Skip to content

Commit 7dae289

Browse files
stevespringettstevespringett
committed
Merge remote-tracking branch 'origin/v1.5-dev' into v1.5-dev
2 parents 4900d34 + f6ee477 commit 7dae289

12 files changed

+82
-37
lines changed

‎README.md‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,13 @@
66
[![Twitter](https://img.shields.io/twitter/url/http/shields.io.svg?style=social&label=Follow)](https://twitter.com/CycloneDX_Spec)
77

88
# CycloneDX Specification
9-
CycloneDX is a lightweight Software Bill of Materials (SBOM) specification designed for use in application security
10-
contexts and supply chain component analysis.
9+
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. The specification supports:
10+
* Software Bill of Materials (SBOM)
11+
* Software-as-a-Service Bill of Materials (SaaSBOM)
12+
* Hardware Bill of Materials (HBOM)
13+
* Operations Bill of Materials (OBOM)
14+
* Vulnerability Disclosure Reports (VDR)
15+
* Vulnerability Exploitability eXchange (VEX).
1116

1217

1318
## Introduction
@@ -17,8 +22,8 @@ organizations to identify risk, allows for greater transparency, and enables rap
1722

1823
CycloneDX was created for this purpose.
1924

20-
Strategic direction and maintenance of the specification is managed by the CycloneDX Core working group, with origins
21-
in the [OWASP](https://owasp.org) community.
25+
Strategic direction and maintenance of the specification is managed by the CycloneDX Core Working Group, is backed by the
26+
[OWASP Foundation](https://owasp.org), and is supported by the global information security community.
2227

2328

2429
## Use Cases
@@ -40,7 +45,7 @@ The following media types are officially registered with IANA:
4045
| application/vnd.cyclonedx+xml | XML | [IANA](https://www.iana.org/assignments/media-types/application/vnd.cyclonedx+xml) |
4146
| application/vnd.cyclonedx+json | JSON | [IANA](https://www.iana.org/assignments/media-types/application/vnd.cyclonedx+json) |
4247

43-
Specific versions of CycloneDX can be specified by using the version parameter. i.e. `application/vnd.cyclonedx+xml; version=1.3`.
48+
Specific versions of CycloneDX can be specified by using the version parameter. For example: `application/vnd.cyclonedx+xml; version=1.3`.
4449

4550
The officially supported media type for Protocol Buffer format is `application/x.vnd.cyclonedx+protobuf`.
4651

‎schema/bom-1.1.xsd‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,13 @@ limitations under the License.
3838
</xs:documentation>
3939
</xs:annotation>
4040

41+
<xs:simpleType name="refType">
42+
<xs:annotation>
43+
<xs:documentation>Identifier-DataType for interlinked elements.</xs:documentation>
44+
</xs:annotation>
45+
<xs:restriction base="xs:string" />
46+
</xs:simpleType>
47+
4148
<xs:complexType name="componentsType">
4249
<xs:sequence minOccurs="0" maxOccurs="unbounded">
4350
<xs:element name="component" type="bom:component"/>
@@ -201,7 +208,7 @@ limitations under the License.
201208
</xs:documentation>
202209
</xs:annotation>
203210
</xs:attribute>
204-
<xs:attribute name="bom-ref" type="xs:string">
211+
<xs:attribute name="bom-ref" type="bom:refType">
205212
<xs:annotation>
206213
<xs:documentation>
207214
An optional identifier which can be used to reference the component elsewhere in the BOM.

‎schema/bom-1.2-strict.schema.json‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,10 @@
8787
}
8888
},
8989
"definitions": {
90+
"refType": {
91+
"$comment": "Identifier-DataType for interlinked elements.",
92+
"type": "string"
93+
},
9094
"metadata": {
9195
"type": "object",
9296
"title": "BOM Metadata Object",
@@ -261,7 +265,7 @@
261265
"pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+$"
262266
},
263267
"bom-ref": {
264-
"type": "string",
268+
"$ref": "#/definitions/refType",
265269
"title": "BOM Reference",
266270
"description": "An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref should be unique.",
267271
"default": "",
@@ -859,16 +863,15 @@
859863
"additionalProperties": false,
860864
"properties": {
861865
"ref": {
862-
"type": "string",
863-
"format": "string",
866+
"$ref": "#/definitions/refType",
864867
"title": "Reference",
865868
"description": "References a component by the components bom-ref attribute"
866869
},
867870
"dependsOn": {
868871
"type": "array",
869872
"uniqueItems": true,
870873
"items": {
871-
"type": "string"
874+
"$ref": "#/definitions/refType"
872875
},
873876
"title": "Depends On",
874877
"description": "The bom-ref identifiers of the components that are dependencies of this dependency object."
@@ -884,7 +887,7 @@
884887
"additionalProperties": false,
885888
"properties": {
886889
"bom-ref": {
887-
"type": "string",
890+
"$ref": "#/definitions/refType",
888891
"title": "BOM Reference",
889892
"description": "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref should be unique.",
890893
"default": "",

‎schema/bom-1.2.schema.json‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,10 @@
8080
}
8181
},
8282
"definitions": {
83+
"refType": {
84+
"$comment": "Identifier-DataType for interlinked elements.",
85+
"type": "string"
86+
},
8387
"metadata": {
8488
"type": "object",
8589
"title": "BOM Metadata Object",
@@ -249,7 +253,7 @@
249253
"pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+$"
250254
},
251255
"bom-ref": {
252-
"type": "string",
256+
"$ref": "#/definitions/refType",
253257
"title": "BOM Reference",
254258
"description": "An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref should be unique.",
255259
"default": "",
@@ -833,7 +837,7 @@
833837
],
834838
"properties": {
835839
"ref": {
836-
"type": "string",
840+
"$ref": "#/definitions/refType",
837841
"format": "string",
838842
"title": "Reference",
839843
"description": "References a component by the components bom-ref attribute"
@@ -842,7 +846,7 @@
842846
"type": "array",
843847
"uniqueItems": true,
844848
"items": {
845-
"type": "string"
849+
"$ref": "#/definitions/refType"
846850
},
847851
"title": "Depends On",
848852
"description": "The bom-ref identifiers of the components that are dependencies of this dependency object."
@@ -857,7 +861,7 @@
857861
],
858862
"properties": {
859863
"bom-ref": {
860-
"type": "string",
864+
"$ref": "#/definitions/refType",
861865
"title": "BOM Reference",
862866
"description": "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref should be unique.",
863867
"default": "",

‎schema/bom-1.2.xsd‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,13 @@ limitations under the License.
3838
</xs:documentation>
3939
</xs:annotation>
4040

41+
<xs:simpleType name="refType">
42+
<xs:annotation>
43+
<xs:documentation>Identifier-DataType for interlinked elements.</xs:documentation>
44+
</xs:annotation>
45+
<xs:restriction base="xs:string" />
46+
</xs:simpleType>
47+
4148
<xs:complexType name="metadata">
4249
<xs:sequence minOccurs="0" maxOccurs="1">
4350
<xs:element name="timestamp" type="xs:dateTime" minOccurs="0">
@@ -395,7 +402,7 @@ limitations under the License.
395402
</xs:documentation>
396403
</xs:annotation>
397404
</xs:attribute>
398-
<xs:attribute name="bom-ref" type="xs:string">
405+
<xs:attribute name="bom-ref" type="bom:refType">
399406
<xs:annotation>
400407
<xs:documentation>
401408
An optional identifier which can be used to reference the component elsewhere in the BOM.
@@ -1144,7 +1151,7 @@ limitations under the License.
11441151
<xs:sequence minOccurs="0" maxOccurs="unbounded">
11451152
<xs:element name="dependency" type="bom:dependencyType"/>
11461153
</xs:sequence>
1147-
<xs:attribute name="ref" type="xs:string" use="required">
1154+
<xs:attribute name="ref" type="bom:refType" use="required">
11481155
<xs:annotation>
11491156
<xs:documentation>References a component or service by the its bom-ref attribute</xs:documentation>
11501157
</xs:annotation>
@@ -1302,7 +1309,7 @@ limitations under the License.
13021309
</xs:annotation>
13031310
</xs:any>
13041311
</xs:sequence>
1305-
<xs:attribute name="bom-ref" type="xs:string">
1312+
<xs:attribute name="bom-ref" type="bom:refType">
13061313
<xs:annotation>
13071314
<xs:documentation>
13081315
An optional identifier which can be used to reference the service elsewhere in the BOM.

‎schema/bom-1.3-strict.schema.json‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,10 @@
9494
}
9595
},
9696
"definitions": {
97+
"refType": {
98+
"$comment": "Identifier-DataType for interlinked elements.",
99+
"type": "string"
100+
},
97101
"metadata": {
98102
"type": "object",
99103
"title": "BOM Metadata Object",
@@ -267,7 +271,7 @@
267271
"pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+$"
268272
},
269273
"bom-ref": {
270-
"type": "string",
274+
"$ref": "#/definitions/refType",
271275
"title": "BOM Reference",
272276
"description": "An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref should be unique."
273277
},
@@ -852,15 +856,15 @@
852856
"additionalProperties": false,
853857
"properties": {
854858
"ref": {
855-
"type": "string",
859+
"$ref": "#/definitions/refType",
856860
"title": "Reference",
857861
"description": "References a component by the components bom-ref attribute"
858862
},
859863
"dependsOn": {
860864
"type": "array",
861865
"uniqueItems": true,
862866
"items": {
863-
"type": "string"
867+
"$ref": "#/definitions/refType"
864868
},
865869
"title": "Depends On",
866870
"description": "The bom-ref identifiers of the components that are dependencies of this dependency object."
@@ -876,7 +880,7 @@
876880
"additionalProperties": false,
877881
"properties": {
878882
"bom-ref": {
879-
"type": "string",
883+
"$ref": "#/definitions/refType",
880884
"title": "BOM Reference",
881885
"description": "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref should be unique."
882886
},

‎schema/bom-1.3.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ enum Classification {
4343
CLASSIFICATION_LIBRARY = 3;
4444
// A software operating system without regard to deployment model (i.e. installed on physical hardware, virtual machine, image, etc) Refer to https://en.wikipedia.org/wiki/Operating_system
4545
CLASSIFICATION_OPERATING_SYSTEM = 4;
46-
// A hardware device such as a processor, or chip-set. A hardware device containing firmware should include a component for the physical hardware itself, and another component of type 'firmware' or 'operating-system' (whichever is relevant), describing information about the software running on the device.
46+
// A hardware device such as a processor, or chip-set. A hardware device containing firmware should include a component for the physical hardware itself, and another component of type 'firmware' or 'operating-system' (whichever is relevant), describing information about the software running on the device. See also the list of known device properties: https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md
4747
CLASSIFICATION_DEVICE = 5;
4848
// A computer file. Refer to https://en.wikipedia.org/wiki/Computer_file for information about files.
4949
CLASSIFICATION_FILE = 6;

‎schema/bom-1.3.schema.json‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,10 @@
8787
}
8888
},
8989
"definitions": {
90+
"refType": {
91+
"$comment": "Identifier-DataType for interlinked elements.",
92+
"type": "string"
93+
},
9094
"metadata": {
9195
"type": "object",
9296
"title": "BOM Metadata Object",
@@ -255,7 +259,7 @@
255259
"pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+$"
256260
},
257261
"bom-ref": {
258-
"type": "string",
262+
"$ref": "#/definitions/refType",
259263
"title": "BOM Reference",
260264
"description": "An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref should be unique."
261265
},
@@ -826,15 +830,15 @@
826830
],
827831
"properties": {
828832
"ref": {
829-
"type": "string",
833+
"$ref": "#/definitions/refType",
830834
"title": "Reference",
831835
"description": "References a component by the components bom-ref attribute"
832836
},
833837
"dependsOn": {
834838
"type": "array",
835839
"uniqueItems": true,
836840
"items": {
837-
"type": "string"
841+
"$ref": "#/definitions/refType"
838842
},
839843
"title": "Depends On",
840844
"description": "The bom-ref identifiers of the components that are dependencies of this dependency object."
@@ -849,7 +853,7 @@
849853
],
850854
"properties": {
851855
"bom-ref": {
852-
"type": "string",
856+
"$ref": "#/definitions/refType",
853857
"title": "BOM Reference",
854858
"description": "An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref should be unique."
855859
},

‎schema/bom-1.3.xsd‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,13 @@ limitations under the License.
3535
</xs:documentation>
3636
</xs:annotation>
3737

38+
<xs:simpleType name="refType">
39+
<xs:annotation>
40+
<xs:documentation>Identifier-DataType for interlinked elements.</xs:documentation>
41+
</xs:annotation>
42+
<xs:restriction base="xs:string" />
43+
</xs:simpleType>
44+
3845
<xs:complexType name="metadata">
3946
<xs:sequence minOccurs="0" maxOccurs="1">
4047
<xs:element name="timestamp" type="xs:dateTime" minOccurs="0">
@@ -400,7 +407,7 @@ limitations under the License.
400407
</xs:documentation>
401408
</xs:annotation>
402409
</xs:attribute>
403-
<xs:attribute name="bom-ref" type="xs:string">
410+
<xs:attribute name="bom-ref" type="bom:refType">
404411
<xs:annotation>
405412
<xs:documentation>
406413
An optional identifier which can be used to reference the component elsewhere in the BOM.
@@ -555,7 +562,9 @@ limitations under the License.
555562
<xs:documentation>A hardware device such as a processor, or chip-set. A hardware device
556563
containing firmware should include a component for the physical hardware itself, and another
557564
component of type 'firmware' or 'operating-system' (whichever is relevant), describing
558-
information about the software running on the device.</xs:documentation>
565+
information about the software running on the device.
566+
See also the list of known device properties: https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md
567+
</xs:documentation>
559568
</xs:annotation>
560569
</xs:enumeration>
561570
<xs:enumeration value="firmware">
@@ -1156,7 +1165,7 @@ limitations under the License.
11561165
<xs:sequence minOccurs="0" maxOccurs="unbounded">
11571166
<xs:element name="dependency" type="bom:dependencyType"/>
11581167
</xs:sequence>
1159-
<xs:attribute name="ref" type="xs:string" use="required">
1168+
<xs:attribute name="ref" type="bom:refType" use="required">
11601169
<xs:annotation>
11611170
<xs:documentation>References a component or service by the its bom-ref attribute</xs:documentation>
11621171
</xs:annotation>
@@ -1309,7 +1318,7 @@ limitations under the License.
13091318
</xs:annotation>
13101319
</xs:any>
13111320
</xs:sequence>
1312-
<xs:attribute name="bom-ref" type="xs:string">
1321+
<xs:attribute name="bom-ref" type="bom:refType">
13131322
<xs:annotation>
13141323
<xs:documentation>
13151324
An optional identifier which can be used to reference the service elsewhere in the BOM.
@@ -1502,7 +1511,7 @@ limitations under the License.
15021511
</xs:simpleType>
15031512

15041513
<xs:complexType name="bomReferenceType">
1505-
<xs:attribute name="ref" type="xs:string" use="required">
1514+
<xs:attribute name="ref" type="bom:refType" use="required">
15061515
<xs:annotation>
15071516
<xs:documentation>References a component or service by the its bom-ref attribute</xs:documentation>
15081517
</xs:annotation>

‎schema/bom-1.4.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ enum Classification {
4545
CLASSIFICATION_LIBRARY = 3;
4646
// A software operating system without regard to deployment model (i.e. installed on physical hardware, virtual machine, image, etc) Refer to https://en.wikipedia.org/wiki/Operating_system
4747
CLASSIFICATION_OPERATING_SYSTEM = 4;
48-
// A hardware device such as a processor, or chip-set. A hardware device containing firmware should include a component for the physical hardware itself, and another component of type 'firmware' or 'operating-system' (whichever is relevant), describing information about the software running on the device.
48+
// A hardware device such as a processor, or chip-set. A hardware device containing firmware should include a component for the physical hardware itself, and another component of type 'firmware' or 'operating-system' (whichever is relevant), describing information about the software running on the device. See also the list of known device properties: https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md
4949
CLASSIFICATION_DEVICE = 5;
5050
// A computer file. Refer to https://en.wikipedia.org/wiki/Computer_file for information about files.
5151
CLASSIFICATION_FILE = 6;

0 commit comments

Comments
 (0)