diff --git a/schema/bom-1.7.proto b/schema/bom-1.7.proto index 2f1aaf0d..d41a810a 100644 --- a/schema/bom-1.7.proto +++ b/schema/bom-1.7.proto @@ -218,6 +218,8 @@ message ExternalReference { optional string comment = 3; // Optional integrity hashes for the external resource content repeated Hash hashes = 4; + // Specifies optional, custom, properties + repeated Property properties = 5; } enum ExternalReferenceType { diff --git a/schema/bom-1.7.schema.json b/schema/bom-1.7.schema.json index e1dd5b1d..7bb633f4 100644 --- a/schema/bom-1.7.schema.json +++ b/schema/bom-1.7.schema.json @@ -1827,6 +1827,12 @@ "items": {"$ref": "#/definitions/hash"}, "title": "Hashes", "description": "The hashes of the external reference (if applicable)." + }, + "properties": { + "type": "array", + "title": "Properties", + "description": "Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.", + "items": {"$ref": "#/definitions/property"} } } }, diff --git a/schema/bom-1.7.xsd b/schema/bom-1.7.xsd index 594d2bfb..f4e3acb7 100644 --- a/schema/bom-1.7.xsd +++ b/schema/bom-1.7.xsd @@ -1597,6 +1597,16 @@ limitations under the License. + + + Provides the ability to document properties in a name/value store. + This provides flexibility to include data not officially supported in the standard + without having to use additional namespaces or create extensions. Property names + of interest to the general public are encouraged to be registered in the + CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. + Formal registration is optional. + + diff --git a/tools/src/test/resources/1.7/valid-external-reference-properties-1.7.json b/tools/src/test/resources/1.7/valid-external-reference-properties-1.7.json new file mode 100644 index 00000000..dba73c1d --- /dev/null +++ b/tools/src/test/resources/1.7/valid-external-reference-properties-1.7.json @@ -0,0 +1,30 @@ +{ + "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json", + "bomFormat": "CycloneDX", + "specVersion": "1.7", + "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", + "version": 1, + "components": [ + { + "type": "application", + "name": "dummy", + "description": "this component has an external reference with properties", + "externalReferences": [ + { + "type": "component-analysis-report", + "url": "http://example.com/extref/component-analysis-report", + "properties": [ + { + "name": "author", + "value": "John Doe" + }, + { + "name": "timestamp", + "value": "2025-01-27T12:27:26Z" + } + ] + } + ] + } + ] +} diff --git a/tools/src/test/resources/1.7/valid-external-reference-properties-1.7.textproto b/tools/src/test/resources/1.7/valid-external-reference-properties-1.7.textproto new file mode 100644 index 00000000..760e7d42 --- /dev/null +++ b/tools/src/test/resources/1.7/valid-external-reference-properties-1.7.textproto @@ -0,0 +1,23 @@ +# proto-file: schema/bom-1.7.proto +# proto-message: Bom + +spec_version: "1.7" +version: 1 +serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" +components { + type: CLASSIFICATION_APPLICATION + name: "dummy" + description: "this component has an external reference with properties" + external_references { + type: EXTERNAL_REFERENCE_TYPE_COMPONENT_ANALYSIS_REPORT + url: "http://example.com/extref/component-analysis-report" + properties { + name: "author" + value: "John Doe" + } + properties { + name: "timestamp" + value: "2025-01-27T12:27:26Z" + } + } +} diff --git a/tools/src/test/resources/1.7/valid-external-reference-properties-1.7.xml b/tools/src/test/resources/1.7/valid-external-reference-properties-1.7.xml new file mode 100644 index 00000000..1adbd451 --- /dev/null +++ b/tools/src/test/resources/1.7/valid-external-reference-properties-1.7.xml @@ -0,0 +1,18 @@ + + + + + dummy + this component has an external reference with properties + + + http://example.com/extref/component-analysis-report + + John Doe + 2025-01-27T12:27:26Z + + + + + +