Skip to content

Commit a17b6e6

Browse files
jkowalleckjkowalleck
committed
Merge remote-tracking branch 'origin/1.7-dev' into feat/licenses/acknowledgement-should-be-unique
2 parents cdb4f48 + e95af17 commit a17b6e6

11 files changed

+704
-44
lines changed

‎schema/bom-1.7.proto‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,8 @@ enum Classification {
6666
CLASSIFICATION_FIRMWARE = 8;
6767
// A special type of software that operates or controls a particular type of device. Refer to https://en.wikipedia.org/wiki/Device_driver
6868
CLASSIFICATION_DEVICE_DRIVER = 9;
69-
// A runtime environment which interprets or executes software. This may include runtimes such as those that execute bytecode or low-code/no-code application platforms.
69+
// A runtime environment that interprets or executes software.
70+
// This may include runtimes such as those that execute bytecode, just-in-time compilers, interpreters, or low-code/no-code application platforms.
7071
CLASSIFICATION_PLATFORM = 10;
7172
// A model based on training data that can make predictions or decisions without being explicitly programmed to do so.
7273
CLASSIFICATION_MACHINE_LEARNING_MODEL = 11;
@@ -122,7 +123,7 @@ message Component {
122123
optional Scope scope = 11;
123124
// The hashes of the component.
124125
repeated Hash hashes = 12;
125-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression).
126+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
126127
// There should be no more than one per license acknowledgement.
127128
repeated LicenseChoice licenses = 13;
128129
// An optional copyright notice informing users of the underlying claims to copyright ownership in a published work.
@@ -573,6 +574,7 @@ message Metadata {
573574
// The organization that supplied the component that the BOM describes. The supplier may often be the manufacture, but may also be a distributor or repackager.
574575
optional OrganizationalEntity supplier = 6;
575576
// The license information for the BOM document. This may be different from the license(s) of the component(s) that the BOM describes.
577+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
576578
// There should be no more than one per license acknowledgement.
577579
repeated LicenseChoice licenses = 7;
578580
// Specifies optional, custom, properties
@@ -710,7 +712,7 @@ message Service {
710712
optional bool x_trust_boundary = 9;
711713
// Specifies information about the data including the directional flow of data and the data classification.
712714
repeated DataFlow data = 10;
713-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression).
715+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
714716
// There should be no more than one per license acknowledgement.
715717
repeated LicenseChoice licenses = 11;
716718
// Provides the ability to document external references related to the service.
@@ -833,7 +835,7 @@ message EvidenceCopyright {
833835

834836
// Provides the ability to document evidence collected through various forms of extraction or analysis.
835837
message Evidence {
836-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression).
838+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
837839
// There should be no license acknowledgement assigned to any of these.
838840
repeated LicenseChoice licenses = 1;
839841
// Copyright evidence captures intellectual property assertions, providing evidence of possible ownership and legal protection.

‎schema/bom-1.7.schema.json‎

Lines changed: 28 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -888,7 +888,7 @@
888888
"framework": "A software framework. Refer to [https://en.wikipedia.org/wiki/Software_framework](https://en.wikipedia.org/wiki/Software_framework) for information on how frameworks vary slightly from libraries.",
889889
"library": "A software library. Refer to [https://en.wikipedia.org/wiki/Library_(computing)](https://en.wikipedia.org/wiki/Library_(computing)) for information about libraries. All third-party and open source reusable components will likely be a library. If the library also has key features of a framework, then it should be classified as a framework. If not, or is unknown, then specifying library is recommended.",
890890
"container": "A packaging and/or runtime format, not specific to any particular technology, which isolates software inside the container from software outside of a container through virtualization technology. Refer to [https://en.wikipedia.org/wiki/OS-level_virtualization](https://en.wikipedia.org/wiki/OS-level_virtualization).",
891-
"platform": "A runtime environment which interprets or executes software. This may include runtimes such as those that execute bytecode or low-code/no-code application platforms.",
891+
"platform": "A runtime environment that interprets or executes software. This may include runtimes such as those that execute bytecode, just-in-time compilers, interpreters, or low-code/no-code application platforms.",
892892
"operating-system": "A software operating system without regard to deployment model (i.e. installed on physical hardware, virtual machine, image, etc) Refer to [https://en.wikipedia.org/wiki/Operating_system](https://en.wikipedia.org/wiki/Operating_system).",
893893
"device": "A hardware device such as a processor or chip-set. A hardware device containing firmware SHOULD include a component for the physical hardware itself and another component of type 'firmware' or 'operating-system' (whichever is relevant), describing information about the software running on the device. See also the list of [known device properties](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md).",
894894
"device-driver": "A special type of software that operates or controls a particular type of device. Refer to [https://en.wikipedia.org/wiki/Device_driver](https://en.wikipedia.org/wiki/Device_driver).",
@@ -1526,36 +1526,31 @@
15261526
},
15271527
"licenseChoice": {
15281528
"title": "License Choice",
1529-
"description": "EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)",
1529+
"description": "A list of SPDX licenses and/or named licenses and/or SPDX License Expression.",
15301530
"type": "array",
1531-
"oneOf": [
1532-
{
1533-
"title": "Multiple licenses",
1534-
"description": "A list of SPDX licenses and/or named licenses.",
1535-
"type": "array",
1536-
"items": {
1531+
"items": {
1532+
"oneOf": [
1533+
{
15371534
"type": "object",
15381535
"title": "License",
1539-
"required": ["license"],
1536+
"required": [
1537+
"license"
1538+
],
15401539
"additionalProperties": false,
15411540
"properties": {
1542-
"license": {"$ref": "#/definitions/license"}
1541+
"license": {
1542+
"$ref": "#/definitions/license"
1543+
}
15431544
}
1544-
}
1545-
},
1546-
{
1547-
"title": "SPDX License Expression",
1548-
"description": "A tuple of exactly one SPDX License Expression.",
1549-
"type": "array",
1550-
"additionalItems": false,
1551-
"minItems": 1,
1552-
"maxItems": 1,
1553-
"items": [{
1545+
},
1546+
{
15541547
"title": "License Expression",
15551548
"description": "Specifies the details and attributes related to a software license.\nIt must be a valid SPDX license expression, along with additional properties such as license acknowledgment.",
15561549
"type": "object",
15571550
"additionalProperties": false,
1558-
"required": ["expression"],
1551+
"required": [
1552+
"expression"
1553+
],
15591554
"properties": {
15601555
"expression": {
15611556
"type": "string",
@@ -1601,7 +1596,9 @@
16011596
"type": "string",
16021597
"title": "License URL",
16031598
"description": "The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness",
1604-
"examples": ["https://www.apache.org/licenses/LICENSE-2.0.txt"],
1599+
"examples": [
1600+
"https://www.apache.org/licenses/LICENSE-2.0.txt"
1601+
],
16051602
"format": "iri-reference"
16061603
}
16071604
},
@@ -1616,17 +1613,21 @@
16161613
"title": "BOM Reference",
16171614
"description": "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
16181615
},
1619-
"licensing": {"$ref": "#/definitions/licensing"},
1616+
"licensing": {
1617+
"$ref": "#/definitions/licensing"
1618+
},
16201619
"properties": {
16211620
"type": "array",
16221621
"title": "Properties",
16231622
"description": "Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.",
1624-
"items": {"$ref": "#/definitions/property"}
1623+
"items": {
1624+
"$ref": "#/definitions/property"
1625+
}
16251626
}
16261627
}
1627-
}]
1628-
}
1629-
]
1628+
}
1629+
]
1630+
}
16301631
},
16311632
"commit": {
16321633
"type": "object",

‎schema/bom-1.7.xsd‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1287,8 +1287,11 @@ limitations under the License.
12871287
</xs:enumeration>
12881288
<xs:enumeration value="platform">
12891289
<xs:annotation>
1290-
<xs:documentation>A runtime environment which interprets or executes software. This may include
1291-
runtimes such as those that execute bytecode or low-code/no-code application platforms.</xs:documentation>
1290+
<xs:documentation>
1291+
A runtime environment that interprets or executes software.
1292+
This may include runtimes such as those that execute bytecode, just-in-time compilers,
1293+
interpreters, or low-code/no-code application platforms.
1294+
</xs:documentation>
12921295
</xs:annotation>
12931296
</xs:enumeration>
12941297
<xs:enumeration value="operating-system">
@@ -2568,10 +2571,13 @@ limitations under the License.
25682571
</xs:simpleType>
25692572

25702573
<xs:complexType name="licenseChoiceType">
2571-
<xs:choice>
2572-
<xs:element name="license" type="bom:licenseType" minOccurs="0" maxOccurs="unbounded"/>
2573-
<xs:element name="expression" type="bom:licenseExpressionType" minOccurs="0" maxOccurs="1" />
2574-
<xs:element name="expression-detailed" type="bom:licenseExpressionDetailedType" minOccurs="0" maxOccurs="1" />
2574+
<xs:annotation>
2575+
<xs:documentation>A list of SPDX licenses and/or named licenses and/or SPDX License Expression.</xs:documentation>
2576+
</xs:annotation>
2577+
<xs:choice minOccurs="0" maxOccurs="unbounded">
2578+
<xs:element name="license" type="bom:licenseType"/>
2579+
<xs:element name="expression" type="bom:licenseExpressionType"/>
2580+
<xs:element name="expression-detailed" type="bom:licenseExpressionDetailedType"/>
25752581
</xs:choice>
25762582
</xs:complexType>
25772583

‎tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.json‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.6",
5+
"serialNumber": "urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42",
6+
"version": 1,
7+
"metadata": {
8+
"lifecycles": [{"phase": "design"}]
9+
},
10+
"components": [
11+
{
12+
"type": "library",
13+
"group": "com.example",
14+
"name": "situation-A",
15+
"version": "1",
16+
"description": "Multiple licenses: declared ids/names, and a concluded expression",
17+
"licenses": [
18+
{
19+
"license": {
20+
"id": "MIT",
21+
"acknowledgement": "declared"
22+
}
23+
},
24+
{
25+
"license": {
26+
"id": "PostgreSQL",
27+
"acknowledgement": "declared"
28+
}
29+
},
30+
{
31+
"license": {
32+
"name": "Apache Software License",
33+
"acknowledgement": "declared"
34+
}
35+
},
36+
{
37+
"expression": "(MIT OR PostgreSQL OR Apache-2.0)",
38+
"acknowledgement": "concluded"
39+
}
40+
]
41+
},
42+
{
43+
"type": "library",
44+
"group": "com.example",
45+
"name": "situation-B",
46+
"version": "1",
47+
"description": "Multiple license expressions: one declared, one concluded",
48+
"licenses": [
49+
{
50+
"expression": "MIT OR (GPL-3.0 OR GPL-2.0)",
51+
"acknowledgement": "declared"
52+
},
53+
{
54+
"expression": "(GPL-3.0-only AND LGPL-2.0-only)",
55+
"acknowledgement": "concluded"
56+
}
57+
]
58+
},
59+
{
60+
"type": "library",
61+
"group": "com.example",
62+
"name": "situation-C",
63+
"version": "1",
64+
"description": "Multiple license: one declared expression, one concluded id",
65+
"licenses": [
66+
{
67+
"expression": "GPL-3.0-or-later OR GPL-2.0",
68+
"acknowledgement": "declared"
69+
},
70+
{
71+
"license": {
72+
"id": "GPL-3.0-only",
73+
"acknowledgement": "concluded"
74+
}
75+
}
76+
]
77+
}
78+
]
79+
}

‎tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.xml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?xml version="1.0"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.6"
3+
serialNumber="urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42"
4+
>
5+
<!--
6+
All license posture in here is for show-case ony.
7+
This is not a real law-case!
8+
-->
9+
<metadata>
10+
<lifecycles><lifecycle><phase>design</phase></lifecycle></lifecycles>
11+
</metadata>
12+
<components>
13+
<component type="library">
14+
<group>com.example</group>
15+
<name>situation-A</name>
16+
<version>1</version>
17+
<description>Multiple licenses: declared ids/names, and a concluded expression</description>
18+
<licenses>
19+
<license acknowledgement="declared"><id>MIT</id></license>
20+
<license acknowledgement="declared"><id>PostgreSQL</id></license>
21+
<license acknowledgement="declared"><name>Apache Software License</name></license>
22+
<expression acknowledgement="concluded">(MIT OR PostgreSQL OR Apache-2.0)</expression>
23+
</licenses>
24+
</component>
25+
<component type="library">
26+
<group>com.example</group>
27+
<name>situation-B</name>
28+
<version>1</version>
29+
<description>Multiple license expressions: one declared, one concluded</description>
30+
<licenses>
31+
<expression acknowledgement="declared">MIT OR (GPL-3.0 OR GPL-2.0)</expression>
32+
<expression acknowledgement="concluded">(GPL-3.0-only AND LGPL-2.0-only)</expression>
33+
</licenses>
34+
</component>
35+
<component type="library">
36+
<group>com.example</group>
37+
<name>situation-C</name>
38+
<version>1</version>
39+
<description>Multiple license: one declared expression, one concluded id</description>
40+
<licenses>
41+
<expression acknowledgement="declared">GPL-3.0-or-later OR GPL-2.0</expression>
42+
<license acknowledgement="concluded"><id>GPL-3.0-only</id></license>
43+
</licenses>
44+
</component>
45+
</components>
46+
</bom>

‎tools/src/test/resources/1.7/valid-license-choice-1.7.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.7",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"components": [
8+
{
9+
"type": "application",
10+
"publisher": "Acme Inc",
11+
"group": "com.acme",
12+
"name": "tomcat-catalina",
13+
"version": "9.0.14",
14+
"description": "Modified version of Apache Catalina",
15+
"scope": "required",
16+
"licenses": [
17+
{
18+
"license": {
19+
"id": "Apache-2.0"
20+
}
21+
},
22+
{
23+
"expression": "EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0"
24+
},
25+
{
26+
"license": {
27+
"name": "My Own License",
28+
"text": {
29+
"content": "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua."
30+
}
31+
}
32+
},
33+
{
34+
"expression": "LicenseRef-MIT-Style-2",
35+
"expressionDetails": [
36+
{
37+
"licenseIdentifier": "LicenseRef-MIT-Style-2",
38+
"url": "https://example.com/license"
39+
}
40+
]
41+
}
42+
]
43+
}
44+
]
45+
}

‎tools/src/test/resources/1.7/valid-license-choice-1.7.textproto‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# proto-file: schema/bom-1.7.proto
2+
# proto-message: Bom
3+
4+
# All license posture in here is for show-case ony.
5+
# This is not a real law-case!
6+
7+
spec_version: "1.7"
8+
serial_number: "urn:uuid:b1ef52c6-7cd8-43d5-9e42-5e69044bbe9e"
9+
version: 1
10+
components {
11+
type: CLASSIFICATION_APPLICATION
12+
publisher: "Acme Inc"
13+
group: "com.acme"
14+
name: "tomcat-catalina"
15+
version: "9.0.14"
16+
description: "Modified version of Apache Catalina"
17+
scope: SCOPE_REQUIRED
18+
licenses {
19+
license {
20+
id: "Apache-2.0"
21+
}
22+
}
23+
licenses {
24+
expression: "EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0"
25+
}
26+
licenses {
27+
license {
28+
name: "My Own License"
29+
text {
30+
value: "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua."
31+
}
32+
}
33+
}
34+
licenses {
35+
expression_detailed {
36+
expression: "LicenseRef-MIT-Style-2"
37+
details {
38+
license_identifier: "LicenseRef-MIT-Style-2"
39+
url: "https://example.com/license"
40+
}
41+
}
42+
}
43+
}

0 commit comments

Comments
 (0)