Skip to content

[WIP] v1.7 #511

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 68 commits into
base: master
Choose a base branch
from
Draft

[WIP] v1.7 #511

wants to merge 68 commits into from

Conversation

jkowalleck
Copy link
Member

@jkowalleck jkowalleck commented Aug 31, 2024

Note

WORK IN PROGRESS
see progress: https://github.com/CycloneDX/specification/milestone/8


Fixed

  • XML schema: add type for ComponentData sub-elements (#600 via #601)
  • ... TBC ...

Deprecated

  • ... TBD ...

Changed

  • ... TBD ...

Added

  • Support for Streebog hashing algorithm (#485 via #525)
  • Support for external components with version-ranges (#321 via #586)
  • ... TBC ...

Documentation

  • ... TBD ...

Test data

  • Add test data for CycloneDX 1.7 XML, JSON, Protobuf
  • ... TBC ...

@jkowalleck jkowalleck added this to the 1.7 milestone Aug 31, 2024
jkowalleck and others added 28 commits September 2, 2024 23:55
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
1. enabled test runner for schema 1.7
1. copied all test cases from 1.6 to 1.7 
1. renamed the files from `*.1.6.*` to `*.1.7.*`
1. migrated the test cases from schema 1.6 to schema 1.7

see the diff/delta of each individual commit for details

java tests are expected to fail, as long as
#256 is not done
Signed-off-by: Jan Kowalleck <[email protected]>
We often only need the latest docs, while developing a new version.
Therefore, the latest version's docs are generated first.
jkowalleck and others added 23 commits February 5, 2025 18:33
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Fix missing type definitions for ComponentData subelements

Fixes #600
@jkowalleck jkowalleck added defect test-data related to test-resources and -data labels Feb 22, 2025
jkowalleck and others added 3 commits March 6, 2025 10:10
As discussed in ticket #321, this PR adds the following abilities:

- mark components as **external**
  > Determine whether this component is external.
> An external component is one that is not part of an assembly, but is
expected to be provided by the environment, regardless of the
component's `@scope`. This setting can be useful for distinguishing
which components are bundled with the product and which can be relied
upon to be present in the deployment environment.
> This may be set to `true` for runtime components only. For
`/metadata/component`, it must be set to `false`.
- external components may have **version-ranges** instead of a specific
version
> For an external component, this specifies the accepted version range.
> The value must adhere to the Package URL Version Range syntax (vers),
as defined at
<https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst>.
  > May only be used if `.isExternal` is set to `true`.
> Must be used exclusively, either 'version' or 'versionRange', but not
both.


fixes #321 

----


> [!NOTE]
> this one supersedes #326 <-- read there for more background and
previous discussions

implementing with `components`, because the objects referenced/required
are actually used at runtime and therefore are considered a "component".

Sketch/proposal for  #321

- [x] sketch JSON schema  
  - properties and assert
  - test cases 
- [x] sketch XML schema
  - elements & attributes.
no asserts - this would require XSD1.1 which is not broadly implemented,
yet.
  - test cases
- [x] sketch ProtoBuff schema  
  - fields
  - test cases

----


> [!NOTE]
> ALL FEEDBACK IS WELCOME! Yes, everything.
> but some might not be resolved in this very PR, but in the
authoritative guides. See
#586 (comment)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
defect proposed core enhancement test-data related to test-resources and -data
Projects
None yet
4 participants