35f2e69](https://github.com/CycloneDX/specification/tree/ef71717ae0ecb564c0b4c9536d6e9e57e35f2e69/schema)
7+
[4159deec24ce6380b580a1a79a4bc2a107ec32aa](https://github.com/CycloneDX/specification/commit/4159deec24ce6380b580a1a79a4bc2a107ec32aa)
88

99
| file | note |
1010
|------|------|
@@ -13,9 +13,11 @@ Currently using version
1313
| [`bom-1.2.SNAPSHOT.xsd`](bom-1.2.SNAPSHOT.xsd) | applied changes: 1 |
1414
| [`bom-1.3.SNAPSHOT.xsd`](bom-1.3.SNAPSHOT.xsd) | applied changes: 1 |
1515
| [`bom-1.4.SNAPSHOT.xsd`](bom-1.4.SNAPSHOT.xsd) | applied changes: 1 |
16+
| [`bom-1.5.SNAPSHOT.xsd`](bom-1.5.SNAPSHOT.xsd) | applied changes: 1 |
1617
| [`bom-1.2.SNAPSHOT.schema.json`](bom-1.2.SNAPSHOT.schema.json) | applied changes: 2,3,4,5 |
1718
| [`bom-1.3.SNAPSHOT.schema.json`](bom-1.3.SNAPSHOT.schema.json) | applied changes: 2,3,4,5 |
1819
| [`bom-1.4.SNAPSHOT.schema.json`](bom-1.4.SNAPSHOT.schema.json) | applied changes: 2,3,4,5 |
20+
| [`bom-1.5.SNAPSHOT.schema.json`](bom-1.5.SNAPSHOT.schema.json) | applied changes: 2,3,4,5 |
1921
| [`bom-1.2-strict.SNAPSHOT.schema.json`](bom-1.2-strict.SNAPSHOT.schema.json) | applied changes: 2,3,4,5 |
2022
| [`bom-1.3-strict.SNAPSHOT.schema.json`](bom-1.3-strict.SNAPSHOT.schema.json) | applied changes: 2,3,4,5 |
2123
| [`spdx.SNAPSHOT.xsd`](spdx.SNAPSHOT.xsd) | |

‎res/schema/bom-1.1.SNAPSHOT.xsd

+8-1
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,13 @@ limitations under the License.
3838
</xs:documentation>
3939
</xs:annotation>
4040

41+
<xs:simpleType name="refType">
42+
<xs:annotation>
43+
<xs:documentation>Identifier-DataType for interlinked elements.</xs:documentation>
44+
</xs:annotation>
45+
<xs:restriction base="xs:string" />
46+
</xs:simpleType>
47+
4148
<xs:complexType name="componentsType">
4249
<xs:sequence minOccurs="0" maxOccurs="unbounded">
4350
<xs:element name="component" type="bom:component"/>
@@ -201,7 +208,7 @@ limitations under the License.
201208
</xs:documentation>
202209
</xs:annotation>
203210
</xs:attribute>
204-
<xs:attribute name="bom-ref" type="xs:string">
211+
<xs:attribute name="bom-ref" type="bom:refType">
205212
<xs:annotation>
206213
<xs:documentation>
207214
An optional identifier which can be used to reference the component elsewhere in the BOM.

‎res/schema/bom-1.2-strict.SNAPSHOT.schema.json

+8-5
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@
8686
}
8787
},
8888
"definitions": {
89+
"refType": {
90+
"$comment": "Identifier-DataType for interlinked elements.",
91+
"type": "string"
92+
},
8993
"metadata": {
9094
"type": "object",
9195
"title": "BOM Metadata Object",
@@ -260,7 +264,7 @@
260264
"pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+$"
261265
},
262266
"bom-ref": {
263-
"type": "string",
267+
"$ref": "#/definitions/refType",
264268
"title": "BOM Reference",
265269
"description": "An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref should be unique.",
266270
"default": "",
@@ -858,16 +862,15 @@
858862
"additionalProperties": false,
859863
"properties": {
860864
"ref": {
861-
"type": "string",
862-
"format": "string",
865+
"$ref": "#/definitions/refType",
863866
"title": "Reference",
864867
"description": "References a component by the components bom-ref attribute"
865868
},
866869
"dependsOn": {
867870
"type": "array",
868871
"uniqueItems": true,
869872
"items": {
870-
"type": "string"
873+
"$ref": "#/definitions/refType"
871874
},
872875
"title": "Depends On",
873876
"description": "The bom-ref identifiers of the components that are dependencies of this dependency object."
@@ -883,7 +886,7 @@
883886
"additionalProperties": false,
884887
"properties": {
885888
"bom-ref": {
886-
"type": "string",
889+
"$ref": "#/definitions/refType",
887890
"title": "BOM Reference",
888891
"description": "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref should be unique.",
889892
"default": "",

‎res/schema/bom-1.2.SNAPSHOT.schema.json

+8-4
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,10 @@
7979
}
8080
},
8181
"definitions": {
82+
"refType": {
83+
"$comment": "Identifier-DataType for interlinked elements.",
84+
"type": "string"
85+
},
8286
"metadata": {
8387
"type": "object",
8488
"title": "BOM Metadata Object",
@@ -248,7 +252,7 @@
248252
"pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+$"
249253
},
250254
"bom-ref": {
251-
"type": "string",
255+
"$ref": "#/definitions/refType",
252256
"title": "BOM Reference",
253257
"description": "An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref should be unique.",
254258
"default": "",
@@ -832,7 +836,7 @@
832836
],
833837
"properties": {
834838
"ref": {
835-
"type": "string",
839+
"$ref": "#/definitions/refType",
836840
"format": "string",
837841
"title": "Reference",
838842
"description": "References a component by the components bom-ref attribute"
@@ -841,7 +845,7 @@
841845
"type": "array",
842846
"uniqueItems": true,
843847
"items": {
844-
"type": "string"
848+
"$ref": "#/definitions/refType"
845849
},
846850
"title": "Depends On",
847851
"description": "The bom-ref identifiers of the components that are dependencies of this dependency object."
@@ -856,7 +860,7 @@
856860
],
857861
"properties": {
858862
"bom-ref": {
859-
"type": "string",
863+
"$ref": "#/definitions/refType",
860864
"title": "BOM Reference",
861865
"description": "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref should be unique.",
862866
"default": "",

‎res/schema/bom-1.2.SNAPSHOT.xsd

+10-3
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,13 @@ limitations under the License.
3838
</xs:documentation>
3939
</xs:annotation>
4040

41+
<xs:simpleType name="refType">
42+
<xs:annotation>
43+
<xs:documentation>Identifier-DataType for interlinked elements.</xs:documentation>
44+
</xs:annotation>
45+
<xs:restriction base="xs:string" />
46+
</xs:simpleType>
47+
4148
<xs:complexType name="metadata">
4249
<xs:sequence minOccurs="0" maxOccurs="1">
4350
<xs:element name="timestamp" type="xs:dateTime" minOccurs="0">
@@ -395,7 +402,7 @@ limitations under the License.
395402
</xs:documentation>
396403
</xs:annotation>
397404
</xs:attribute>
398-
<xs:attribute name="bom-ref" type="xs:string">
405+
<xs:attribute name="bom-ref" type="bom:refType">
399406
<xs:annotation>
400407
<xs:documentation>
401408
An optional identifier which can be used to reference the component elsewhere in the BOM.
@@ -1144,7 +1151,7 @@ limitations under the License.
11441151
<xs:sequence minOccurs="0" maxOccurs="unbounded">
11451152
<xs:element name="dependency" type="bom:dependencyType"/>
11461153
</xs:sequence>
1147-
<xs:attribute name="ref" type="xs:string" use="required">
1154+
<xs:attribute name="ref" type="bom:refType" use="required">
11481155
<xs:annotation>
11491156
<xs:documentation>References a component or service by the its bom-ref attribute</xs:documentation>
11501157
</xs:annotation>
@@ -1302,7 +1309,7 @@ limitations under the License.
13021309
</xs:annotation>
13031310
</xs:any>
13041311
</xs:sequence>
1305-
<xs:attribute name="bom-ref" type="xs:string">
1312+
<xs:attribute name="bom-ref" type="bom:refType">
13061313
<xs:annotation>
13071314
<xs:documentation>
13081315
An optional identifier which can be used to reference the service elsewhere in the BOM.

‎res/schema/bom-1.3-strict.SNAPSHOT.schema.json

+8-4
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,10 @@
9393
}
9494
},
9595
"definitions": {
96+
"refType": {
97+
"$comment": "Identifier-DataType for interlinked elements.",
98+
"type": "string"
99+
},
96100
"metadata": {
97101
"type": "object",
98102
"title": "BOM Metadata Object",
@@ -266,7 +270,7 @@
266270
"pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+$"
267271
},
268272
"bom-ref": {
269-
"type": "string",
273+
"$ref": "#/definitions/refType",
270274
"title": "BOM Reference",
271275
"description": "An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref should be unique."
272276
},
@@ -851,15 +855,15 @@
851855
"additionalProperties": false,
852856
"properties": {
853857
"ref": {
854-
"type": "string",
858+
"$ref": "#/definitions/refType",
855859
"title": "Reference",
856860
"description": "References a component by the components bom-ref attribute"
857861
},
858862
"dependsOn": {
859863
"type": "array",
860864
"uniqueItems": true,
861865
"items": {
862-
"type": "string"
866+
"$ref": "#/definitions/refType"
863867
},
864868
"title": "Depends On",
865869
"description": "The bom-ref identifiers of the components that are dependencies of this dependency object."
@@ -875,7 +879,7 @@
875879
"additionalProperties": false,
876880
"properties": {
877881
"bom-ref": {
878-
"type": "string",
882+
"$ref": "#/definitions/refType",
879883
"title": "BOM Reference",
880884
"description": "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref should be unique."
881885
},

‎res/schema/bom-1.3.SNAPSHOT.schema.json

+8-4
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@
8686
}
8787
},
8888
"definitions": {
89+
"refType": {
90+
"$comment": "Identifier-DataType for interlinked elements.",
91+
"type": "string"
92+
},
8993
"metadata": {
9094
"type": "object",
9195
"title": "BOM Metadata Object",
@@ -254,7 +258,7 @@
254258
"pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+$"
255259
},
256260
"bom-ref": {
257-
"type": "string",
261+
"$ref": "#/definitions/refType",
258262
"title": "BOM Reference",
259263
"description": "An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref should be unique."
260264
},
@@ -825,15 +829,15 @@
825829
],
826830
"properties": {
827831
"ref": {
828-
"type": "string",
832+
"$ref": "#/definitions/refType",
829833
"title": "Reference",
830834
"description": "References a component by the components bom-ref attribute"
831835
},
832836
"dependsOn": {
833837
"type": "array",
834838
"uniqueItems": true,
835839
"items": {
836-
"type": "string"
840+
"$ref": "#/definitions/refType"
837841
},
838842
"title": "Depends On",
839843
"description": "The bom-ref identifiers of the components that are dependencies of this dependency object."
@@ -848,7 +852,7 @@
848852
],
849853
"properties": {
850854
"bom-ref": {
851-
"type": "string",
855+
"$ref": "#/definitions/refType",
852856
"title": "BOM Reference",
853857
"description": "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref should be unique."
854858
},

‎res/schema/bom-1.3.SNAPSHOT.xsd

+14-5
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,13 @@ limitations under the License.
3535
</xs:documentation>
3636
</xs:annotation>
3737

38+
<xs:simpleType name="refType">
39+
<xs:annotation>
40+
<xs:documentation>Identifier-DataType for interlinked elements.</xs:documentation>
41+
</xs:annotation>
42+
<xs:restriction base="xs:string" />
43+
</xs:simpleType>
44+
3845
<xs:complexType name="metadata">
3946
<xs:sequence minOccurs="0" maxOccurs="1">
4047
<xs:element name="timestamp" type="xs:dateTime" minOccurs="0">
@@ -400,7 +407,7 @@ limitations under the License.
400407
</xs:documentation>
401408
</xs:annotation>
402409
</xs:attribute>
403-
<xs:attribute name="bom-ref" type="xs:string">
410+
<xs:attribute name="bom-ref" type="bom:refType">
404411
<xs:annotation>
405412
<xs:documentation>
406413
An optional identifier which can be used to reference the component elsewhere in the BOM.
@@ -555,7 +562,9 @@ limitations under the License.
555562
<xs:documentation>A hardware device such as a processor, or chip-set. A hardware device
556563
containing firmware should include a component for the physical hardware itself, and another
557564
component of type 'firmware' or 'operating-system' (whichever is relevant), describing
558-
information about the software running on the device.</xs:documentation>
565+
information about the software running on the device.
566+
See also the list of known device properties: https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md
567+
</xs:documentation>
559568
</xs:annotation>
560569
</xs:enumeration>
561570
<xs:enumeration value="firmware">
@@ -1156,7 +1165,7 @@ limitations under the License.
11561165
<xs:sequence minOccurs="0" maxOccurs="unbounded">
11571166
<xs:element name="dependency" type="bom:dependencyType"/>
11581167
</xs:sequence>
1159-
<xs:attribute name="ref" type="xs:string" use="required">
1168+
<xs:attribute name="ref" type="bom:refType" use="required">
11601169
<xs:annotation>
11611170
<xs:documentation>References a component or service by the its bom-ref attribute</xs:documentation>
11621171
</xs:annotation>
@@ -1309,7 +1318,7 @@ limitations under the License.
13091318
</xs:annotation>
13101319
</xs:any>
13111320
</xs:sequence>
1312-
<xs:attribute name="bom-ref" type="xs:string">
1321+
<xs:attribute name="bom-ref" type="bom:refType">
13131322
<xs:annotation>
13141323
<xs:documentation>
13151324
An optional identifier which can be used to reference the service elsewhere in the BOM.
@@ -1502,7 +1511,7 @@ limitations under the License.
15021511
</xs:simpleType>
15031512

15041513
<xs:complexType name="bomReferenceType">
1505-
<xs:attribute name="ref" type="xs:string" use="required">
1514+
<xs:attribute name="ref" type="bom:refType" use="required">
15061515
<xs:annotation>
15071516
<xs:documentation>References a component or service by the its bom-ref attribute</xs:documentation>
15081517
</xs:annotation>

‎res/schema/bom-1.4.SNAPSHOT.schema.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@
281281
"file"
282282
],
283283
"title": "Component Type",
284-
"description": "Specifies the type of component. For software components, classify as application if no more specific appropriate classification is available or cannot be determined for the component. Types include:\n\n* __application__ = A software application. Refer to [https://en.wikipedia.org/wiki/Application_software](https://en.wikipedia.org/wiki/Application_software) for information about applications.\n* __framework__ = A software framework. Refer to [https://en.wikipedia.org/wiki/Software_framework](https://en.wikipedia.org/wiki/Software_framework) for information on how frameworks vary slightly from libraries.\n* __library__ = A software library. Refer to [https://en.wikipedia.org/wiki/Library_(computing)](https://en.wikipedia.org/wiki/Library_(computing))\n for information about libraries. All third-party and open source reusable components will likely be a library. If the library also has key features of a framework, then it should be classified as a framework. If not, or is unknown, then specifying library is RECOMMENDED.\n* __container__ = A packaging and/or runtime format, not specific to any particular technology, which isolates software inside the container from software outside of a container through virtualization technology. Refer to [https://en.wikipedia.org/wiki/OS-level_virtualization](https://en.wikipedia.org/wiki/OS-level_virtualization)\n* __operating-system__ = A software operating system without regard to deployment model (i.e. installed on physical hardware, virtual machine, image, etc) Refer to [https://en.wikipedia.org/wiki/Operating_system](https://en.wikipedia.org/wiki/Operating_system)\n* __device__ = A hardware device such as a processor, or chip-set. A hardware device containing firmware SHOULD include a component for the physical hardware itself, and another component of type 'firmware' or 'operating-system' (whichever is relevant), describing information about the software running on the device.\n* __firmware__ = A special type of software that provides low-level control over a devices hardware. Refer to [https://en.wikipedia.org/wiki/Firmware](https://en.wikipedia.org/wiki/Firmware)\n* __file__ = A computer file. Refer to [https://en.wikipedia.org/wiki/Computer_file](https://en.wikipedia.org/wiki/Computer_file) for information about files.",
284+
"description": "Specifies the type of component. For software components, classify as application if no more specific appropriate classification is available or cannot be determined for the component. Types include:\n\n* __application__ = A software application. Refer to [https://en.wikipedia.org/wiki/Application_software](https://en.wikipedia.org/wiki/Application_software) for information about applications.\n* __framework__ = A software framework. Refer to [https://en.wikipedia.org/wiki/Software_framework](https://en.wikipedia.org/wiki/Software_framework) for information on how frameworks vary slightly from libraries.\n* __library__ = A software library. Refer to [https://en.wikipedia.org/wiki/Library_(computing)](https://en.wikipedia.org/wiki/Library_(computing))\n for information about libraries. All third-party and open source reusable components will likely be a library. If the library also has key features of a framework, then it should be classified as a framework. If not, or is unknown, then specifying library is RECOMMENDED.\n* __container__ = A packaging and/or runtime format, not specific to any particular technology, which isolates software inside the container from software outside of a container through virtualization technology. Refer to [https://en.wikipedia.org/wiki/OS-level_virtualization](https://en.wikipedia.org/wiki/OS-level_virtualization)\n* __operating-system__ = A software operating system without regard to deployment model (i.e. installed on physical hardware, virtual machine, image, etc) Refer to [https://en.wikipedia.org/wiki/Operating_system](https://en.wikipedia.org/wiki/Operating_system)\n* __device__ = A hardware device such as a processor, or chip-set. A hardware device containing firmware SHOULD include a component for the physical hardware itself, and another component of type 'firmware' or 'operating-system' (whichever is relevant), describing information about the software running on the device.\n See also the list of [known device properties](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md).\n* __firmware__ = A special type of software that provides low-level control over a devices hardware. Refer to [https://en.wikipedia.org/wiki/Firmware](https://en.wikipedia.org/wiki/Firmware)\n* __file__ = A computer file. Refer to [https://en.wikipedia.org/wiki/Computer_file](https://en.wikipedia.org/wiki/Computer_file) for information about files.",
285285
"examples": ["library"]
286286
},
287287
"mime-type": {
@@ -1640,7 +1640,7 @@
16401640
},
16411641
"range": {
16421642
"description": "A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst",
1643-
"$ref": "#/definitions/version"
1643+
"$ref": "#/definitions/range"
16441644
},
16451645
"status": {
16461646
"description": "The vulnerability status for the version or range of versions.",

0 commit comments

Comments
 (0)