Skip to content

Commit 6771127

Browse files
stevespringettstevespringett
authored
Merge pull request #199 from CycloneDX/v1.5-dev-evidence
Added identity and occurrences to evidence. Updated test cases.
2 parents 30b1d70 + d294a99 commit 6771127

File tree

6 files changed

+638
-1
lines changed

6 files changed

+638
-1
lines changed

‎schema/bom-1.5.proto‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -576,6 +576,82 @@ message EvidenceCopyright {
576576
message Evidence {
577577
repeated LicenseChoice licenses = 1;
578578
repeated EvidenceCopyright copyright = 2;
579+
repeated EvidenceIdentity identity = 3;
580+
repeated EvidenceOccurrences occurrences = 4;
581+
optional Callstack callstack = 5;
582+
}
583+
584+
// Evidence of the components use through the callstack.
585+
message Callstack {
586+
repeated Frames frames = 1;
587+
588+
message Frames {
589+
// A package organizes modules into namespaces, providing a unique namespace for each type it contains.
590+
optional string package = 1;
591+
// A module or class that encloses functions/methods and other code.
592+
string module = 2;
593+
// A block of code designed to perform a particular task.
594+
optional string function = 3;
595+
// Optional arguments that are passed to the module or function.
596+
repeated string parameters = 4;
597+
// The line number the code that is called resides on.
598+
optional int32 line = 5;
599+
// The column the code that is called resides.
600+
optional int32 column = 6;
601+
// The full path and filename of the module.
602+
optional string fullFilename = 7;
603+
}
604+
}
605+
606+
message EvidenceIdentity {
607+
// The identity field of the component which the evidence describes.
608+
EvidenceFieldType field = 1;
609+
// The overall confidence of the evidence from 0 - 1, where 1 is 100% confidence.
610+
optional float confidence = 2;
611+
// The methods used to extract and/or analyze the evidence.
612+
repeated EvidenceMethods methods = 3;
613+
// The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs. Tools used for analysis should already be defined in the BOM, either in the metadata/tools, components, or formulation.
614+
repeated string tools = 4;
615+
}
616+
617+
message EvidenceMethods {
618+
// The technique used in this method of analysis.
619+
EvidenceTechnique technique = 1;
620+
// The confidence of the evidence from 0 - 1, where 1 is 100% confidence. Confidence is specific to the technique used. Each technique of analysis can have independent confidence.
621+
float confidence = 2;
622+
// The value or contents of the evidence.
623+
optional string value = 3;
624+
}
625+
626+
message EvidenceOccurrences {
627+
// An optional identifier which can be used to reference the occurrence elsewhere in the BOM. Every bom-ref MUST be unique within the BOM.
628+
optional string bom_ref = 1;
629+
// The location or path to where the component was found.
630+
string location = 2;
631+
}
632+
633+
enum EvidenceFieldType {
634+
EVIDENCE_FIELD_NULL = 0;
635+
EVIDENCE_FIELD_GROUP = 1;
636+
EVIDENCE_FIELD_NAME = 2;
637+
EVIDENCE_FIELD_VERSION = 3;
638+
EVIDENCE_FIELD_PURL = 4;
639+
EVIDENCE_FIELD_CPE = 5;
640+
EVIDENCE_FIELD_SWID = 6;
641+
EVIDENCE_FIELD_HASH = 7;
642+
}
643+
644+
enum EvidenceTechnique {
645+
EVIDENCE_TECHNIQUE_SOURCE_CODE_ANALYSIS = 0;
646+
EVIDENCE_TECHNIQUE_BINARY_ANALYSIS = 1;
647+
EVIDENCE_TECHNIQUE_MANIFEST_ANALYSIS = 2;
648+
EVIDENCE_TECHNIQUE_AST_FINGERPRINT = 3;
649+
EVIDENCE_TECHNIQUE_HASH_COMPARISON = 4;
650+
EVIDENCE_TECHNIQUE_INSTRUMENTATION = 5;
651+
EVIDENCE_TECHNIQUE_DYNAMIC_ANALYSIS = 6;
652+
EVIDENCE_TECHNIQUE_FILENAME = 7;
653+
EVIDENCE_TECHNIQUE_ATTESTATION = 8;
654+
EVIDENCE_TECHNIQUE_OTHER = 9;
579655
}
580656

581657
message Note {

‎schema/bom-1.5.schema.json‎

Lines changed: 160 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1323,13 +1323,172 @@
13231323
}
13241324
}
13251325
},
1326-
13271326
"componentEvidence": {
13281327
"type": "object",
13291328
"title": "Evidence",
13301329
"description": "Provides the ability to document evidence collected through various forms of extraction or analysis.",
13311330
"additionalProperties": false,
13321331
"properties": {
1332+
"identity": {
1333+
"type": "object",
1334+
"description": "Evidence that substantiates the identity of a component.",
1335+
"required": [ "field" ],
1336+
"additionalProperties": false,
1337+
"properties": {
1338+
"field": {
1339+
"type": "string",
1340+
"enum": [
1341+
"group", "name", "version", "purl", "cpe", "swid", "hash"
1342+
],
1343+
"title": "Field",
1344+
"description": "The identity field of the component which the evidence describes."
1345+
},
1346+
"confidence": {
1347+
"type": "number",
1348+
"minimum": 0,
1349+
"maximum": 1,
1350+
"title": "Confidence",
1351+
"description": "The overall confidence of the evidence from 0 - 1, where 1 is 100% confidence."
1352+
},
1353+
"methods": {
1354+
"type": "array",
1355+
"title": "Methods",
1356+
"description": "The methods used to extract and/or analyze the evidence.",
1357+
"additionalItems": false,
1358+
"items": {
1359+
"type": "object",
1360+
"required": [
1361+
"technique" ,
1362+
"confidence"
1363+
],
1364+
"additionalProperties": false,
1365+
"properties": {
1366+
"technique": {
1367+
"title": "Technique",
1368+
"description": "The technique used in this method of analysis.",
1369+
"type": "string",
1370+
"enum": [
1371+
"source-code-analysis",
1372+
"binary-analysis",
1373+
"manifest-analysis",
1374+
"ast-fingerprint",
1375+
"hash-comparison",
1376+
"instrumentation",
1377+
"dynamic-analysis",
1378+
"filename",
1379+
"attestation",
1380+
"other"
1381+
]
1382+
},
1383+
"confidence": {
1384+
"type": "number",
1385+
"minimum": 0,
1386+
"maximum": 1,
1387+
"title": "Confidence",
1388+
"description": "The confidence of the evidence from 0 - 1, where 1 is 100% confidence. Confidence is specific to the technique used. Each technique of analysis can have independent confidence."
1389+
},
1390+
"value": {
1391+
"type": "string",
1392+
"title": "Value",
1393+
"description": "The value or contents of the evidence."
1394+
}
1395+
}
1396+
}
1397+
},
1398+
"tools": {
1399+
"type": "array",
1400+
"uniqueItems": true,
1401+
"additionalItems": false,
1402+
"items": {
1403+
"$ref": "#/definitions/refType"
1404+
},
1405+
"title": "BOM References",
1406+
"description": "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs. Tools used for analysis should already be defined in the BOM, either in the metadata/tools, components, or formulation."
1407+
}
1408+
}
1409+
},
1410+
"occurrences": {
1411+
"type": "array",
1412+
"title": "Occurrences",
1413+
"description": "Evidence of individual instances of a component spread across multiple locations.",
1414+
"additionalItems": false,
1415+
"items": {
1416+
"required": [ "location" ],
1417+
"additionalProperties": false,
1418+
"properties": {
1419+
"bom-ref": {
1420+
"$ref": "#/definitions/refType",
1421+
"title": "BOM Reference",
1422+
"description": "An optional identifier which can be used to reference the occurrence elsewhere in the BOM. Every bom-ref MUST be unique within the BOM."
1423+
},
1424+
"location": {
1425+
"type": "string",
1426+
"title": "Location",
1427+
"description": "The location or path to where the component was found."
1428+
}
1429+
}
1430+
}
1431+
},
1432+
"callstack": {
1433+
"type": "object",
1434+
"description": "Evidence of the components use through the callstack.",
1435+
"additionalProperties": false,
1436+
"properties": {
1437+
"frames": {
1438+
"type": "array",
1439+
"title": "Methods",
1440+
"additionalItems": false,
1441+
"items": {
1442+
"type": "object",
1443+
"required": [
1444+
"module"
1445+
],
1446+
"additionalProperties": false,
1447+
"properties": {
1448+
"package": {
1449+
"title": "Package",
1450+
"description": "A package organizes modules into namespaces, providing a unique namespace for each type it contains.",
1451+
"type": "string"
1452+
},
1453+
"module": {
1454+
"title": "Module",
1455+
"description": "A module or class that encloses functions/methods and other code.",
1456+
"type": "string"
1457+
},
1458+
"function": {
1459+
"title": "Function",
1460+
"description": "A block of code designed to perform a particular task.",
1461+
"type": "string"
1462+
},
1463+
"parameters": {
1464+
"title": "Parameters",
1465+
"description": "Optional arguments that are passed to the module or function.",
1466+
"type": "array",
1467+
"additionalItems": false,
1468+
"items": {
1469+
"type": "string"
1470+
}
1471+
},
1472+
"line": {
1473+
"title": "Line",
1474+
"description": "The line number the code that is called resides on.",
1475+
"type": "integer"
1476+
},
1477+
"column": {
1478+
"title": "Column",
1479+
"description": "The column the code that is called resides.",
1480+
"type": "integer"
1481+
},
1482+
"fullFilename": {
1483+
"title": "Full Filename",
1484+
"description": "The full path and filename of the module.",
1485+
"type": "string"
1486+
}
1487+
}
1488+
}
1489+
}
1490+
}
1491+
},
13331492
"licenses": {
13341493
"type": "array",
13351494
"additionalItems": false,

0 commit comments

Comments
 (0)