Skip to content

Commit e22b417

Browse files
stevespringettstevespringett
authored
Merge pull request #234 from CycloneDX/v1.5-dev-fix-data-governance
Fixing missing data governance on service data
2 parents 7dae289 + ec4add4 commit e22b417

File tree

6 files changed

+115
-76
lines changed

6 files changed

+115
-76
lines changed

‎schema/bom-1.5.proto‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,8 @@ message DataFlow {
147147
repeated string source = 5;
148148
// The URI, URL, or BOM-Link of the components or services the data is sent to
149149
repeated string destination = 6;
150+
// Data Governance
151+
optional DataGovernance governance = 7;
150152
}
151153

152154
// Specifies the flow direction of the data. Valid values are: inbound, outbound, bi-directional, and unknown. Direction is relative to the service. Inbound flow states that data enters the service. Outbound flow states that data leaves the service. Bi-directional states that data flows both ways, and unknown states that the direction is not known.
@@ -1109,20 +1111,20 @@ message ComponentData {
11091111
// Provides the ability to document name-value parameters used for configuration.
11101112
repeated Property properties = 3;
11111113
}
1114+
}
11121115

1113-
message DataGovernance {
1114-
// Data custodians are responsible for the safe custody, transport, and storage of data.
1115-
repeated DataGovernanceResponsibleParty custodians = 1;
1116-
// Data stewards are responsible for data content, context, and associated business rules.
1117-
repeated DataGovernanceResponsibleParty stewards = 2;
1118-
// Data owners are concerned with risk and appropriate access to data.
1119-
repeated DataGovernanceResponsibleParty owners = 3;
1116+
message DataGovernance {
1117+
// Data custodians are responsible for the safe custody, transport, and storage of data.
1118+
repeated DataGovernanceResponsibleParty custodians = 1;
1119+
// Data stewards are responsible for data content, context, and associated business rules.
1120+
repeated DataGovernanceResponsibleParty stewards = 2;
1121+
// Data owners are concerned with risk and appropriate access to data.
1122+
repeated DataGovernanceResponsibleParty owners = 3;
11201123

1121-
message DataGovernanceResponsibleParty {
1122-
oneof choice {
1123-
OrganizationalEntity organization = 1;
1124-
OrganizationalContact contact = 2;
1125-
}
1124+
message DataGovernanceResponsibleParty {
1125+
oneof choice {
1126+
OrganizationalEntity organization = 1;
1127+
OrganizationalContact contact = 2;
11261128
}
11271129
}
11281130
}

‎schema/bom-1.5.schema.json‎

Lines changed: 31 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1313,6 +1313,11 @@
13131313
"Credit card information being exchanged in between the web app and the database"
13141314
]
13151315
},
1316+
"governance": {
1317+
"type": "object",
1318+
"title": "Data Governance",
1319+
"$ref": "#/definitions/dataGovernance"
1320+
},
13161321
"source": {
13171322
"type": "array",
13181323
"items": {
@@ -2548,28 +2553,32 @@
25482553
"governance": {
25492554
"type": "object",
25502555
"title": "Data Governance",
2551-
"description": "",
2552-
"additionalProperties": false,
2553-
"properties": {
2554-
"custodians": {
2555-
"type": "array",
2556-
"title": "Data Custodians",
2557-
"description": "Data custodians are responsible for the safe custody, transport, and storage of data.",
2558-
"items": { "$ref": "#/definitions/dataGovernanceResponsibleParty" }
2559-
},
2560-
"stewards": {
2561-
"type": "array",
2562-
"title": "Data Stewards",
2563-
"description": "Data stewards are responsible for data content, context, and associated business rules.",
2564-
"items": { "$ref": "#/definitions/dataGovernanceResponsibleParty" }
2565-
},
2566-
"owners": {
2567-
"type": "array",
2568-
"title": "Data Owners",
2569-
"description": "Data owners are concerned with risk and appropriate access to data.",
2570-
"items": { "$ref": "#/definitions/dataGovernanceResponsibleParty" }
2571-
}
2572-
}
2556+
"$ref": "#/definitions/dataGovernance"
2557+
}
2558+
}
2559+
},
2560+
"dataGovernance": {
2561+
"type": "object",
2562+
"title": "Data Governance",
2563+
"additionalProperties": false,
2564+
"properties": {
2565+
"custodians": {
2566+
"type": "array",
2567+
"title": "Data Custodians",
2568+
"description": "Data custodians are responsible for the safe custody, transport, and storage of data.",
2569+
"items": { "$ref": "#/definitions/dataGovernanceResponsibleParty" }
2570+
},
2571+
"stewards": {
2572+
"type": "array",
2573+
"title": "Data Stewards",
2574+
"description": "Data stewards are responsible for data content, context, and associated business rules.",
2575+
"items": { "$ref": "#/definitions/dataGovernanceResponsibleParty" }
2576+
},
2577+
"owners": {
2578+
"type": "array",
2579+
"title": "Data Owners",
2580+
"description": "Data owners are concerned with risk and appropriate access to data.",
2581+
"items": { "$ref": "#/definitions/dataGovernanceResponsibleParty" }
25732582
}
25742583
}
25752584
},

‎schema/bom-1.5.xsd‎

Lines changed: 43 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1826,6 +1826,7 @@ limitations under the License.
18261826
<xs:documentation>Specifies the data classification.</xs:documentation>
18271827
</xs:annotation>
18281828
</xs:element>
1829+
<xs:element name="governance" type="bom:dataGovernance" minOccurs="0" maxOccurs="1" />
18291830
<xs:element name="source" minOccurs="0" maxOccurs="1">
18301831
<xs:annotation>
18311832
<xs:documentation>The URI, URL, or BOM-Link of the components or services the data came in from.</xs:documentation>
@@ -3008,48 +3009,7 @@ limitations under the License.
30083009
</xs:documentation>
30093010
</xs:annotation>
30103011
</xs:element>
3011-
<xs:element name="governance" minOccurs="0" maxOccurs="1">
3012-
<xs:complexType>
3013-
<xs:sequence>
3014-
<xs:element name="custodians" minOccurs="0" maxOccurs="1">
3015-
<xs:annotation>
3016-
<xs:documentation>
3017-
Data custodians are responsible for the safe custody, transport, and storage of data.
3018-
</xs:documentation>
3019-
</xs:annotation>
3020-
<xs:complexType>
3021-
<xs:sequence>
3022-
<xs:element name="custodian" type="bom:organizationOrIndividualType" minOccurs="0" maxOccurs="unbounded"/>
3023-
</xs:sequence>
3024-
</xs:complexType>
3025-
</xs:element>
3026-
<xs:element name="stewards" minOccurs="0" maxOccurs="1">
3027-
<xs:annotation>
3028-
<xs:documentation>
3029-
Data stewards are responsible for data content, context, and associated business rules.
3030-
</xs:documentation>
3031-
</xs:annotation>
3032-
<xs:complexType>
3033-
<xs:sequence>
3034-
<xs:element name="steward" type="bom:organizationOrIndividualType" minOccurs="0" maxOccurs="unbounded"/>
3035-
</xs:sequence>
3036-
</xs:complexType>
3037-
</xs:element>
3038-
<xs:element name="owners" minOccurs="0" maxOccurs="1">
3039-
<xs:annotation>
3040-
<xs:documentation>
3041-
Data owners are concerned with risk and appropriate access to data.
3042-
</xs:documentation>
3043-
</xs:annotation>
3044-
<xs:complexType>
3045-
<xs:sequence>
3046-
<xs:element name="owner" type="bom:organizationOrIndividualType" minOccurs="0" maxOccurs="unbounded"/>
3047-
</xs:sequence>
3048-
</xs:complexType>
3049-
</xs:element>
3050-
</xs:sequence>
3051-
</xs:complexType>
3052-
</xs:element>
3012+
<xs:element name="governance" type="bom:dataGovernance" minOccurs="0" maxOccurs="1" />
30533013
</xs:sequence>
30543014
<xs:attribute name="bom-ref" type="bom:refType">
30553015
<xs:annotation>
@@ -3061,6 +3021,47 @@ limitations under the License.
30613021
</xs:attribute>
30623022
</xs:complexType>
30633023

3024+
<xs:complexType name="dataGovernance">
3025+
<xs:sequence>
3026+
<xs:element name="custodians" minOccurs="0" maxOccurs="1">
3027+
<xs:annotation>
3028+
<xs:documentation>
3029+
Data custodians are responsible for the safe custody, transport, and storage of data.
3030+
</xs:documentation>
3031+
</xs:annotation>
3032+
<xs:complexType>
3033+
<xs:sequence>
3034+
<xs:element name="custodian" type="bom:organizationOrIndividualType" minOccurs="0" maxOccurs="unbounded"/>
3035+
</xs:sequence>
3036+
</xs:complexType>
3037+
</xs:element>
3038+
<xs:element name="stewards" minOccurs="0" maxOccurs="1">
3039+
<xs:annotation>
3040+
<xs:documentation>
3041+
Data stewards are responsible for data content, context, and associated business rules.
3042+
</xs:documentation>
3043+
</xs:annotation>
3044+
<xs:complexType>
3045+
<xs:sequence>
3046+
<xs:element name="steward" type="bom:organizationOrIndividualType" minOccurs="0" maxOccurs="unbounded"/>
3047+
</xs:sequence>
3048+
</xs:complexType>
3049+
</xs:element>
3050+
<xs:element name="owners" minOccurs="0" maxOccurs="1">
3051+
<xs:annotation>
3052+
<xs:documentation>
3053+
Data owners are concerned with risk and appropriate access to data.
3054+
</xs:documentation>
3055+
</xs:annotation>
3056+
<xs:complexType>
3057+
<xs:sequence>
3058+
<xs:element name="owner" type="bom:organizationOrIndividualType" minOccurs="0" maxOccurs="unbounded"/>
3059+
</xs:sequence>
3060+
</xs:complexType>
3061+
</xs:element>
3062+
</xs:sequence>
3063+
</xs:complexType>
3064+
30643065
<xs:complexType name="organizationOrIndividualType">
30653066
<xs:choice>
30663067
<xs:element name="organization" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1" />

‎tools/src/test/resources/1.5/valid-saasbom-1.5.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,15 @@
106106
"description": "Traffic to/from stock service to microservice-1",
107107
"classification": "PII",
108108
"flow": "bi-directional",
109+
"governance": {
110+
"owners": [
111+
{
112+
"organization": {
113+
"name": "Customer Name"
114+
}
115+
}
116+
]
117+
},
109118
"source": [
110119
"urn:cdx:3e671687-395b-41f5-a30f-a58921a69b79/1#stock-ticker-service"
111120
],

‎tools/src/test/resources/1.5/valid-saasbom-1.5.textproto‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,15 @@ services {
3131
value: "Customer"
3232
name: "Consumer to Stock Service",
3333
description: "Traffic to/from consumer to service"
34+
governance: {
35+
owners: [
36+
{
37+
organization: {
38+
name: "Customer Name"
39+
}
40+
}
41+
]
42+
},
3443
source: "https://0.0.0.0"
3544
destination: "https://0.0.0.0"
3645
}

‎tools/src/test/resources/1.5/valid-saasbom-1.5.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,15 @@
2424
<data>
2525
<dataflow name="Consumer to Stock Service" description="Traffic to/from consumer to service">
2626
<classification flow="bi-directional">Customer</classification>
27+
<governance>
28+
<owners>
29+
<owner>
30+
<organization>
31+
<name>Customer Name</name>
32+
</organization>
33+
</owner>
34+
</owners>
35+
</governance>
2736
<source>
2837
<url>https://0.0.0.0</url>
2938
</source>

0 commit comments

Comments
 (0)