Skip to content

Commit a9122e8

Browse files
jkowalleckjkowalleck
authored
feat: Add support for TLP marking in metadata (#604)
As discussed in ticket #595, this PR adds TLP marking in the BOM metadata. This PR superseeds #603 fixes #595
2 parents cb2a539 + ed5fa84 commit a9122e8

8 files changed

Lines changed: 140 additions & 0 deletions

‎schema/bom-1.7.proto‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -528,6 +528,8 @@ message Metadata {
528528
repeated Lifecycles lifecycles = 9;
529529
// The organization that created the BOM. Manufacturer is common in BOMs created through automated processes. BOMs created through manual means may have '.authors' instead.
530530
optional OrganizationalEntity manufacturer = 10;
531+
// The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the data that the BOM describes.
532+
optional TlpClassification distribution = 11;
531533
}
532534

533535
message Lifecycles {
@@ -689,6 +691,22 @@ message Swid {
689691
optional string url = 7;
690692
}
691693

694+
// Traffic Light Protocol (TLP) is a classification system for identifying the potential risk associated with artefact, including whether it is subject to certain types of legal, financial, or technical threats. Refer to https://www.first.org/tlp/ for further information.
695+
//The default classification is "CLEAR"
696+
enum TlpClassification {
697+
// The information is not subject to any restrictions as regards the sharing.
698+
// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX -- "CLEAR" is our fallback, the default.
699+
TLP_CLASSIFICATION_CLEAR = 0;
700+
// The information is subject to limited disclosure, and recipients can share it within their community but not via publicly accessible channels.
701+
TLP_CLASSIFICATION_GREEN = 1;
702+
// The information is subject to limited disclosure, and recipients can only share it on a need-to-know basis within their organization and with clients.
703+
TLP_CLASSIFICATION_AMBER = 2;
704+
// The information is subject to limited disclosure, and recipients can only share it on a need-to-know basis within their organization.
705+
TLP_CLASSIFICATION_AMBER_AND_STRICT = 3;
706+
// The information is subject to restricted distribution to individual recipients only and must not be shared.
707+
TLP_CLASSIFICATION_RED = 4;
708+
}
709+
692710
// Specifies a tool (manual or automated).
693711
message Tool {
694712
// DEPRECATED - DO NOT USE - The vendor of the tool used to create the BOM.

‎schema/bom-1.7.schema.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -712,9 +712,34 @@
712712
"title": "Properties",
713713
"description": "Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.",
714714
"items": {"$ref": "#/definitions/property"}
715+
},
716+
"distribution": {
717+
"title": "Distribution",
718+
"description": "The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the data that the BOM describes.",
719+
"$ref": "#/definitions/tlpClassification"
715720
}
716721
}
717722
},
723+
"tlpClassification": {
724+
"title": "Traffic Light Protocol (TLP) Classification",
725+
"description": "Traffic Light Protocol (TLP) is a classification system for identifying the potential risk associated with artefact, including whether it is subject to certain types of legal, financial, or technical threats. Refer to [https://www.first.org/tlp/](https://www.first.org/tlp/) for further information.\nThe default classification is \"CLEAR\"",
726+
"type" : "string",
727+
"default": "CLEAR",
728+
"enum": [
729+
"CLEAR",
730+
"GREEN",
731+
"AMBER",
732+
"AMBER_AND_STRICT",
733+
"RED"
734+
],
735+
"meta:enum": {
736+
"CLEAR": "The information is not subject to any restrictions as regards the sharing.",
737+
"GREEN": "The information is subject to limited disclosure, and recipients can share it within their community but not via publicly accessible channels.",
738+
"AMBER": "The information is subject to limited disclosure, and recipients can only share it on a need-to-know basis within their organization and with clients.",
739+
"AMBER_AND_STRICT": "The information is subject to limited disclosure, and recipients can only share it on a need-to-know basis within their organization.",
740+
"RED": "The information is subject to restricted distribution to individual recipients only and must not be shared."
741+
}
742+
},
718743
"tool": {
719744
"type": "object",
720745
"title": "Tool",

‎schema/bom-1.7.xsd‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,12 @@ limitations under the License.
256256
Formal registration is optional.</xs:documentation>
257257
</xs:annotation>
258258
</xs:element>
259+
<xs:element name="distribution" type="bom:tlpClassificationType" default="CLEAR" minOccurs="0" maxOccurs="1">
260+
<xs:annotation>
261+
<xs:documentation>The Traffic Light Protocol (TLP) classification that controls the sharing and distribution
262+
of the data that the BOM describes.</xs:documentation>
263+
</xs:annotation>
264+
</xs:element>
259265
<xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded">
260266
<xs:annotation>
261267
<xs:documentation>
@@ -390,6 +396,52 @@ limitations under the License.
390396
</xs:anyAttribute>
391397
</xs:complexType>
392398

399+
<xs:simpleType name="tlpClassificationType">
400+
<xs:annotation>
401+
<xs:documentation xml:lang="en">
402+
Traffic Light Protocol (TLP) is a classification system for identifying the potential risk associated with artefact, including whether it is subject to certain types of legal, financial, or technical threats. Refer to https://www.first.org/tlp/ for further information.
403+
The default classification is "CLEAR"
404+
</xs:documentation>
405+
</xs:annotation>
406+
<xs:restriction base="xs:string">
407+
<xs:enumeration value="CLEAR">
408+
<xs:annotation>
409+
<xs:documentation>
410+
The information is not subject to any restrictions as regards the sharing.
411+
</xs:documentation>
412+
</xs:annotation>
413+
</xs:enumeration>
414+
<xs:enumeration value="GREEN">
415+
<xs:annotation>
416+
<xs:documentation>
417+
The information is subject to limited disclosure, and recipients can share it within their community but not via publicly accessible channels.
418+
</xs:documentation>
419+
</xs:annotation>
420+
</xs:enumeration>
421+
<xs:enumeration value="AMBER">
422+
<xs:annotation>
423+
<xs:documentation>
424+
The information is subject to limited disclosure, and recipients can only share it on a need-to-know basis within their organization and with clients.
425+
</xs:documentation>
426+
</xs:annotation>
427+
</xs:enumeration>
428+
<xs:enumeration value="AMBER_AND_STRICT">
429+
<xs:annotation>
430+
<xs:documentation>
431+
The information is subject to limited disclosure, and recipients can only share it on a need-to-know basis within their organization.
432+
</xs:documentation>
433+
</xs:annotation>
434+
</xs:enumeration>
435+
<xs:enumeration value="RED">
436+
<xs:annotation>
437+
<xs:documentation>
438+
The information is subject to restricted distribution to individual recipients only and must not be shared.
439+
</xs:documentation>
440+
</xs:annotation>
441+
</xs:enumeration>
442+
</xs:restriction>
443+
</xs:simpleType>
444+
393445
<xs:complexType name="toolType">
394446
<xs:annotation>
395447
<xs:documentation>Information about the automated or manual tool used</xs:documentation>

‎tools/src/test/resources/1.7/invalid-metadata-distribution-1.7.json‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.7",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"metadata": {
8+
"distribution": "Unrestricted"
9+
},
10+
"components": []
11+
}

‎tools/src/test/resources/1.7/invalid-metadata-distribution-1.7.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0"?>
2+
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.7">
3+
<metadata>
4+
<distribution>Unrestricted</distribution>
5+
</metadata>
6+
<components />
7+
</bom>

‎tools/src/test/resources/1.7/valid-metadata-distribution-1.7.json‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.7",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"metadata": {
8+
"distribution": "RED"
9+
},
10+
"components": []
11+
}

‎tools/src/test/resources/1.7/valid-metadata-distribution-1.7.textproto‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# proto-file: schema/bom-1.7.proto
2+
# proto-message: Bom
3+
4+
spec_version: "1.7"
5+
version: 1
6+
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
7+
metadata {
8+
distribution: TLP_CLASSIFICATION_RED
9+
}

‎tools/src/test/resources/1.7/valid-metadata-distribution-1.7.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0"?>
2+
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.7">
3+
<metadata>
4+
<distribution>RED</distribution>
5+
</metadata>
6+
<components />
7+
</bom>

0 commit comments

Comments
 (0)