Skip to content

Commit 9730c9f

Browse files
stevespringettstevespringett
authored
Merge pull request #236 from CycloneDX/v1.5-explicit-bomlink
intro to explicitly linked elements
2 parents be369a9 + b3719fd commit 9730c9f

File tree

6 files changed

+137
-34
lines changed

6 files changed

+137
-34
lines changed

‎schema/bom-1.5.schema.json

Lines changed: 61 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
"type": "integer",
4343
"title": "BOM Version",
4444
"description": "Whenever an existing BOM is modified, either manually or through automated processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM. The default version is '1'.",
45+
"minimum": 1,
4546
"default": 1,
4647
"examples": [1]
4748
},
@@ -121,20 +122,28 @@
121122
},
122123
"definitions": {
123124
"refType": {
124-
"$comment": "Identifier-DataType for interlinked elements.",
125-
"type": "string"
125+
"description": "Identifier for referable and therefore interlink-able elements.",
126+
"type": "string",
127+
"minLength": 1,
128+
"$comment": "value SHOULD not start with the BOM-Link intro 'urn:cdx:'"
129+
},
130+
"refLinkType": {
131+
"description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.",
132+
"allOf": [{"$ref": "#/definitions/refType"}]
126133
},
127134
"bomLinkDocumentType": {
128135
"title": "BOM-Link document",
129136
"description": "Descriptor for another BOM document. See https://cyclonedx.org/capabilities/bomlink/",
130137
"type": "string",
138+
"format": "iri-reference",
131139
"pattern": "^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*$",
132140
"$comment": "part of the pattern is based on `bom.serialNumber`'s pattern"
133141
},
134142
"bomLinkElementType": {
135143
"title": "BOM-Link element",
136144
"description": "Descriptor for an element in another BOM document. See https://cyclonedx.org/capabilities/bomlink/",
137145
"type": "string",
146+
"format": "iri-reference",
138147
"pattern": "^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*#.+$",
139148
"$comment": "part of the pattern is based on `bom.serialNumber`'s pattern"
140149
},
@@ -1125,10 +1134,17 @@
11251134
"additionalProperties": false,
11261135
"properties": {
11271136
"url": {
1128-
"type": "string",
1137+
"anyOf": [
1138+
{
1139+
"type": "string",
1140+
"format": "iri-reference"
1141+
},
1142+
{
1143+
"$ref": "#/definitions/bomLink"
1144+
}
1145+
],
11291146
"title": "URL",
1130-
"description": "The URI (URL or URN) to the external reference. External references are URIs and therefore can accept any URL scheme including https ([RFC-7230](https://www.ietf.org/rfc/rfc7230.txt)), mailto ([RFC-2368](https://www.ietf.org/rfc/rfc2368.txt)), tel ([RFC-3966](https://www.ietf.org/rfc/rfc3966.txt)), and dns ([RFC-4501](https://www.ietf.org/rfc/rfc4501.txt)). External references may also include formally registered URNs such as [CycloneDX BOM-Link](https://cyclonedx.org/capabilities/bomlink/) to reference CycloneDX BOMs or any object within a BOM. BOM-Link transforms applicable external references into relationships that can be expressed in a BOM or across BOMs.",
1131-
"format": "iri-reference"
1147+
"description": "The URI (URL or URN) to the external reference. External references are URIs and therefore can accept any URL scheme including https ([RFC-7230](https://www.ietf.org/rfc/rfc7230.txt)), mailto ([RFC-2368](https://www.ietf.org/rfc/rfc2368.txt)), tel ([RFC-3966](https://www.ietf.org/rfc/rfc3966.txt)), and dns ([RFC-4501](https://www.ietf.org/rfc/rfc4501.txt)). External references may also include formally registered URNs such as [CycloneDX BOM-Link](https://cyclonedx.org/capabilities/bomlink/) to reference CycloneDX BOMs or any object within a BOM. BOM-Link transforms applicable external references into relationships that can be expressed in a BOM or across BOMs."
11321148
},
11331149
"comment": {
11341150
"type": "string",
@@ -1199,15 +1215,15 @@
11991215
"additionalProperties": false,
12001216
"properties": {
12011217
"ref": {
1202-
"$ref": "#/definitions/refType",
1218+
"$ref": "#/definitions/refLinkType",
12031219
"title": "Reference",
12041220
"description": "References a component by the components bom-ref attribute"
12051221
},
12061222
"dependsOn": {
12071223
"type": "array",
12081224
"uniqueItems": true,
12091225
"items": {
1210-
"$ref": "#/definitions/refType"
1226+
"$ref": "#/definitions/refLinkType"
12111227
},
12121228
"title": "Depends On",
12131229
"description": "The bom-ref identifiers of the components that are dependencies of this dependency object."
@@ -1362,17 +1378,31 @@
13621378
"source": {
13631379
"type": "array",
13641380
"items": {
1365-
"type": "string",
1366-
"format": "iri-reference"
1381+
"anyOf": [
1382+
{
1383+
"type": "string",
1384+
"format": "iri-reference"
1385+
},
1386+
{
1387+
"$ref": "#/definitions/bomLinkElementType"
1388+
}
1389+
]
13671390
},
13681391
"title": "Source",
13691392
"description": "The URI, URL, or BOM-Link of the components or services the data came in from"
13701393
},
13711394
"destination": {
13721395
"type": "array",
13731396
"items": {
1374-
"type": "string",
1375-
"format": "iri-reference"
1397+
"anyOf": [
1398+
{
1399+
"type": "string",
1400+
"format": "iri-reference"
1401+
},
1402+
{
1403+
"$ref": "#/definitions/bomLinkElementType"
1404+
}
1405+
]
13761406
},
13771407
"title": "Destination",
13781408
"description": "The URI, URL, or BOM-Link of the components or services the data is sent to"
@@ -1480,7 +1510,10 @@
14801510
"type": "array",
14811511
"uniqueItems": true,
14821512
"items": {
1483-
"$ref": "#/definitions/refType"
1513+
"anyOf": [
1514+
{"$ref": "#/definitions/refLinkType"},
1515+
{"$ref": "#/definitions/bomLinkElementType"}
1516+
]
14841517
},
14851518
"title": "BOM References",
14861519
"description": "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs. Tools used for analysis should already be defined in the BOM, either in the metadata/tools, components, or formulation."
@@ -1600,7 +1633,10 @@
16001633
"type": "array",
16011634
"uniqueItems": true,
16021635
"items": {
1603-
"$ref": "#/definitions/refType"
1636+
"anyOf": [
1637+
{"$ref": "#/definitions/refLinkType"},
1638+
{"$ref": "#/definitions/bomLinkElementType"}
1639+
]
16041640
},
16051641
"title": "BOM references",
16061642
"description": "The bom-ref identifiers of the components or services being described. Assemblies refer to nested relationships whereby a constituent part may include other constituent parts. References do not cascade to child parts. References are explicit for the specified constituent part only."
@@ -2182,7 +2218,10 @@
21822218
"additionalProperties": false,
21832219
"properties": {
21842220
"ref": {
2185-
"$ref": "#/definitions/refType",
2221+
"anyOf": [
2222+
{"$ref": "#/definitions/refLinkType"},
2223+
{"$ref": "#/definitions/bomLinkElementType"}
2224+
],
21862225
"title": "Reference",
21872226
"description": "References a component or service by the objects bom-ref"
21882227
},
@@ -2275,7 +2314,10 @@
22752314
"type": "array",
22762315
"uniqueItems": true,
22772316
"items": {
2278-
"$ref": "#/definitions/refType"
2317+
"anyOf": [
2318+
{"$ref": "#/definitions/refLinkType"},
2319+
{"$ref": "#/definitions/bomLinkElementType"}
2320+
]
22792321
},
22802322
"title": "BOM References",
22812323
"description": "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs."
@@ -2413,7 +2455,10 @@
24132455
"additionalProperties": false,
24142456
"properties": {
24152457
"ref": {
2416-
"$ref": "#/definitions/refType",
2458+
"anyOf": [
2459+
{"$ref": "#/definitions/refLinkType"},
2460+
{"$ref": "#/definitions/bomLinkElementType"}
2461+
],
24172462
"title": "Reference",
24182463
"description": "References a data component by the components bom-ref attribute"
24192464
}

‎schema/bom-1.5.xsd

Lines changed: 48 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,21 @@ limitations under the License.
3737

3838
<xs:simpleType name="refType">
3939
<xs:annotation>
40-
<xs:documentation>Identifier-DataType for interlinked elements.</xs:documentation>
40+
<xs:documentation>Identifier for referable and therefore interlink-able elements.</xs:documentation>
4141
</xs:annotation>
42-
<xs:restriction base="xs:string" />
42+
<xs:restriction base="xs:string">
43+
<xs:minLength value="1"/>
44+
<!-- value SHOULD not start with the BOM-Link intro "urn:cdx:" -->
45+
</xs:restriction>
46+
</xs:simpleType>
47+
<xs:simpleType name="refLinkType">
48+
<xs:annotation>
49+
<xs:documentation xml:lang="en">
50+
Descriptor for an element identified by the attribute "bom-ref" in the same BOM document.
51+
In contrast to `bomLinkElementType`.
52+
</xs:documentation>
53+
</xs:annotation>
54+
<xs:restriction base="bom:refType"/>
4355
</xs:simpleType>
4456

4557
<xs:simpleType name="bomLinkDocumentType">
@@ -49,9 +61,9 @@ limitations under the License.
4961
See https://cyclonedx.org/capabilities/bomlink/
5062
</xs:documentation>
5163
</xs:annotation>
52-
<xs:restriction base="xs:string">
64+
<xs:restriction base="xs:anyURI">
5365
<!-- part of the pattern is based on `bom.serialNumber`'s pattern -->
54-
<xs:pattern value="urn:cdx:([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})|(\{[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\})/[1-9][0-9]*"/>
66+
<xs:pattern value="urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*"/>
5567
</xs:restriction>
5668
</xs:simpleType>
5769
<xs:simpleType name="bomLinkElementType">
@@ -61,9 +73,9 @@ limitations under the License.
6173
See https://cyclonedx.org/capabilities/bomlink/
6274
</xs:documentation>
6375
</xs:annotation>
64-
<xs:restriction base="xs:string">
76+
<xs:restriction base="xs:anyURI">
6577
<!-- part of the pattern is based on `bom.serialNumber`'s pattern -->
66-
<xs:pattern value="urn:cdx:([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})|(\{[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\})/[1-9][0-9]*#.+"/>
78+
<xs:pattern value="urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*#.+"/>
6779
</xs:restriction>
6880
</xs:simpleType>
6981
<xs:simpleType name="bomLinkType">
@@ -1380,7 +1392,7 @@ limitations under the License.
13801392

13811393
<xs:complexType name="externalReference">
13821394
<xs:sequence>
1383-
<xs:element name="url" type="xs:anyURI" minOccurs="1" maxOccurs="1">
1395+
<xs:element name="url" minOccurs="1" maxOccurs="1">
13841396
<xs:annotation>
13851397
<xs:documentation xml:lang="en">The URI (URL or URN) to the external reference. External references
13861398
are URIs and therefore can accept any URL scheme including https, mailto, tel, and dns.
@@ -1389,6 +1401,9 @@ limitations under the License.
13891401
references into relationships that can be expressed in a BOM or across BOMs. Refer to:
13901402
https://cyclonedx.org/capabilities/bomlink/</xs:documentation>
13911403
</xs:annotation>
1404+
<xs:simpleType>
1405+
<xs:union memberTypes="xs:anyURI bom:bomLinkType"/>
1406+
</xs:simpleType>
13921407
</xs:element>
13931408
<xs:element name="comment" type="xs:string" minOccurs="0" maxOccurs="1">
13941409
<xs:annotation>
@@ -1769,9 +1784,9 @@ limitations under the License.
17691784
<xs:sequence minOccurs="0" maxOccurs="unbounded">
17701785
<xs:element name="dependency" type="bom:dependencyType"/>
17711786
</xs:sequence>
1772-
<xs:attribute name="ref" type="bom:refType" use="required">
1787+
<xs:attribute name="ref" type="bom:refLinkType" use="required">
17731788
<xs:annotation>
1774-
<xs:documentation>References a component or service by the its bom-ref attribute</xs:documentation>
1789+
<xs:documentation>References a component or service by its bom-ref attribute</xs:documentation>
17751790
</xs:annotation>
17761791
</xs:attribute>
17771792
<xs:anyAttribute namespace="##other" processContents="lax">
@@ -1902,7 +1917,11 @@ limitations under the License.
19021917
</xs:annotation>
19031918
<xs:complexType>
19041919
<xs:sequence minOccurs="0" maxOccurs="unbounded">
1905-
<xs:element name="url" type="xs:anyURI"/>
1920+
<xs:element name="url">
1921+
<xs:simpleType>
1922+
<xs:union memberTypes="xs:anyURI bom:bomLinkElementType"/>
1923+
</xs:simpleType>
1924+
</xs:element>
19061925
</xs:sequence>
19071926
</xs:complexType>
19081927
</xs:element>
@@ -1912,7 +1931,11 @@ limitations under the License.
19121931
</xs:annotation>
19131932
<xs:complexType>
19141933
<xs:sequence minOccurs="0" maxOccurs="unbounded">
1915-
<xs:element name="url" type="xs:anyURI"/>
1934+
<xs:element name="url">
1935+
<xs:simpleType>
1936+
<xs:union memberTypes="xs:anyURI bom:bomLinkElementType"/>
1937+
</xs:simpleType>
1938+
</xs:element>
19161939
</xs:sequence>
19171940
</xs:complexType>
19181941
</xs:element>
@@ -2647,10 +2670,13 @@ limitations under the License.
26472670
</xs:annotation>
26482671
<xs:complexType>
26492672
<xs:choice minOccurs="0" maxOccurs="unbounded">
2650-
<xs:element name="ref" type="bom:refType" minOccurs="0" maxOccurs="1">
2673+
<xs:element name="ref" minOccurs="0" maxOccurs="1">
26512674
<xs:annotation>
26522675
<xs:documentation>References a data component by the components bom-ref attribute</xs:documentation>
26532676
</xs:annotation>
2677+
<xs:simpleType>
2678+
<xs:union memberTypes="bom:refLinkType bom:bomLinkElementType"/>
2679+
</xs:simpleType>
26542680
</xs:element>
26552681
<xs:element name="dataset" type="bom:componentDataType" minOccurs="0" maxOccurs="1" />
26562682
</xs:choice>
@@ -3217,10 +3243,13 @@ limitations under the License.
32173243
</xs:simpleType>
32183244

32193245
<xs:complexType name="bomReferenceType">
3220-
<xs:attribute name="ref" type="bom:refType" use="required">
3246+
<xs:attribute name="ref" use="required">
32213247
<xs:annotation>
3222-
<xs:documentation>References a component or service by the its bom-ref attribute</xs:documentation>
3248+
<xs:documentation>References a component or service by its bom-ref attribute</xs:documentation>
32233249
</xs:annotation>
3250+
<xs:simpleType>
3251+
<xs:union memberTypes="bom:refLinkType bom:bomLinkType"/>
3252+
</xs:simpleType>
32243253
</xs:attribute>
32253254
<xs:anyAttribute namespace="##other" processContents="lax">
32263255
<xs:annotation>
@@ -3574,10 +3603,13 @@ limitations under the License.
35743603
<xs:element name="target">
35753604
<xs:complexType>
35763605
<xs:sequence minOccurs="0" maxOccurs="1">
3577-
<xs:element name="ref" type="bom:refType" minOccurs="1" maxOccurs="1">
3606+
<xs:element name="ref" minOccurs="1" maxOccurs="1">
35783607
<xs:annotation>
35793608
<xs:documentation>References a component or service by the objects bom-ref.</xs:documentation>
35803609
</xs:annotation>
3610+
<xs:simpleType>
3611+
<xs:union memberTypes="bom:refLinkType bom:bomLinkElementType"/>
3612+
</xs:simpleType>
35813613
</xs:element>
35823614
<xs:element name="versions" minOccurs="0" maxOccurs="1">
35833615
<xs:annotation>
@@ -5383,7 +5415,7 @@ limitations under the License.
53835415
</xs:annotation>
53845416
</xs:any>
53855417
</xs:sequence>
5386-
<xs:attribute name="version" type="xs:integer" default="1">
5418+
<xs:attribute name="version" type="xs:positiveInteger" default="1">
53875419
<xs:annotation>
53885420
<xs:documentation>Whenever an existing BOM is modified, either manually or through automated
53895421
processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with

‎tools/src/test/resources/1.5/invalid-component-ref-1.5.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@
1515
"bom-ref": "123",
1616
"name": "acme-library",
1717
"version": "1.0.0"
18+
},
19+
{
20+
"type": "library",
21+
"bom-ref": "",
22+
"name": "acme-library",
23+
"version": "1.0.0"
1824
}
1925
]
2026
}

‎tools/src/test/resources/1.5/invalid-component-ref-1.5.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@
66
<version>1.0.0</version>
77
<components>
88
<component type="library" bom-ref="123">
9+
<!-- duplicate value in attribute `bom-ref` -->
10+
<name>acme-library</name>
11+
<version>1.0.0</version>
12+
</component>
13+
<component type="library" bom-ref="">
14+
<!-- empty value in attribute `bom-ref` -->
915
<name>acme-library</name>
1016
<version>1.0.0</version>
1117
</component>

‎tools/src/test/resources/1.5/invalid-dependency-1.5.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,12 @@
2727
{
2828
"dependsOn": []
2929
},
30+
{
31+
"ref": "",
32+
"dependsOn": [
33+
"library-a"
34+
]
35+
},
3036
{
3137
"ref": "library-b",
3238
"dependsOn": [

‎tools/src/test/resources/1.5/invalid-dependency-1.5.xml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,17 @@
1515
</component>
1616
</components>
1717
<dependencies>
18-
<dependency />
18+
<dependency>
19+
<!-- invalid: missing attribute `ref` -->
20+
</dependency>
21+
<dependency ref="">
22+
<!-- invalid: attribute `ref` is empty -->
23+
<dependency ref="library-a"/>
24+
</dependency>
1925
<dependency ref="library-b">
20-
<dependency ref="library-c"/>
26+
<dependency ref="library-c">
27+
<!-- valid -->
28+
</dependency>
2129
</dependency>
2230
</dependencies>
2331
</bom>

0 commit comments

Comments
 (0)