Skip to content

Comments

Add comprehensive support for CycloneDX 1.7 specification#257

Open
alistair-mclean wants to merge 2 commits intoCycloneDX:masterfrom
alistair-mclean:feature/spec-1.7-support
Open

Add comprehensive support for CycloneDX 1.7 specification#257
alistair-mclean wants to merge 2 commits intoCycloneDX:masterfrom
alistair-mclean:feature/spec-1.7-support

Conversation

@alistair-mclean
Copy link
Contributor

@alistair-mclean alistair-mclean commented Feb 6, 2026

This implementation adds:

  • Citations for data provenance and attribution
  • Patent information and assertions
  • Enhanced Cryptography Bill of Materials (CBOM) features
  • Traffic Light Protocol (TLP) distribution constraints
  • IKEv2 transform types for protocol properties
  • Extended certificate lifecycle management
  • New cryptographic asset tracking capabilities

Breaking changes:

  • Default BOM version changed from 1.6 to 1.7
  • NewBOM() now creates version 1.7 BOMs by default

Changes by file:

cyclonedx.go:

  • Add SpecVersion1_7 constant
  • Add BOM.Citations field for data attribution
  • Add Component.IsExternal, Component.PatentAssertions, Component.VersionRange
  • Add Service.PatentAssertions field
  • Add Metadata.DistributionConstraints field
  • Add ExternalReference.Properties field
  • Enhance CertificateProperties with 11 new fields:
    • SerialNumber, CertificateFileExtension, Fingerprint
    • CertificateState, CertificateExtensions
    • RelatedCryptographicAssets
    • CreationDate, ActivationDate, DeactivationDate
    • RevocationDate, DestructionDate
  • Enhance CryptoAlgorithmProperties with AlgorithmFamily, EllipticCurve
  • Enhance RelatedCryptoMaterialProperties with Fingerprint, RelatedCryptographicAssets
  • Enhance CryptoProtocolProperties with RelatedCryptographicAssets
  • Enhance CipherSuite with TLSGroups, TLSSignatureSchemes
  • Add new types:
    • Citation (8 fields: BOMRef, Pointers, Expressions, Timestamp, AttributedTo, Process, Note, Signature)
    • Patent (14 fields: BOMRef, PatentNumber, ApplicationNumber, Jurisdiction, PriorityApplication, PublicationNumber, Title, Abstract, FilingDate, GrantDate, PatentExpirationDate, PatentLegalStatus, PatentAssignee, ExternalReferences)
    • PatentFamily (5 fields: BOMRef, FamilyID, PriorityApplication, Members, ExternalReferences)
    • PatentAssertion (5 fields: BOMRef, PatentRefs, AssertionType, Asserter, Notes)
    • PatentAssertionType with 8 enum values
    • DistributionConstraints with TLP field
    • TLPClassification with 5 levels (Clear, Green, Amber, Amber+Strict, Red)
    • RelatedCryptographicAsset (Type, Ref)
    • CertificateState with predefined and custom state support
    • CertificateStateType with 6 enum values (pre-activation, active, suspended, deactivated, revoked, destroyed)
    • CertificateExtension with predefined and custom extension support
    • CertificateExtensionName with 10 common extensions
    • IKEv2TransformTypes (Encr, PRF, Integ, KE, ESN, Auth)
    • IKEv2Auth, IKEv2Enc, IKEv2Integ, IKEv2Ke, IKEv2Prf structs
  • Add hash algorithms: HashAlgoStreebog256, HashAlgoStreebog512
  • Remove unused PatentLegalEvent type

cyclonedx_json.go:

  • Add SpecVersion1_7 to jsonSchemas map
  • Add 1.7 case to BOM.UnmarshalJSON

cyclonedx_xml.go:

  • Add SpecVersion1_7 to xmlNamespaces map
  • Add 1.7 case to BOM.UnmarshalXML

cyclonedx_string.go:

  • Regenerate with SpecVersion1_7 string representation

convert.go:

  • Add version conversion for BOM.Citations (< 1.7)
  • Add version conversion for Metadata.DistributionConstraints (< 1.7)
  • Add version conversion for Component.IsExternal, PatentAssertions, VersionRange (< 1.7)
  • Add version conversion for Service.PatentAssertions (< 1.7)
  • Add version conversion for ExternalReference.Properties (< 1.7)
  • Add convertCryptoProperties function for all CBOM 1.7 fields:
    • CryptoAlgorithmProperties.AlgorithmFamily, EllipticCurve
    • CertificateProperties (11 fields)
    • RelatedCryptoMaterialProperties.Fingerprint, RelatedCryptographicAssets
    • CryptoProtocolProperties.RelatedCryptographicAssets
    • CipherSuite.TLSGroups, TLSSignatureSchemes
  • Add hash algorithm version support for Streebog algorithms (>= 1.7)

example_test.go:

  • Update Example_encode expected output from 1.6 to 1.7 namespace

encode_test.go:

  • Update all test expectations from 1.6 to 1.7

Addresses issue #247

@alistair-mclean alistair-mclean requested a review from a team as a code owner February 6, 2026 14:43
Citations, Patents, enhanced CBOM capabilities, and all new 1.7 fields.

This implementation adds:
- Citations for data provenance and attribution
- Patent information and assertions
- Enhanced Cryptography Bill of Materials (CBOM) features
- Traffic Light Protocol (TLP) distribution constraints
- IKEv2 transform types for protocol properties
- Extended certificate lifecycle management
- New cryptographic asset tracking capabilities

Breaking changes:
- Default BOM version changed from 1.6 to 1.7
- NewBOM() now creates version 1.7 BOMs by default

Changes by file:

cyclonedx.go:
- Add SpecVersion1_7 constant
- Add BOM.Citations field for data attribution
- Add Component.IsExternal, Component.PatentAssertions, Component.VersionRange
- Add Service.PatentAssertions field
- Add Metadata.DistributionConstraints field
- Add ExternalReference.Properties field
- Enhance CertificateProperties with 11 new fields:
  * SerialNumber, CertificateFileExtension, Fingerprint
  * CertificateState, CertificateExtensions
  * RelatedCryptographicAssets
  * CreationDate, ActivationDate, DeactivationDate
  * RevocationDate, DestructionDate
- Enhance CryptoAlgorithmProperties with AlgorithmFamily, EllipticCurve
- Enhance RelatedCryptoMaterialProperties with Fingerprint, RelatedCryptographicAssets
- Enhance CryptoProtocolProperties with RelatedCryptographicAssets
- Enhance CipherSuite with TLSGroups, TLSSignatureSchemes
- Add new types:
  * Citation (8 fields: BOMRef, Pointers, Expressions, Timestamp, AttributedTo, Process, Note, Signature)
  * Patent (14 fields: BOMRef, PatentNumber, ApplicationNumber, Jurisdiction, PriorityApplication, PublicationNumber, Title, Abstract, FilingDate, GrantDate, PatentExpirationDate, PatentLegalStatus, PatentAssignee, ExternalReferences)
  * PatentFamily (5 fields: BOMRef, FamilyID, PriorityApplication, Members, ExternalReferences)
  * PatentAssertion (5 fields: BOMRef, PatentRefs, AssertionType, Asserter, Notes)
  * PatentAssertionType with 8 enum values
  * DistributionConstraints with TLP field
  * TLPClassification with 5 levels (Clear, Green, Amber, Amber+Strict, Red)
  * RelatedCryptographicAsset (Type, Ref)
  * CertificateState with predefined and custom state support
  * CertificateStateType with 6 enum values (pre-activation, active, suspended, deactivated, revoked, destroyed)
  * CertificateExtension with predefined and custom extension support
  * CertificateExtensionName with 10 common extensions
  * IKEv2TransformTypes (Encr, PRF, Integ, KE, ESN, Auth)
  * IKEv2Auth, IKEv2Enc, IKEv2Integ, IKEv2Ke, IKEv2Prf structs
- Add hash algorithms: HashAlgoStreebog256, HashAlgoStreebog512
- Remove unused PatentLegalEvent type

cyclonedx_json.go:
- Add SpecVersion1_7 to jsonSchemas map
- Add 1.7 case to BOM.UnmarshalJSON

cyclonedx_xml.go:
- Add SpecVersion1_7 to xmlNamespaces map
- Add 1.7 case to BOM.UnmarshalXML

cyclonedx_string.go:
- Regenerate with SpecVersion1_7 string representation

convert.go:
- Add version conversion for BOM.Citations (< 1.7)
- Add version conversion for Metadata.DistributionConstraints (< 1.7)
- Add version conversion for Component.IsExternal, PatentAssertions, VersionRange (< 1.7)
- Add version conversion for Service.PatentAssertions (< 1.7)
- Add version conversion for ExternalReference.Properties (< 1.7)
- Add convertCryptoProperties function for all CBOM 1.7 fields:
  * CryptoAlgorithmProperties.AlgorithmFamily, EllipticCurve
  * CertificateProperties (11 fields)
  * RelatedCryptoMaterialProperties.Fingerprint, RelatedCryptographicAssets
  * CryptoProtocolProperties.RelatedCryptographicAssets
  * CipherSuite.TLSGroups, TLSSignatureSchemes
- Add hash algorithm version support for Streebog algorithms (>= 1.7)

example_test.go:
- Update Example_encode expected output from 1.6 to 1.7 namespace

encode_test.go:
- Update all test expectations from 1.6 to 1.7

Signed-off-by: Alistair McLean <alistair.mclean@netrise.io>
@alistair-mclean alistair-mclean force-pushed the feature/spec-1.7-support branch from 3041de7 to d746214 Compare February 6, 2026 14:55
Signed-off-by: Alistair McLean <alistair.mclean@netrise.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant