specification

specification copied to clipboard

Add support for redaction

1

It is desirable to specify that a component, service, assembly, or dependency has been redacted. This is a use case currently being discussed at CISA.

stevespringett

followup of #396 existing work/art: - Green Software Foundation - Impact Framework - see requests - request for manufacturing cost in HBOM and SBOM ans SaaSBOM (components and services) and...

jkowalleck

Link to Purl Version Specification does not work

1

The link to the purl version range defined in https://github.com/CycloneDX/specification/blob/8af880d5f2ba0a107de88a920a76cedd5ba75083/schema/bom-1.5.xsd#L3647 (https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst) does not work at the moment. Currently the Version-Range Spec is not merged to main but only available in...

weichslgartner

Fix empty link to PURL spec / VERS spec

1

I was browsing through https://cyclonedx.org/docs/1.5/json/#vulnerabilities_items_affects_items_versions_items_range to gain a better understanding of CycloneDX version ranges. When I attempted to access the information via this link: https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst, it led me to a...

nathannaveen

Add inline mapping to SCVS BOM Maturity Model

8

A proposal has been suggested that the CycloneDX specification add native support for the [SCVS BOM Maturity Model](https://scvs.owasp.org/bom-maturity-model/) to the schema itself. This may likely be a JSON-only enhancement, but...

stevespringett

licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses

22

## current situation (CDX 1.6): - it is allowed to have EITHER one spdx license expression OR multiple named/spdx licenses. see [spec](https://cyclonedx.org/docs/1.6/json/#components_items_licenses) - each license(expression/named/spdx) can have a acknowledgement -...

jkowalleck

Misalignment in Protobuf Specification with Updated XML and JSON Schemas for LicenseChoice

6

Up to version 1.5, there was a discrepancy between the XML and the JSON Schema, which was resolved as per #204/#205. Since that update, `LicenseChoice` has become a complex type...

mtsfoni

Bumps [json-schema-for-humans](https://github.com/coveooss/json-schema-for-humans) from 0.47 to 1.0.2. Release notes Sourced from json-schema-for-humans's releases. v1.0.2 1.0.2 (2024-05-16) Bug Fixes Fix for unstable enum description templating_utils.py (#243) (c304af8) v1.0.1 1.0.1 (2024-05-06) Bug Fixes...

dependabot[bot]

Add support for Blueprints

6

A BOM is not overly useful to defenders as they only contain inventory of things and potentially how something was built (e.g. formulation). They do not provide any insight into...

stevespringett

Change component type so that it's not required or add a new type of unassigned

4

I'm currently working on generating SBOM for a yocto based embedded distribution and I'd like to use dependency-track. I have a semi-working solution to get my SBOM into dependency track...

pjdowner