diff --git a/schema/bom-1.7.proto b/schema/bom-1.7.proto index 3686422b..0f5845bf 100644 --- a/schema/bom-1.7.proto +++ b/schema/bom-1.7.proto @@ -559,6 +559,11 @@ enum LicensingTypeEnum { } message Metadata { + message DistributionConstraints { + // The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the data that the BOM describes. + optional TlpClassification tlp = 1; + } + // The date and time (timestamp) when the document was created. optional google.protobuf.Timestamp timestamp = 1; // The tool(s) used in the creation of the BOM. @@ -580,8 +585,8 @@ message Metadata { repeated Lifecycles lifecycles = 9; // The organization that created the BOM. Manufacturer is common in BOMs created through automated processes. BOMs created through manual means may have '.authors' instead. optional OrganizationalEntity manufacturer = 10; - // The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the data that the BOM describes. - optional TlpClassification distribution = 11; + // Conditions and constraints governing the sharing and distribution of the data or components described by this BOM. + optional DistributionConstraints distributionConstraints = 11; } message Lifecycles { diff --git a/schema/bom-1.7.schema.json b/schema/bom-1.7.schema.json index 1bdcad7b..aa1ee459 100644 --- a/schema/bom-1.7.schema.json +++ b/schema/bom-1.7.schema.json @@ -723,10 +723,17 @@ "description": "Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", "items": {"$ref": "#/definitions/property"} }, - "distribution": { - "title": "Distribution", - "description": "The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the data that the BOM describes.", - "$ref": "#/definitions/tlpClassification" + "distributionConstraints": { + "title": "Distribution Constraints", + "description": "Conditions and constraints governing the sharing and distribution of the data or components described by this BOM.", + "type": "object", + "properties": { + "tlp": { + "$ref": "#/definitions/tlpClassification", + "description": "The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the data that the BOM describes." + } + }, + "additionalProperties": false } } }, diff --git a/schema/bom-1.7.xsd b/schema/bom-1.7.xsd index fbf9e774..e1926495 100644 --- a/schema/bom-1.7.xsd +++ b/schema/bom-1.7.xsd @@ -256,11 +256,25 @@ limitations under the License. Formal registration is optional. - + - The Traffic Light Protocol (TLP) classification that controls the sharing and distribution - of the data that the BOM describes. + + Conditions and constraints governing the sharing and distribution of the data or components + described by this BOM. + + + + + + + The Traffic Light Protocol (TLP) classification that controls the sharing and + distribution of the data that the BOM describes. + + + + + diff --git a/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.json b/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.json index 54411553..1fd187c1 100644 --- a/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.json +++ b/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.json @@ -5,7 +5,9 @@ "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", "version": 1, "metadata": { - "distribution": "RED" + "distributionConstraints": { + "tlp": "RED" + } }, "components": [] } diff --git a/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.textproto b/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.textproto index e32c0456..26807b80 100644 --- a/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.textproto +++ b/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.textproto @@ -5,5 +5,7 @@ spec_version: "1.7" version: 1 serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" metadata { - distribution: TLP_CLASSIFICATION_RED + distributionConstraints { + tlp: TLP_CLASSIFICATION_RED + } } diff --git a/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.xml b/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.xml index 3666b382..833ada63 100644 --- a/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.xml +++ b/tools/src/test/resources/1.7/valid-metadata-distribution-1.7.xml @@ -1,7 +1,9 @@ - RED + + RED +