Skip to content

Commit eac0ac6

Browse files
stevespringettstevespringett
committed
Initial commit
Signed-off-by: Steve Springett <[email protected]>
1 parent 3b62100 commit eac0ac6

25 files changed

+974
-0
lines changed

‎schema/2.0/README.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# CycloneDX 2.0 Schemas
2+
3+
This directory contains the official JSON Schema definitions for CycloneDX 2.0, as standardised in [ECMA-424](https://ecma-international.org/publications-and-standards/standards/ecma-424/). These schemas constitute the normative implementation of the CycloneDX specification and are intended for use in validation, tooling, and data exchange.
4+
5+
## Schema Overview
6+
7+
| File | Description |
8+
|--------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
9+
| [`cyclonedx-2.0.schema.json`](./cyclonedx-2.0.schema.json) | The normative schema for CycloneDX Bill of Materials (BOM) documents. This schema references modular models and defines the complete structure for expressing inventories and metadata. |
10+
| [`cyclonedx-api-2.0.schema.json`](./cyclonedx-api-2.0.schema.json) | The normative API-focused schema. It reuses CycloneDX models but is structured for compatibility with request/response patterns in service architectures. |
11+
| [`cyclonedx-combined-2.0.schema.json`](./cyclonedx-combined-2.0.schema.json) | A fully resolved version of the BOM schema with all external model references inlined. Useful for systems that require a self-contained schema. |
12+
| [`cyclonedx-api-combined-2.0.schema.json`](./cyclonedx-api-combined-2.0.schema.json) | The combined version of the API schema with all model definitions embedded. Suitable for use in tools or validators that do not support `$ref` resolution. |
13+
14+
## Modularity and Model Composition
15+
16+
CycloneDX 2.0 is defined as a modular specification. All core concepts—such as components, services, vulnerabilities, licensing, and AI/ML metadata—are encapsulated in reusable model definitions located in the [`model/`](./model) directory.
17+
18+
This modular architecture promotes:
19+
20+
- **Consistency** across multiple schema contexts
21+
- **Reusability** of models within and beyond CycloneDX
22+
- **Clarity and maintainability** for implementers
23+
24+
## Combined Schemas
25+
26+
The `*-combined` schema files are auto-generated from the normative schemas by resolving all references. These are provided for convenience and do not supersede the authoritative pre-defined schemas.
27+
28+
## Related Resources
29+
30+
- CycloneDX Website: [https://cyclonedx.org](https://cyclonedx.org)
31+
- ECMA-424 Publication: [https://ecma-international.org/publications-and-standards/standards/ecma-424/](https://ecma-international.org/publications-and-standards/standards/ecma-424/)
32+
- Model Definitions: See [`model/README.md`](./model/README.md)

‎schema/2.0/cyclonedx-2.0.schema.json

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "http://localhost:8080/schema/2.0/cyclonedx-2.0.schema.json",
4+
"type": "object",
5+
"title": "CycloneDX Transparency Expression Language",
6+
"$comment": "CycloneDX JSON schema is published under the terms of the Apache License 2.0.",
7+
"required": [
8+
"specFormat",
9+
"specVersion"
10+
],
11+
"additionalProperties": false,
12+
"properties": {
13+
"$schema": {
14+
"type": "string"
15+
},
16+
"specFormat": {
17+
"type": "string",
18+
"title": "Specification Format",
19+
"description": "Specifies the format. This value must be \"CycloneDX\".",
20+
"enum": [
21+
"CycloneDX"
22+
]
23+
},
24+
"specVersion": {
25+
"type": "string",
26+
"title": "Specification Version",
27+
"description": "The version of the CycloneDX specification the BOM conforms to.",
28+
"examples": [
29+
"2.0"
30+
]
31+
},
32+
"serialNumber": {
33+
"type": "string",
34+
"title": "BOM Serial Number",
35+
"description": "Every BOM generated SHOULD have a unique serial number, even if the contents of the BOM have not changed over time. If specified, the serial number must conform to [RFC 4122](https://www.ietf.org/rfc/rfc4122.html). Use of serial numbers is recommended.",
36+
"examples": [
37+
"urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
38+
],
39+
"pattern": "^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
40+
},
41+
"version": {
42+
"type": "integer",
43+
"title": "BOM Version",
44+
"description": "Whenever an existing BOM is modified, either manually or through automated processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM. The default version is '1'.",
45+
"minimum": 1,
46+
"default": 1
47+
}
48+
},
49+
"allOf": [
50+
{ "$ref": "cyclonedx-common-2.0.schema.json#/$defs/extensibleProperties" }
51+
]
52+
}

‎schema/2.0/cyclonedx-api-2.0.schema.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "http://localhost:8080/schema/2.0/cyclonedx-api-2.0.schema.json",
4+
"type": "object",
5+
"title": "CycloneDX Transparency Expression Language: API",
6+
"$comment" : "CycloneDX JSON schema is published under the terms of the Apache License 2.0.",
7+
"$defs": {
8+
9+
}
10+
}

‎schema/2.0/model/README.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# CycloneDX 2.0 Model Definitions
2+
3+
This directory contains the modular JSON Schema definitions that constitute the building blocks of the CycloneDX 2.0 specification.
4+
5+
## Purpose
6+
7+
The model definitions are:
8+
9+
- **Reusable** across different schemas such as `bom.schema.json` and `api.schema.json`
10+
- **Compositional**, enabling coherent and maintainable schema evolution
11+
- **Portable**, supporting external reuse outside the CycloneDX context
12+
13+
Each file in this directory defines a discrete concept and adheres to the CycloneDX data modelling conventions.
14+
15+
These models are compiled into the schemas in the parent directory, ensuring consistency and maximising reuse.
16+
17+
| Schema File | Purpose |
18+
|----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
19+
| [`cyclonedx-ai-model-parameters-2.0.schema.json`](./cyclonedx-ai-model-parameters-2.0.schema.json) | Defines configuration and metadata for AI/ML training, evaluation, and deployment parameters. |
20+
| [`cyclonedx-ai-modelcard-2.0.schema.json`](./cyclonedx-ai-modelcard-2.0.schema.json) | Describes AI/ML model cards including intended use, limitations, and ethical considerations. |
21+
| [`cyclonedx-annotation-2.0.schema.json`](./cyclonedx-annotation-2.0.schema.json) | Represents human or automated comments about BOM elements, such as components or services. |
22+
| [`cyclonedx-common-2.0.schema.json`](./cyclonedx-common-2.0.schema.json) | Provides common types and base definitions used across all other schemas. |
23+
| [`cyclonedx-component-2.0.schema.json`](./cyclonedx-component-2.0.schema.json) | Models hardware, software, data, cryptographic, and AI components and their attributes. |
24+
| [`cyclonedx-composition-2.0.schema.json`](./cyclonedx-composition-2.0.schema.json) | Indicates the known and unknown completeness of BOM elements and their relationships. |
25+
| [`cyclonedx-cryptography-2.0.schema.json`](./cyclonedx-cryptography-2.0.schema.json) | Defines cryptographic properties, including algorithms, keys, and post-quantum cryptographic readiness. |
26+
| [`cyclonedx-declaration-2.0.schema.json`](./cyclonedx-declaration-2.0.schema.json) | Structures conformance declarations, claims, attestations, and associated evidence. |
27+
| [`cyclonedx-definition-2.0.schema.json`](./cyclonedx-definition-2.0.schema.json) | Contains reusable definitions and enums referenced by other schemas. |
28+
| [`cyclonedx-dependency-2.0.schema.json`](./cyclonedx-dependency-2.0.schema.json) | Captures dependency relationships among components and services in the BOM. |
29+
| [`cyclonedx-formulation-2.0.schema.json`](./cyclonedx-formulation-2.0.schema.json) | Describes the process of manufacturing, building, or deploying a component or service. |
30+
| [`cyclonedx-license-2.0.schema.json`](./cyclonedx-license-2.0.schema.json) | Models software licences using SPDX IDs, named licences, and optional full text. |
31+
| [`cyclonedx-licensing-2.0.schema.json`](./cyclonedx-licensing-2.0.schema.json) | Expands on licence metadata with purchaser, licensee, terms, and validity periods. |
32+
| [`cyclonedx-metadata-2.0.schema.json`](./cyclonedx-metadata-2.0.schema.json) | Contains metadata about the BOM, such as authorship, tools used, and timestamps. |
33+
| [`cyclonedx-patent-2.0.schema.json`](./cyclonedx-patent-2.0.schema.json) | Represents patents relevant to components, including jurisdiction and legal status. |
34+
| [`cyclonedx-patent-assertion-2.0.schema.json`](./cyclonedx-patent-assertion-2.0.schema.json) | Defines legal claims or disclaimers associated with patents. |
35+
| [`cyclonedx-patent-family-2.0.schema.json`](./cyclonedx-patent-family-2.0.schema.json) | Groups related patents across different jurisdictions into patent families. |
36+
| [`cyclonedx-release-notes-2.0.schema.json`](./cyclonedx-release-notes-2.0.schema.json) | Specifies structured release note content, including changes and version history. |
37+
| [`cyclonedx-service-2.0.schema.json`](./cyclonedx-service-2.0.schema.json) | Models services such as APIs or microservices, including endpoints and interactions. |
38+
| [`cyclonedx-standard-2.0.schema.json`](./cyclonedx-standard-2.0.schema.json) | Describes standards, regulations, and frameworks referenced in BOM declarations. |
39+
| [`cyclonedx-vulnerability-2.0.schema.json`](./cyclonedx-vulnerability-2.0.schema.json) | Details vulnerabilities, including severity, remediation, and advisories. |
40+

‎schema/2.0/model/cyclonedx-ai-model-parameters-2.0.schema.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "http://localhost:8080/schema/2.0/cyclonedx-ai-model-parameters-2.0.schema.json",
4+
"type": "null",
5+
"title": "CycloneDX Transparency Expression Language: AI Model Parameters",
6+
"$comment": "CycloneDX JSON schema is published under the terms of the Apache License 2.0.",
7+
"$defs": {
8+
}
9+
}

‎schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "http://localhost:8080/schema/2.0/cyclonedx-ai-modelcard-2.0.schema.json",
4+
"type": "null",
5+
"title": "CycloneDX Transparency Expression Language: AI Model Card",
6+
"$comment": "CycloneDX JSON schema is published under the terms of the Apache License 2.0.",
7+
"$defs": {
8+
}
9+
}

‎schema/2.0/model/cyclonedx-annotation-2.0.schema.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "http://localhost:8080/schema/2.0/cyclonedx-annotation-2.0.schema.json",
4+
"type": "null",
5+
"title": "CycloneDX Transparency Expression Language: Annotation",
6+
"$comment" : "CycloneDX JSON schema is published under the terms of the Apache License 2.0.",
7+
"$defs": {
8+
}
9+
}

0 commit comments

Comments
 (0)