Skip to content

Commit 35bf568

Browse files
jkowalleckjkowalleck
committed
Merge remote-tracking branch 'origin/1.7-dev' into 1.7-dev-cryptography
2 parents 3ba73d7 + c4f5402 commit 35bf568

File tree

59 files changed

+4732
-572
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+4732
-572
lines changed

‎README.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
[![Build Status](https://github.com/CycloneDX/specification/workflows/CI%20Build/badge.svg)](https://github.com/CycloneDX/specification/actions?workflow=CI+Build)
1+
[![Build Docs](https://github.com/CycloneDX/specification/actions/workflows/build_docs.yml/badge.svg)](https://github.com/CycloneDX/specification/actions/workflows/build_docs.yml)
2+
[![CT Java](https://github.com/CycloneDX/specification/actions/workflows/test_java.yml/badge.svg)](https://github.com/CycloneDX/specification/actions/workflows/test_java.yml)
3+
[![CT JavaScript](https://github.com/CycloneDX/specification/actions/workflows/test_js.yml/badge.svg)](https://github.com/CycloneDX/specification/actions/workflows/test_js.yml)
4+
[![CT PHP](https://github.com/CycloneDX/specification/actions/workflows/test_php.yml/badge.svg)](https://github.com/CycloneDX/specification/actions/workflows/test_php.yml)
5+
[![CT ProtoBuf](https://github.com/CycloneDX/specification/actions/workflows/test_proto.yml/badge.svg)](https://github.com/CycloneDX/specification/actions/workflows/test_proto.yml)
26
[![License][license-image]][license-url]
37
[![Website](https://img.shields.io/badge/https://-cyclonedx.org-blue.svg)](https://cyclonedx.org/)
48
[![Slack Invite](https://img.shields.io/badge/Slack-Join-blue?logo=slack&labelColor=393939)](https://cyclonedx.org/slack/invite)

‎schema/bom-1.7.proto‎

Lines changed: 379 additions & 97 deletions
Large diffs are not rendered by default.

‎schema/bom-1.7.schema.json‎

Lines changed: 721 additions & 225 deletions
Large diffs are not rendered by default.

‎schema/bom-1.7.xsd‎

Lines changed: 948 additions & 247 deletions
Large diffs are not rendered by default.

‎tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.json‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.6",
5+
"serialNumber": "urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42",
6+
"version": 1,
7+
"metadata": {
8+
"lifecycles": [{"phase": "design"}]
9+
},
10+
"components": [
11+
{
12+
"type": "library",
13+
"group": "com.example",
14+
"name": "situation-A",
15+
"version": "1",
16+
"description": "Multiple licenses: declared ids/names, and a concluded expression",
17+
"licenses": [
18+
{
19+
"license": {
20+
"id": "MIT",
21+
"acknowledgement": "declared"
22+
}
23+
},
24+
{
25+
"license": {
26+
"id": "PostgreSQL",
27+
"acknowledgement": "declared"
28+
}
29+
},
30+
{
31+
"license": {
32+
"name": "Apache Software License",
33+
"acknowledgement": "declared"
34+
}
35+
},
36+
{
37+
"expression": "(MIT OR PostgreSQL OR Apache-2.0)",
38+
"acknowledgement": "concluded"
39+
}
40+
]
41+
},
42+
{
43+
"type": "library",
44+
"group": "com.example",
45+
"name": "situation-B",
46+
"version": "1",
47+
"description": "Multiple license expressions: one declared, one concluded",
48+
"licenses": [
49+
{
50+
"expression": "MIT OR (GPL-3.0 OR GPL-2.0)",
51+
"acknowledgement": "declared"
52+
},
53+
{
54+
"expression": "(GPL-3.0-only AND LGPL-2.0-only)",
55+
"acknowledgement": "concluded"
56+
}
57+
]
58+
},
59+
{
60+
"type": "library",
61+
"group": "com.example",
62+
"name": "situation-C",
63+
"version": "1",
64+
"description": "Multiple license: one declared expression, one concluded id",
65+
"licenses": [
66+
{
67+
"expression": "GPL-3.0-or-later OR GPL-2.0",
68+
"acknowledgement": "declared"
69+
},
70+
{
71+
"license": {
72+
"id": "GPL-3.0-only",
73+
"acknowledgement": "concluded"
74+
}
75+
}
76+
]
77+
}
78+
]
79+
}

‎tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.xml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?xml version="1.0"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.6"
3+
serialNumber="urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42"
4+
>
5+
<!--
6+
All license posture in here is for show-case ony.
7+
This is not a real law-case!
8+
-->
9+
<metadata>
10+
<lifecycles><lifecycle><phase>design</phase></lifecycle></lifecycles>
11+
</metadata>
12+
<components>
13+
<component type="library">
14+
<group>com.example</group>
15+
<name>situation-A</name>
16+
<version>1</version>
17+
<description>Multiple licenses: declared ids/names, and a concluded expression</description>
18+
<licenses>
19+
<license acknowledgement="declared"><id>MIT</id></license>
20+
<license acknowledgement="declared"><id>PostgreSQL</id></license>
21+
<license acknowledgement="declared"><name>Apache Software License</name></license>
22+
<expression acknowledgement="concluded">(MIT OR PostgreSQL OR Apache-2.0)</expression>
23+
</licenses>
24+
</component>
25+
<component type="library">
26+
<group>com.example</group>
27+
<name>situation-B</name>
28+
<version>1</version>
29+
<description>Multiple license expressions: one declared, one concluded</description>
30+
<licenses>
31+
<expression acknowledgement="declared">MIT OR (GPL-3.0 OR GPL-2.0)</expression>
32+
<expression acknowledgement="concluded">(GPL-3.0-only AND LGPL-2.0-only)</expression>
33+
</licenses>
34+
</component>
35+
<component type="library">
36+
<group>com.example</group>
37+
<name>situation-C</name>
38+
<version>1</version>
39+
<description>Multiple license: one declared expression, one concluded id</description>
40+
<licenses>
41+
<expression acknowledgement="declared">GPL-3.0-or-later OR GPL-2.0</expression>
42+
<license acknowledgement="concluded"><id>GPL-3.0-only</id></license>
43+
</licenses>
44+
</component>
45+
</components>
46+
</bom>

‎tools/src/test/resources/1.7/informal-invalid-component-versionRange-non-external-explicit.xml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?xml version="1.0"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.7"
3+
serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1"
4+
>
5+
<!--
6+
this would be formal, if the support for XSD1.1's `assert` was properly implemented
7+
in validators and tools digesting XML.
8+
-->
9+
<components>
10+
<component type="library" isExternal="false">
11+
<name>InvalidVersions</name>
12+
<versionRange><![CDATA[vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1]]></versionRange>
13+
<description>versionRange may only exist on extraneous components, set `isExternal` explicit</description>
14+
</component>
15+
</components>
16+
</bom>

‎tools/src/test/resources/1.7/informal-invalid-component-versionRange-non-external-implicit.xml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?xml version="1.0"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.7"
3+
serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1"
4+
>
5+
<!--
6+
this would be formal, if the support for XSD1.1's `assert` was properly implemented
7+
in validators and tools digesting XML.
8+
-->
9+
<components>
10+
<component type="library">
11+
<!-- @isExternal defaults to `false` -->
12+
<name>InvalidVersions</name>
13+
<versionRange><![CDATA[vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1]]></versionRange>
14+
<description>versionRange may only exist on extraneous components, set `isExternal` implicit by default value</description>
15+
</component>
16+
</components>
17+
</bom>

‎tools/src/test/resources/1.7/invalid-citations-1.7.json‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.7",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"metadata": {
8+
"timestamp": "2025-05-01T14:23:00Z"
9+
},
10+
"components": [
11+
{
12+
"type": "library",
13+
"bom-ref": "component-1",
14+
"name": "example-lib",
15+
"version": "1.2.3",
16+
"licenses": [
17+
{
18+
"license": {
19+
"id": "Apache-2.0"
20+
}
21+
}
22+
]
23+
}
24+
],
25+
"citations": [
26+
{
27+
"bom-ref": "citation-1",
28+
"pointers": [ "/components/0/name" ],
29+
"timestamp": "2025-05-01T14:00:00Z",
30+
"note": "Should have at least one of the following property sets: property 'attributedTo' or property 'process'"
31+
},
32+
{
33+
"bom-ref": "citation-1",
34+
"pointers": [ "/components/0/name" ],
35+
"expressions": [ "$..[?(@.bom-ref=='component-1')].version" ],
36+
"timestamp": "2025-05-01T14:00:00Z",
37+
"note": "Should not have both a pointer and expression."
38+
}
39+
]
40+
}

‎tools/src/test/resources/1.7/invalid-citations-1.7.textproto‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# proto-file: schema/bom-1.7.proto
2+
# proto-message: Bom
3+
4+
spec_version: "1.7"
5+
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
6+
version: 1
7+
8+
metadata {
9+
timestamp {
10+
seconds: 1754424907
11+
nanos: 0
12+
}
13+
}
14+
15+
components {
16+
type: CLASSIFICATION_LIBRARY
17+
bom_ref: "component-1"
18+
name: "example-lib"
19+
version: "1.2.3"
20+
licenses {
21+
license {
22+
id: "Apache-2.0"
23+
}
24+
}
25+
}
26+
27+
## !! NO formal check possible
28+
#citations {
29+
# bom_ref: "citation-1"
30+
# pointers: { pointer: "/components/0/name" }
31+
# timestamp {
32+
# seconds: 1746108000
33+
# nanos: 0
34+
# }
35+
# note: "Should have at least one of the following property sets: property 'attributedTo' or property 'process'"
36+
#}
37+
38+
39+
citations {
40+
bom_ref: "citation-1"
41+
pointers: { pointer: "/components/0/name" }
42+
expressions: { expression: "$..[?(bom_ref=='component-1')].version" }
43+
timestamp {
44+
seconds: 1746108000
45+
nanos: 0
46+
}
47+
note: "Should not have both a pointer and expression."
48+
}

0 commit comments

Comments
 (0)