Skip to content

Commit 303889b

Browse files
jkowalleckjkowalleck
authored
feat: add support CycloneDX 1.7.1 & 1.6.2 & 1.5.1 (#985)
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
1 parent 392ba60 commit 303889b

7 files changed

Lines changed: 60 additions & 30 deletions

File tree

‎cyclonedx/schema/_res/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ some schema for offline use as downloaded via [script](../../../tools/schema-dow
44
original sources: <https://github.com/CycloneDX/specification/tree/master/schema>
55

66
Currently using version
7-
[4b3f59453366e27c8073fd24e98bf21ef8892c8e](https://github.com/CycloneDX/specification/commit/4b3f59453366e27c8073fd24e98bf21ef8892c8e)
7+
[b29bae660048e0ad2fbc5f2972927b442ce951c4](https://github.com/CycloneDX/specification/commit/b29bae660048e0ad2fbc5f2972927b442ce951c4)
88

99
| file | note |
1010
|------|------|

‎cyclonedx/schema/_res/bom-1.5.SNAPSHOT.xsd‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ limitations under the License.
2222
targetNamespace="http://cyclonedx.org/schema/bom/1.5"
2323
vc:minVersion="1.0"
2424
vc:maxVersion="1.1"
25-
version="1.5.0">
25+
version="1.5.1">
2626

2727
<xs:import namespace="http://cyclonedx.org/schema/spdx" schemaLocation="spdx.SNAPSHOT.xsd"/>
2828

@@ -2885,7 +2885,7 @@ limitations under the License.
28852885
</xs:annotation>
28862886
<xs:complexType>
28872887
<xs:sequence>
2888-
<xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="1" />
2888+
<xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
28892889
</xs:sequence>
28902890
</xs:complexType>
28912891
</xs:element>
@@ -2897,7 +2897,7 @@ limitations under the License.
28972897
</xs:annotation>
28982898
<xs:complexType>
28992899
<xs:sequence>
2900-
<xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="1" />
2900+
<xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
29012901
</xs:sequence>
29022902
</xs:complexType>
29032903
</xs:element>
@@ -2911,7 +2911,7 @@ limitations under the License.
29112911
</xs:annotation>
29122912
<xs:complexType>
29132913
<xs:sequence>
2914-
<xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="1" />
2914+
<xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
29152915
</xs:sequence>
29162916
</xs:complexType>
29172917
</xs:element>
@@ -2923,7 +2923,7 @@ limitations under the License.
29232923
</xs:annotation>
29242924
<xs:complexType>
29252925
<xs:sequence>
2926-
<xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="1" />
2926+
<xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
29272927
</xs:sequence>
29282928
</xs:complexType>
29292929
</xs:element>
@@ -3008,6 +3008,16 @@ limitations under the License.
30083008
</xs:sequence>
30093009
</xs:complexType>
30103010
</xs:element>
3011+
<xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1">
3012+
<xs:annotation>
3013+
<xs:documentation>Provides the ability to document properties in a name/value store.
3014+
This provides flexibility to include data not officially supported in the standard
3015+
without having to use additional namespaces or create extensions. Property names
3016+
of interest to the general public are encouraged to be registered in the
3017+
CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy.
3018+
Formal registration is OPTIONAL.</xs:documentation>
3019+
</xs:annotation>
3020+
</xs:element>
30113021
</xs:sequence>
30123022
<xs:attribute name="bom-ref" type="bom:refType">
30133023
<xs:annotation>

‎cyclonedx/schema/_res/bom-1.6.SNAPSHOT.schema.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -536,7 +536,7 @@
536536
"description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.",
537537
"type": "string",
538538
"minLength": 1,
539-
"$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'"
539+
"$comment": "TODO (breaking change): add a format constraint that prevents the value from starting with 'urn:cdx:'"
540540
},
541541
"refLinkType": {
542542
"description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.",
@@ -1161,7 +1161,7 @@
11611161
"contentType": {
11621162
"type": "string",
11631163
"title": "Content-Type",
1164-
"description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
1164+
"description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
11651165
"default": "text/plain",
11661166
"examples": [
11671167
"text/plain",
@@ -2681,7 +2681,7 @@
26812681
"ratings": {
26822682
"type": "array",
26832683
"title": "Ratings",
2684-
"description": "List of vulnerability ratings",
2684+
"description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
26852685
"items": {
26862686
"$ref": "#/definitions/rating"
26872687
}

‎cyclonedx/schema/_res/bom-1.6.SNAPSHOT.xsd‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ limitations under the License.
2222
targetNamespace="http://cyclonedx.org/schema/bom/1.6"
2323
vc:minVersion="1.0"
2424
vc:maxVersion="1.1"
25-
version="1.6.1">
25+
version="1.6.2">
2626

2727
<xs:import namespace="http://cyclonedx.org/schema/spdx" schemaLocation="spdx.SNAPSHOT.xsd"/>
2828

@@ -973,7 +973,7 @@ limitations under the License.
973973
<xs:documentation>
974974
Specifies the format and nature of the data being attached, helping systems correctly
975975
interpret and process the content. Common content type examples include `application/json`
976-
for JSON data and `text/plain` for plan text documents.
976+
for JSON data and `text/plain` for plain text documents.
977977
RFC 2045 section 5.1 outlines the structure and use of content types. For a comprehensive
978978
list of registered content types, refer to the IANA media types registry at
979979
https://www.iana.org/assignments/media-types/media-types.xhtml.
@@ -3256,7 +3256,7 @@ limitations under the License.
32563256
</xs:annotation>
32573257
<xs:complexType>
32583258
<xs:sequence>
3259-
<xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="1" />
3259+
<xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
32603260
</xs:sequence>
32613261
</xs:complexType>
32623262
</xs:element>
@@ -3268,7 +3268,7 @@ limitations under the License.
32683268
</xs:annotation>
32693269
<xs:complexType>
32703270
<xs:sequence>
3271-
<xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="1" />
3271+
<xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
32723272
</xs:sequence>
32733273
</xs:complexType>
32743274
</xs:element>
@@ -3282,7 +3282,7 @@ limitations under the License.
32823282
</xs:annotation>
32833283
<xs:complexType>
32843284
<xs:sequence>
3285-
<xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="1" />
3285+
<xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
32863286
</xs:sequence>
32873287
</xs:complexType>
32883288
</xs:element>
@@ -3294,7 +3294,7 @@ limitations under the License.
32943294
</xs:annotation>
32953295
<xs:complexType>
32963296
<xs:sequence>
3297-
<xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="1" />
3297+
<xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="unbounded" />
32983298
</xs:sequence>
32993299
</xs:complexType>
33003300
</xs:element>
@@ -3386,6 +3386,16 @@ limitations under the License.
33863386
</xs:sequence>
33873387
</xs:complexType>
33883388
</xs:element>
3389+
<xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1">
3390+
<xs:annotation>
3391+
<xs:documentation>Provides the ability to document properties in a name/value store.
3392+
This provides flexibility to include data not officially supported in the standard
3393+
without having to use additional namespaces or create extensions. Property names
3394+
of interest to the general public are encouraged to be registered in the
3395+
CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy.
3396+
Formal registration is OPTIONAL.</xs:documentation>
3397+
</xs:annotation>
3398+
</xs:element>
33893399
</xs:sequence>
33903400
<xs:attribute name="bom-ref" type="bom:refType">
33913401
<xs:annotation>
@@ -4218,7 +4228,7 @@ limitations under the License.
42184228
</xs:element>
42194229
<xs:element name="ratings" minOccurs="0" maxOccurs="1">
42204230
<xs:annotation>
4221-
<xs:documentation xml:lang="en">List of vulnerability ratings.</xs:documentation>
4231+
<xs:documentation xml:lang="en">List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.</xs:documentation>
42224232
</xs:annotation>
42234233
<xs:complexType>
42244234
<xs:sequence>

‎cyclonedx/schema/_res/bom-1.7.SNAPSHOT.schema.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -555,7 +555,7 @@
555555
"description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.",
556556
"type": "string",
557557
"minLength": 1,
558-
"$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'"
558+
"$comment": "TODO (breaking change): add a format constraint that prevents the value from starting with 'urn:cdx:'"
559559
},
560560
"refLinkType": {
561561
"title": "BOM Reference",
@@ -981,7 +981,7 @@
981981
"versionRange": {
982982
"$ref": "#/definitions/versionRange",
983983
"title": "Component Version Range",
984-
"description": "For an external component, this specifies the accepted version range.\nThe value must adhere to the Package URL Version Range syntax (vers), as defined at <https://github.com/package-url/vers-spec\nMay only be used if `.isExternal` is set to `true`.\nMust be used exclusively, either 'version' or 'versionRange', but not both."
984+
"description": "For an external component, this specifies the accepted version range.\nThe value must adhere to the Package URL Version Range syntax (vers), as defined at https://github.com/package-url/vers-spec\nMay only be used if `.isExternal` is set to `true`.\nMust be used exclusively, either 'version' or 'versionRange', but not both."
985985
},
986986
"isExternal": {
987987
"type": "boolean",
@@ -1079,7 +1079,7 @@
10791079
"ancestors": {
10801080
"type": "array",
10811081
"title": "Ancestors",
1082-
"description": "Describes zero or more components in which a component is derived from. This is commonly used to describe forks from existing projects where the forked version contains a ancestor node containing the original component it was forked from. For example, Component A is the original component. Component B is the component being used and documented in the BOM. However, Component B contains a pedigree node with a single ancestor documenting Component A - the original component from which Component B is derived from.",
1082+
"description": "Describes zero or more components in which a component is derived from. This is commonly used to describe forks from existing projects where the forked version contains an ancestor node containing the original component it was forked from. For example, Component A is the original component. Component B is the component being used and documented in the BOM. However, Component B contains a pedigree node with a single ancestor documenting Component A - the original component from which Component B is derived from.",
10831083
"items": {"$ref": "#/definitions/component"}
10841084
},
10851085
"descendants": {
@@ -1103,7 +1103,7 @@
11031103
"patches": {
11041104
"type": "array",
11051105
"title": "Patches",
1106-
"description": ">A list of zero or more patches describing how the component deviates from an ancestor, descendant, or variant. Patches may be complementary to commits or may be used in place of commits.",
1106+
"description": "A list of zero or more patches describing how the component deviates from an ancestor, descendant, or variant. Patches may be complementary to commits or may be used in place of commits.",
11071107
"items": {"$ref": "#/definitions/patch"}
11081108
},
11091109
"notes": {
@@ -1248,7 +1248,7 @@
12481248
"contentType": {
12491249
"type": "string",
12501250
"title": "Content-Type",
1251-
"description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
1251+
"description": "Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plain text documents.\n [RFC 2045 section 5.1](https://www.ietf.org/rfc/rfc2045.html#section-5.1) outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the [IANA media types registry](https://www.iana.org/assignments/media-types/media-types.xhtml).",
12521252
"default": "text/plain",
12531253
"examples": [
12541254
"text/plain",
@@ -2841,7 +2841,7 @@
28412841
"ratings": {
28422842
"type": "array",
28432843
"title": "Ratings",
2844-
"description": "List of vulnerability ratings",
2844+
"description": "List of vulnerability ratings. Consumers SHOULD consider ratings in prioritization decisions; source ratings may differ and aid prioritization.",
28452845
"items": {
28462846
"$ref": "#/definitions/rating"
28472847
}

0 commit comments

Comments
 (0)