Can we outside of artefact indicate content

[oej]

Specifically the question started with "I don't want any CycloneDX that contains patent information".

But can we indicate some more detailed level of the types of information that exists in a CycloneDX file, especially for 2.0?

• Patent
• SBOM
• CBOM
• AI/ML
• Attestations (CDXA)
• ?

[stevespringett]

Since CycloneDX 2.0 will be the basis for the Insights API in TEA, TEA will be able to leverage the perspectives functionality in CycloneDX 2.0. This allows TEA admins to create requirements for what is acceptable, what is disallowed, etc. So although the spec is capable of patent information, a TEA instance would be able to communicate the perspectives it uses to the TEA consumer, so the consumer knows that patent information is simply not possible.

You can also apply the same things to SBOM, CBOM, CDXA, etc.

[stevespringett]

Refer to CycloneDX/specification#736

[oej]

Absolutely, but that is future. We may want to implement something in 1.0 to be able to filter before download?