Skip to content

Commit 9847c91

Browse files
stevespringettstevespringett
authored
Merge pull request #213 from CycloneDX/v1.5-dev-lifecycle
Added lifecycle support
2 parents 6fc0585 + 0bae0a7 commit 9847c91

File tree

6 files changed

+254
-35
lines changed

6 files changed

+254
-35
lines changed

‎schema/bom-1.5.proto‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -416,6 +416,36 @@ message Metadata {
416416
optional LicenseChoice licenses = 7;
417417
// Specifies optional, custom, properties
418418
repeated Property properties = 8;
419+
// The product lifecycle(s) that this BOM represents.
420+
repeated Lifecycles lifecycles = 9;
421+
}
422+
423+
message Lifecycles {
424+
oneof choice {
425+
// A pre-defined phase in the product lifecycle.
426+
LifecyclePhase phase = 1;
427+
// The name of the lifecycle phase
428+
string name = 2;
429+
}
430+
// The description of the lifecycle phase
431+
optional string description = 2;
432+
}
433+
434+
enum LifecyclePhase {
435+
// BOM produced early in the development lifecycle containing inventory of components and services that are proposed or planned to be used. The inventory may need to be procured, retrieved, or resourced prior to use.
436+
LIFECYCLE_PHASE_DESIGN = 0;
437+
// BOM consisting of information obtained prior to a build process and may contain source files and development artifacts and manifests. The inventory may need to be resolved and retrieved prior to use.
438+
LIFECYCLE_PHASE_PRE_BUILD = 1;
439+
// BOM consisting of information obtained during a build process where component inventory is available for use. The precise versions of resolved components are usually available at this time as well as the provenance of where the components were retrieved from.
440+
LIFECYCLE_PHASE_BUILD = 2;
441+
// BOM consisting of information obtained after a build process has completed and the resulting components(s) are available for further analysis. Built components may exist as the result of a CI/CD process, may have been installed or deployed to a system or device, and may need to be retrieved or extracted from the system or device.
442+
LIFECYCLE_PHASE_POST_BUILD = 3;
443+
// BOM produced that represents inventory that is running and operational. This may include staging or production environments and will generally encompass multiple SBOMs describing the applications and operating system, along with HBOMs describing the hardware that makes up the system. Operations Bill of Materials (OBOM) can provide full-stack inventory of runtime environments, configurations, and additional dependencies.
444+
LIFECYCLE_PHASE_OPERATIONS = 4;
445+
// BOM consisting of information observed through network discovery providing point-in-time enumeration of embedded, on-premise, and cloud-native services such as server applications, connected devices, microservices, and serverless functions.
446+
LIFECYCLE_PHASE_DISCOVERY = 5;
447+
// BOM containing inventory that will be, or has been retired from operations.
448+
LIFECYCLE_PHASE_DECOMMISSION = 6;
419449
}
420450

421451
message OrganizationalContact {

‎schema/bom-1.5.schema.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,56 @@
136136
"title": "Timestamp",
137137
"description": "The date and time (timestamp) when the BOM was created."
138138
},
139+
"lifecycles": {
140+
"type": "array",
141+
"title": "Lifecycles",
142+
"description": "",
143+
"additionalItems": false,
144+
"items": {
145+
"type": "object",
146+
"title": "Lifecycle",
147+
"description": "The product lifecycle(s) that this BOM represents.",
148+
"additionalProperties": false,
149+
"oneOf": [
150+
{
151+
"required": ["phase"],
152+
"additionalProperties": false,
153+
"properties": {
154+
"phase": {
155+
"type": "string",
156+
"title": "Phase",
157+
"description": "A pre-defined phase in the product lifecycle.\n\n* __design__ = BOM produced early in the development lifecycle containing inventory of components and services that are proposed or planned to be used. The inventory may need to be procured, retrieved, or resourced prior to use.\n* __pre-build__ = BOM consisting of information obtained prior to a build process and may contain source files and development artifacts and manifests. The inventory may need to be resolved and retrieved prior to use.\n* __build__ = BOM consisting of information obtained during a build process where component inventory is available for use. The precise versions of resolved components are usually available at this time as well as the provenance of where the components were retrieved from.\n* __post-build__ = BOM consisting of information obtained after a build process has completed and the resulting components(s) are available for further analysis. Built components may exist as the result of a CI/CD process, may have been installed or deployed to a system or device, and may need to be retrieved or extracted from the system or device.\n* __operations__ = BOM produced that represents inventory that is running and operational. This may include staging or production environments and will generally encompass multiple SBOMs describing the applications and operating system, along with HBOMs describing the hardware that makes up the system. Operations Bill of Materials (OBOM) can provide full-stack inventory of runtime environments, configurations, and additional dependencies.\n* __discovery__ = BOM consisting of information observed through network discovery providing point-in-time enumeration of embedded, on-premise, and cloud-native services such as server applications, connected devices, microservices, and serverless functions.\n* __decommission__ = BOM containing inventory that will be, or has been retired from operations.",
158+
"enum": [
159+
"design",
160+
"pre-build",
161+
"build",
162+
"post-build",
163+
"operations",
164+
"discovery",
165+
"decommission"
166+
]
167+
}
168+
}
169+
},
170+
{
171+
"required": ["name"],
172+
"additionalProperties": false,
173+
"properties": {
174+
"name": {
175+
"type": "string",
176+
"title": "Name",
177+
"description": "The name of the lifecycle phase"
178+
},
179+
"description": {
180+
"type": "string",
181+
"title": "Description",
182+
"description": "The description of the lifecycle phase"
183+
}
184+
}
185+
}
186+
]
187+
}
188+
},
139189
"tools": {
140190
"oneOf": [
141191
{

‎schema/bom-1.5.xsd‎

Lines changed: 118 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,48 @@ limitations under the License.
4949
<xs:documentation>The date and time (timestamp) when the BOM was created.</xs:documentation>
5050
</xs:annotation>
5151
</xs:element>
52+
<xs:element name="lifecycles" minOccurs="0" maxOccurs="1">
53+
<xs:annotation>
54+
<xs:documentation>
55+
The product lifecycle(s) that this BOM represents.
56+
</xs:documentation>
57+
</xs:annotation>
58+
<xs:complexType>
59+
<xs:sequence>
60+
<xs:element name="lifecycle" minOccurs="0" maxOccurs="unbounded">
61+
<xs:complexType>
62+
<xs:choice>
63+
<xs:sequence>
64+
<xs:element name="phase" type="bom:lifecyclePhaseType" minOccurs="1" maxOccurs="1">
65+
<xs:annotation>
66+
<xs:documentation>
67+
A pre-defined phase in the product lifecycle.
68+
</xs:documentation>
69+
</xs:annotation>
70+
</xs:element>
71+
</xs:sequence>
72+
<xs:sequence>
73+
<xs:element name="name" type="xs:normalizedString" minOccurs="1" maxOccurs="1">
74+
<xs:annotation>
75+
<xs:documentation>
76+
The name of the lifecycle phase
77+
</xs:documentation>
78+
</xs:annotation>
79+
</xs:element>
80+
<xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1">
81+
<xs:annotation>
82+
<xs:documentation>
83+
The description of the lifecycle phase
84+
</xs:documentation>
85+
</xs:annotation>
86+
</xs:element>
87+
</xs:sequence>
88+
</xs:choice>
89+
</xs:complexType>
90+
</xs:element>
91+
</xs:sequence>
92+
</xs:complexType>
93+
</xs:element>
5294
<xs:element name="tools" minOccurs="0" maxOccurs="1">
5395
<xs:annotation>
5496
<xs:documentation>The tool(s) used in the creation of the BOM.</xs:documentation>
@@ -131,6 +173,75 @@ limitations under the License.
131173
</xs:anyAttribute>
132174
</xs:complexType>
133175

176+
<xs:simpleType name="lifecyclePhaseType">
177+
<xs:restriction base="xs:string">
178+
<xs:enumeration value="design">
179+
<xs:annotation>
180+
<xs:documentation>
181+
BOM produced early in the development lifecycle containing inventory of components and services
182+
that are proposed or planned to be used. The inventory may need to be procured, retrieved,
183+
or resourced prior to use.
184+
</xs:documentation>
185+
</xs:annotation>
186+
</xs:enumeration>
187+
<xs:enumeration value="pre-build">
188+
<xs:annotation>
189+
<xs:documentation>
190+
BOM consisting of information obtained prior to a build process and may contain source files
191+
and development artifacts and manifests. The inventory may need to be resolved and retrieved
192+
prior to use.
193+
</xs:documentation>
194+
</xs:annotation>
195+
</xs:enumeration>
196+
<xs:enumeration value="build">
197+
<xs:annotation>
198+
<xs:documentation>
199+
BOM consisting of information obtained during a build process where component inventory is
200+
available for use. The precise versions of resolved components are usually available at this
201+
time as well as the provenance of where the components were retrieved from.
202+
</xs:documentation>
203+
</xs:annotation>
204+
</xs:enumeration>
205+
<xs:enumeration value="post-build">
206+
<xs:annotation>
207+
<xs:documentation>
208+
BOM consisting of information obtained after a build process has completed and the resulting
209+
components(s) are available for further analysis. Built components may exist as the result of a
210+
CI/CD process, may have been installed or deployed to a system or device, and may need to be
211+
retrieved or extracted from the system or device.
212+
</xs:documentation>
213+
</xs:annotation>
214+
</xs:enumeration>
215+
<xs:enumeration value="operations">
216+
<xs:annotation>
217+
<xs:documentation>
218+
BOM produced that represents inventory that is running and operational. This may include staging
219+
or production environments and will generally encompass multiple SBOMs describing the applications
220+
and operating system, along with HBOMs describing the hardware that makes up the system. Operations
221+
Bill of Materials (OBOM) can provide full-stack inventory of runtime environments, configurations,
222+
and additional dependencies.
223+
</xs:documentation>
224+
</xs:annotation>
225+
</xs:enumeration>
226+
<xs:enumeration value="discovery">
227+
<xs:annotation>
228+
<xs:documentation>
229+
BOM consisting of information observed through network discovery providing point-in-time
230+
enumeration of embedded, on-premise, and cloud-native services such as server applications,
231+
connected devices, microservices, and serverless functions.
232+
</xs:documentation>
233+
</xs:annotation>
234+
</xs:enumeration>
235+
<xs:enumeration value="decommission">
236+
<xs:annotation>
237+
<xs:documentation>
238+
BOM containing inventory that will be, or has been retired from operations.
239+
</xs:documentation>
240+
</xs:annotation>
241+
</xs:enumeration>
242+
</xs:restriction>
243+
</xs:simpleType>
244+
134245
<xs:complexType name="organizationalEntity">
135246
<xs:sequence minOccurs="0" maxOccurs="1">
136247
<xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1">
@@ -1867,41 +1978,13 @@ limitations under the License.
18671978

18681979
<xs:simpleType name="identityFieldType">
18691980
<xs:restriction base="xs:string">
1870-
<xs:enumeration value="group">
1871-
<xs:annotation>
1872-
<xs:documentation>blah</xs:documentation>
1873-
</xs:annotation>
1874-
</xs:enumeration>
1875-
<xs:enumeration value="name">
1876-
<xs:annotation>
1877-
<xs:documentation>blah</xs:documentation>
1878-
</xs:annotation>
1879-
</xs:enumeration>
1880-
<xs:enumeration value="version">
1881-
<xs:annotation>
1882-
<xs:documentation>blah</xs:documentation>
1883-
</xs:annotation>
1884-
</xs:enumeration>
1885-
<xs:enumeration value="purl">
1886-
<xs:annotation>
1887-
<xs:documentation>blah</xs:documentation>
1888-
</xs:annotation>
1889-
</xs:enumeration>
1890-
<xs:enumeration value="cpe">
1891-
<xs:annotation>
1892-
<xs:documentation>blah</xs:documentation>
1893-
</xs:annotation>
1894-
</xs:enumeration>
1895-
<xs:enumeration value="swid">
1896-
<xs:annotation>
1897-
<xs:documentation>blah</xs:documentation>
1898-
</xs:annotation>
1899-
</xs:enumeration>
1900-
<xs:enumeration value="hash">
1901-
<xs:annotation>
1902-
<xs:documentation>blah</xs:documentation>
1903-
</xs:annotation>
1904-
</xs:enumeration>
1981+
<xs:enumeration value="group"/>
1982+
<xs:enumeration value="name"/>
1983+
<xs:enumeration value="version"/>
1984+
<xs:enumeration value="purl"/>
1985+
<xs:enumeration value="cpe"/>
1986+
<xs:enumeration value="swid"/>
1987+
<xs:enumeration value="hash"/>
19051988
</xs:restriction>
19061989
</xs:simpleType>
19071990

‎tools/src/test/resources/1.5/valid-metadata-lifecycle-1.5.json‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.5",
4+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
5+
"version": 1,
6+
"metadata": {
7+
"lifecycles": [
8+
{
9+
"phase": "build"
10+
},
11+
{
12+
"phase": "post-build"
13+
},
14+
{
15+
"name": "platform-integration-testing",
16+
"description": "Integration testing specific to the runtime platform"
17+
}
18+
]
19+
},
20+
"components": []
21+
}

‎tools/src/test/resources/1.5/valid-metadata-lifecycle-1.5.textproto‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
spec_version: "1.5"
2+
version: 1
3+
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
4+
metadata {
5+
lifecycles [
6+
{
7+
phase: LIFECYCLE_PHASE_BUILD
8+
},
9+
{
10+
phase: LIFECYCLE_PHASE_POST_BUILD
11+
},
12+
{
13+
name: "platform-integration-testing"
14+
description: "Integration testing specific to the runtime platform"
15+
}
16+
]
17+
}

‎tools/src/test/resources/1.5/valid-metadata-lifecycle-1.5.xml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0"?>
2+
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.5">
3+
<metadata>
4+
<lifecycles>
5+
<lifecycle>
6+
<phase>build</phase>
7+
</lifecycle>
8+
<lifecycle>
9+
<phase>post-build</phase>
10+
</lifecycle>
11+
<lifecycle>
12+
<name>platform-integration-testing</name>
13+
<description>Integration testing specific to the runtime platform</description>
14+
</lifecycle>
15+
</lifecycles>
16+
</metadata>
17+
<components />
18+
</bom>

0 commit comments

Comments
 (0)