Skip to content

Commit e06981d

Browse files
stevespringettstevespringett
committed
Deprecated tool in favor of components and services used as tools. Added both current 1.5 and deprecated examples of each.
Signed-off-by: Steve Springett <[email protected]>
1 parent 5a579c6 commit e06981d

9 files changed

+233
-55
lines changed

‎schema/bom-1.5.proto‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -353,7 +353,7 @@ message Metadata {
353353
// The date and time (timestamp) when the document was created.
354354
optional google.protobuf.Timestamp timestamp = 1;
355355
// The tool(s) used in the creation of the BOM.
356-
repeated Tool tools = 2;
356+
optional Tool tools = 2;
357357
// The person(s) who created the BOM. Authors are common in BOMs created through manual processes. BOMs created through automated means may not have authors.
358358
repeated OrganizationalContact authors = 3;
359359
// The component that the BOM describes.
@@ -482,15 +482,20 @@ message Swid {
482482

483483
// Specifies a tool (manual or automated).
484484
message Tool {
485-
// The vendor of the tool used to create the BOM.
486-
optional string vendor = 1;
487-
// The name of the tool used to create the BOM.
488-
optional string name = 2;
489-
// The version of the tool used to create the BOM.
490-
optional string version = 3;
491-
repeated Hash hashes = 4;
492-
// Provides the ability to document external references related to the tool.
493-
repeated ExternalReference external_references = 5;
485+
// DEPRECATED - DO NOT USE - The vendor of the tool used to create the BOM.
486+
optional string vendor = 1 [deprecated = true];
487+
// DEPRECATED - DO NOT USE - The name of the tool used to create the BOM.
488+
optional string name = 2 [deprecated = true];
489+
// DEPRECATED - DO NOT USE - The version of the tool used to create the BOM.
490+
optional string version = 3 [deprecated = true];
491+
// DEPRECATED - DO NOT USE
492+
repeated Hash hashes = 4 [deprecated = true];
493+
// DEPRECATED - DO NOT USE - Provides the ability to document external references related to the tool.
494+
repeated ExternalReference external_references = 5 [deprecated = true];
495+
// A list of software and hardware components used as tools
496+
repeated Component components = 6;
497+
// A list of services used as tools. This may include microservices, function-as-a-service, and other types of network or intra-process services.
498+
repeated Service services = 7;
494499
}
495500

496501
// Specifies a property
@@ -595,7 +600,7 @@ message Vulnerability {
595600
// Individuals or organizations credited with the discovery of the vulnerability.
596601
optional VulnerabilityCredits credits = 14;
597602
// The tool(s) used to identify, confirm, or score the vulnerability.
598-
repeated Tool tools = 15;
603+
optional Tool tools = 15;
599604
// An assessment of the impact and exploitability of the vulnerability.
600605
optional VulnerabilityAnalysis analysis = 16;
601606
// affects

‎schema/bom-1.5.schema.json‎

Lines changed: 59 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -137,11 +137,39 @@
137137
"description": "The date and time (timestamp) when the BOM was created."
138138
},
139139
"tools": {
140-
"type": "array",
141-
"title": "Creation Tools",
142-
"description": "The tool(s) used in the creation of the BOM.",
143-
"additionalItems": false,
144-
"items": {"$ref": "#/definitions/tool"}
140+
"oneOf": [
141+
{
142+
"type": "object",
143+
"title": "Creation Tools",
144+
"description": "The tool(s) used in the creation of the BOM.",
145+
"additionalProperties": false,
146+
"properties": {
147+
"components": {
148+
"type": "array",
149+
"additionalItems": false,
150+
"items": {"$ref": "#/definitions/component"},
151+
"uniqueItems": true,
152+
"title": "Components",
153+
"description": "A list of software and hardware components used as tools"
154+
},
155+
"services": {
156+
"type": "array",
157+
"additionalItems": false,
158+
"items": {"$ref": "#/definitions/service"},
159+
"uniqueItems": true,
160+
"title": "Services",
161+
"description": "A list of services used as tools. This may include microservices, function-as-a-service, and other types of network or intra-process services."
162+
}
163+
}
164+
},
165+
{
166+
"type": "array",
167+
"title": "Creation Tools (legacy)",
168+
"description": "[Deprecated] The tool(s) used in the creation of the BOM.",
169+
"additionalItems": false,
170+
"items": {"$ref": "#/definitions/tool"}
171+
}
172+
]
145173
},
146174
"authors" :{
147175
"type": "array",
@@ -183,7 +211,7 @@
183211
"tool": {
184212
"type": "object",
185213
"title": "Tool",
186-
"description": "Information about the automated or manual tool used",
214+
"description": "[Deprecated] - DO NOT USE. This will be removed in a future version. This will be removed in a future version. Use component or service instead. Information about the automated or manual tool used",
187215
"additionalProperties": false,
188216
"properties": {
189217
"vendor": {
@@ -1739,7 +1767,31 @@
17391767
"title": "Creation Tools",
17401768
"description": "The tool(s) used to identify, confirm, or score the vulnerability.",
17411769
"additionalItems": false,
1742-
"items": {"$ref": "#/definitions/tool"}
1770+
"items": {
1771+
"properties": {
1772+
"component": {
1773+
"$ref": "#/definitions/component"
1774+
},
1775+
"service": {
1776+
"$ref": "#/definitions/service"
1777+
},
1778+
"tool": {
1779+
"description": "[Deprecated - Use `component` and `service` instead]",
1780+
"$ref": "#/definitions/tool"
1781+
}
1782+
},
1783+
"oneOf":[
1784+
{
1785+
"required": ["component"]
1786+
},
1787+
{
1788+
"required": ["service"]
1789+
},
1790+
{
1791+
"required": ["tool"]
1792+
}
1793+
]
1794+
}
17431795
},
17441796
"analysis": {
17451797
"type": "object",

‎schema/bom-1.5.xsd‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,27 @@ limitations under the License.
5454
<xs:documentation>The tool(s) used in the creation of the BOM.</xs:documentation>
5555
</xs:annotation>
5656
<xs:complexType>
57-
<xs:sequence minOccurs="0" maxOccurs="unbounded">
58-
<xs:element name="tool" minOccurs="0" type="bom:toolType"/>
59-
</xs:sequence>
57+
<xs:choice>
58+
<xs:sequence minOccurs="0" maxOccurs="unbounded">
59+
<xs:element name="tool" minOccurs="0" type="bom:toolType">
60+
<xs:annotation>
61+
<xs:documentation>DEPRECATED. Use tools\components or tools\services instead.</xs:documentation>
62+
</xs:annotation>
63+
</xs:element>
64+
</xs:sequence>
65+
<xs:sequence minOccurs="0" maxOccurs="1">
66+
<xs:element name="components" type="bom:componentsType" minOccurs="0" maxOccurs="1">
67+
<xs:annotation>
68+
<xs:documentation>A list of software and hardware components used as tools.</xs:documentation>
69+
</xs:annotation>
70+
</xs:element>
71+
<xs:element name="services" type="bom:servicesType" minOccurs="0" maxOccurs="1">
72+
<xs:annotation>
73+
<xs:documentation>A list of services used as tools.</xs:documentation>
74+
</xs:annotation>
75+
</xs:element>
76+
</xs:sequence>
77+
</xs:choice>
6078
</xs:complexType>
6179
</xs:element>
6280
<xs:element name="authors" minOccurs="0" maxOccurs="1">

‎tools/src/test/resources/1.5/valid-metadata-tool-1.5.json‎

Lines changed: 37 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,44 @@
44
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
55
"version": 1,
66
"metadata": {
7-
"tools": [
8-
{
9-
"vendor": "Awesome Vendor",
10-
"name": "Awesome Tool",
11-
"version": "9.1.2",
12-
"hashes": [
13-
{
14-
"alg": "SHA-1",
15-
"content": "25ed8e31b995bb927966616df2a42b979a2717f0"
7+
"tools": {
8+
"components": [
9+
{
10+
"type": "application",
11+
"group": "Awesome Vendor",
12+
"name": "Awesome Tool",
13+
"version": "9.1.2",
14+
"hashes": [
15+
{
16+
"alg": "SHA-1",
17+
"content": "25ed8e31b995bb927966616df2a42b979a2717f0"
18+
},
19+
{
20+
"alg": "SHA-256",
21+
"content": "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
22+
}
23+
]
24+
}
25+
],
26+
"services": [
27+
{
28+
"provider": {
29+
"name": "Acme Org",
30+
"url": [
31+
"https://example.com"
32+
]
1633
},
17-
{
18-
"alg": "SHA-256",
19-
"content": "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
20-
}
21-
]
22-
}
23-
]
34+
"group": "com.example",
35+
"name": "Acme Signing Server",
36+
"description": "Signs artifacts",
37+
"endpoints": [
38+
"https://example.com/sign",
39+
"https://example.com/verify",
40+
"https://example.com/tsa"
41+
]
42+
}
43+
]
44+
}
2445
},
2546
"components": []
2647
}

‎tools/src/test/resources/1.5/valid-metadata-tool-1.5.textproto‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,35 @@ version: 1
33
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
44
metadata {
55
tools {
6-
vendor: "Awesome Vendor"
7-
name: "Awesome Tool"
8-
version: "9.1.2"
9-
hashes {
10-
alg: HASH_ALG_SHA_1
11-
value: "25ed8e31b995bb927966616df2a42b979a2717f0"
6+
components {
7+
type: CLASSIFICATION_APPLICATION
8+
group: "Awesome Vendor"
9+
name: "Awesome Tool"
10+
version: "9.1.2"
11+
hashes {
12+
alg: HASH_ALG_SHA_1
13+
value: "25ed8e31b995bb927966616df2a42b979a2717f0"
14+
}
15+
hashes {
16+
alg: HASH_ALG_SHA_256
17+
value: "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
18+
}
1219
}
13-
hashes {
14-
alg: HASH_ALG_SHA_256
15-
value: "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
20+
services {
21+
provider: {
22+
name: "Acme Org",
23+
url: [
24+
"https://example.com"
25+
]
26+
},
27+
group: "com.example",
28+
name: "Acme Signing Server",
29+
description: "Signs artifacts",
30+
endpoints: [
31+
"https://example.com/sign",
32+
"https://example.com/verify",
33+
"https://example.com/tsa"
34+
]
1635
}
1736
}
1837
}

‎tools/src/test/resources/1.5/valid-metadata-tool-1.5.xml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,17 @@
22
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.5">
33
<metadata>
44
<tools>
5-
<tool>
6-
<vendor>Awesome Vendor</vendor>
7-
<name>Awesome Tool</name>
8-
<version>9.1.2</version>
9-
<hashes>
10-
<hash alg="SHA-1">25ed8e31b995bb927966616df2a42b979a2717f0</hash>
11-
<hash alg="SHA-256">a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df</hash>
12-
</hashes>
13-
</tool>
5+
<components>
6+
<component type="application">
7+
<group>Awesome Vendor</group>
8+
<name>Awesome Tool</name>
9+
<version>9.1.2</version>
10+
<hashes>
11+
<hash alg="SHA-1">25ed8e31b995bb927966616df2a42b979a2717f0</hash>
12+
<hash alg="SHA-256">a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df</hash>
13+
</hashes>
14+
</component>
15+
</components>
1416
</tools>
1517
</metadata>
1618
<components />

‎tools/src/test/resources/1.5/valid-metadata-tool-deprecated-1.5.json‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.5",
4+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
5+
"version": 1,
6+
"metadata": {
7+
"tools": [
8+
{
9+
"vendor": "Awesome Vendor",
10+
"name": "Awesome Tool",
11+
"version": "9.1.2",
12+
"hashes": [
13+
{
14+
"alg": "SHA-1",
15+
"content": "25ed8e31b995bb927966616df2a42b979a2717f0"
16+
},
17+
{
18+
"alg": "SHA-256",
19+
"content": "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
20+
}
21+
]
22+
}
23+
]
24+
},
25+
"components": []
26+
}

‎tools/src/test/resources/1.5/valid-metadata-tool-deprecated-1.5.textproto‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
spec_version: "1.5"
2+
version: 1
3+
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
4+
metadata {
5+
tools {
6+
vendor: "Awesome Vendor"
7+
name: "Awesome Tool"
8+
version: "9.1.2"
9+
hashes {
10+
alg: HASH_ALG_SHA_1
11+
value: "25ed8e31b995bb927966616df2a42b979a2717f0"
12+
}
13+
hashes {
14+
alg: HASH_ALG_SHA_256
15+
value: "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
16+
}
17+
}
18+
}

‎tools/src/test/resources/1.5/valid-metadata-tool-deprecated-1.5.xml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?xml version="1.0"?>
2+
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.5">
3+
<metadata>
4+
<tools>
5+
<tool>
6+
<vendor>Awesome Vendor</vendor>
7+
<name>Awesome Tool</name>
8+
<version>9.1.2</version>
9+
<hashes>
10+
<hash alg="SHA-1">25ed8e31b995bb927966616df2a42b979a2717f0</hash>
11+
<hash alg="SHA-256">a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df</hash>
12+
</hashes>
13+
</tool>
14+
</tools>
15+
</metadata>
16+
<components />
17+
</bom>

0 commit comments

Comments
 (0)