Skip to content

Commit 930992c

Browse files
jkowalleckjkowalleck
authored
[1.7] - Updates from CBOM working group (#657)
The cryptography working group has received feedback from real-world usage and have made enhancements to the CBOM specificaiton: - enum `CryptoProperties.AlgorithmProperties.CryptoPrimitive` got a new case "key-wrap". - added field `CryptoProperties.AlgorithmProperties.algorithmFamily` - added field `CryptoProperties.AlgorithmProperties.ellipticCurve` - deprecated field `CryptoProperties.AlgorithmProperties.curve` - added field `CryptoProperties.CertificateProperties.serialNumber` - added field `CryptoProperties.CertificateProperties.certificateFileExtension` - deprecated field `CryptoProperties.CertificateProperties.certificateExtension` - deprecated field `CryptoProperties.CertificateProperties.signatureAlgorithmRef` - deprecated field `CryptoProperties.CertificateProperties.subjectPublicKeyRef` - added field `CryptoProperties.CertificateProperties.fingerprint` - added field `CryptoProperties.CertificateProperties.certificateState` - added field `CryptoProperties.CertificateProperties.creationDate` - added field `CryptoProperties.CertificateProperties.activationDate` - added field `CryptoProperties.CertificateProperties.deactivationDate` - added field `CryptoProperties.CertificateProperties.revocationDate` - added field `CryptoProperties.CertificateProperties.destructionDate` - added field `CryptoProperties.CertificateProperties.certificateExtensions` - added field `CryptoProperties.CertificateProperties.relatedCryptographicAssets` - deprecated field `CryptoProperties.RelatedCryptoMaterialProperties.algorithmRef` - added field `CryptoProperties.RelatedCryptoMaterialProperties.fingerprint` - added field `CryptoProperties.RelatedCryptoMaterialProperties.relatedCryptographicAssets` - enum `CryptoProperties.ProtocolProperties.CryptoProtocolType` got new cases: `DTLS`, `QUIC`, `AKA`, `AKA_PRIME`, `PRINS` , `5G_AKA` - added field `CryptoProperties.ProtocolProperties.CryptoProtocolCipherSuite.tlsGroups` - added field `CryptoProperties.ProtocolProperties.CryptoProtocolCipherSuite.tlsSignatureSchemes` - deprecated ikev2Trans information as strings (BOM-links) - added capabilities to capture ikev2Trans information in detailed form - added field `CryptoProperties.CertificateProperties.relatedCryptographicAssets` ---- Closes #569 ----- RFC notice sent 2025-07-26 This RFC will be open for 4 weeks. At the end of the RFC period the CycloneDX community will vote, by lazy consensus, to accept or reject the proposal. RFC period end: 2025-08-23 ---- TODO/DONE - [x] add examples for XML - [x] add examples for JSON - [x] add examples for ProtoBuf - [x] implement for XML - [x] implement for JSON - [x] implement for ProtoBuf
2 parents c4f5402 + ccd758f commit 930992c

28 files changed

+8462
-293
lines changed

‎schema/bom-1.7.proto‎

Lines changed: 229 additions & 10 deletions
Large diffs are not rendered by default.

‎schema/bom-1.7.schema.json‎

Lines changed: 505 additions & 22 deletions
Large diffs are not rendered by default.

‎schema/bom-1.7.xsd‎

Lines changed: 613 additions & 5 deletions
Large diffs are not rendered by default.

‎schema/cryptography-defs.json‎

Lines changed: 3793 additions & 0 deletions
Large diffs are not rendered by default.

‎schema/cryptography-defs.schema.json‎

Lines changed: 576 additions & 0 deletions
Large diffs are not rendered by default.

‎tools/src/main/python/algorithmFamilyGeneration.py‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env python3
2+
3+
from json import dump as json_dump, load as json_load
4+
from datetime import datetime, timezone
5+
from pathlib import Path
6+
from typing import Any, Dict, List
7+
8+
# config
9+
SCHEMA_DIR = Path(__file__).parent.parent.parent.parent.parent / "schema"
10+
DEFS_FILE = SCHEMA_DIR / "cryptography-defs.json"
11+
SCHEMA_FILE = SCHEMA_DIR / "cryptography-defs.schema.json"
12+
13+
# Step 1: Load JSON data safely using context managers
14+
with DEFS_FILE.open("r", encoding="utf-8") as defs_file:
15+
defs_data: Dict[str, List[Dict[str, Any]]] = json_load(defs_file)
16+
17+
with SCHEMA_FILE.open("r", encoding="utf-8") as schema_file:
18+
schema_data: Dict[str, Any] = json_load(schema_file)
19+
20+
# Step 2: Extract unique algorithm families and sort them
21+
families: List[str] = sorted({algo['family'] for algo in defs_data.get('algorithms', [])})
22+
23+
# Step 3: Update the schema with the extracted families
24+
try:
25+
schema_properties = schema_data['properties']
26+
except KeyError as e:
27+
raise KeyError(f"Required schema property 'properties' missing: {e}")
28+
29+
schema_data['$comment'] = datetime.now(timezone.utc).replace(microsecond=0) \
30+
.isoformat().replace('+00:00', 'Z')
31+
32+
schema_data['definitions']['algorithmFamiliesEnum'] = {
33+
"type": "string",
34+
"title": "Algorithm Families",
35+
"description": "An enum for the algorithm families.",
36+
"enum": families,
37+
}
38+
39+
# Step 4: Write the updated schema back to the file
40+
with SCHEMA_FILE.open("w", encoding="utf-8") as update_file:
41+
json_dump(schema_data, update_file, indent=2, ensure_ascii=False)
42+
43+
print("Schema updated successfully.")

‎tools/src/test/java/org/cyclonedx/schema/JsonSchemaVerificationTest.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ class JsonSchemaVerificationTest extends BaseSchemaVerificationTest {
4747

4848
private static final String JSF_NAMESPACE = "http://cyclonedx.org/schema/jsf-0.82.schema.json";
4949
private static final String SPDX_NAMESPACE = "http://cyclonedx.org/schema/spdx.schema.json";
50+
private static final String CRYPTO_DEF_NAMESPACE = "http://cyclonedx.org/schema/cryptography-defs.schema.json";
5051

5152
private static final JsonSchema VERSION_12;
5253
private static final JsonSchema VERSION_13;
@@ -69,8 +70,9 @@ public JsonMetaSchema getMetaSchema(
6970
.metaSchemaFactory(metaSchemaFactory)
7071
.schemaLoaders(b -> b.add(new ClasspathSchemaLoader()).add(DisallowSchemaLoader.getInstance()))
7172
.schemaMappers(b -> b.mapPrefix(SPDX_NAMESPACE, "classpath:spdx.schema.json")
72-
.mapPrefix(JSF_NAMESPACE, "classpath:jsf-0.82.schema.json"))
73-
.build();
73+
.mapPrefix(JSF_NAMESPACE, "classpath:jsf-0.82.schema.json")
74+
.mapPrefix(CRYPTO_DEF_NAMESPACE, "classpath:cryptography-defs.schema.json")
75+
).build();
7476
VERSION_12 = factory.getSchema(SchemaLocation.of("classpath:bom-1.2-strict.schema.json"));
7577
VERSION_13 = factory.getSchema(SchemaLocation.of("classpath:bom-1.3-strict.schema.json"));
7678
VERSION_14 = factory.getSchema(SchemaLocation.of("classpath:bom-1.4.schema.json"));

‎tools/src/test/js/json-schema-functional-tests.js‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,10 @@ console.debug('DEBUG | testdataDir = ', testdataDir);
4444

4545
// region validator
4646

47-
const [spdxSchema, jsfSchema, bomSchema] = await Promise.all([
47+
const [spdxSchema, jsfSchema, cryptoDefsSchema, bomSchema] = await Promise.all([
4848
readFile(join(schemaDir, 'spdx.schema.json'), 'utf-8').then(JSON.parse),
4949
readFile(join(schemaDir, 'jsf-0.82.schema.json'), 'utf-8').then(JSON.parse),
50+
readFile(join(schemaDir, 'cryptography-defs.schema.json'), 'utf-8').then(JSON.parse),
5051
readFile(schemaFile, 'utf-8').then(JSON.parse)
5152
])
5253

@@ -57,7 +58,8 @@ const ajv = new Ajv({
5758
addUsedSchema: false,
5859
schemas: {
5960
'http://cyclonedx.org/schema/spdx.schema.json': spdxSchema,
60-
'http://cyclonedx.org/schema/jsf-0.82.schema.json': jsfSchema
61+
'http://cyclonedx.org/schema/jsf-0.82.schema.json': jsfSchema,
62+
'http://cyclonedx.org/schema/cryptography-defs.schema.json': cryptoDefsSchema,
6163
}
6264
});
6365
addFormats(ajv)
@@ -113,4 +115,4 @@ for (const file of globSync(join(testdataDir, 'invalid-*.json'))) {
113115

114116
// Exit statuses should be in the range 0 to 254.
115117
// The status 0 is used to terminate the program successfully.
116-
process.exitCode = Math.min(errCnt, 254)
118+
process.exitCode = Math.min(errCnt, 254)

‎tools/src/test/js/json-schema-lint-tests.js‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,10 @@ const schemaDir = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..'
1717

1818
// endregion config
1919

20-
const [spdxSchema, jsfSchema, bomSchemas] = await Promise.all([
20+
const [spdxSchema, jsfSchema, cryptoDefsSchema, bomSchemas] = await Promise.all([
2121
readFile(join(schemaDir, 'spdx.schema.json'), 'utf-8').then(JSON.parse),
2222
readFile(join(schemaDir, 'jsf-0.82.schema.json'), 'utf-8').then(JSON.parse),
23+
readFile(join(schemaDir, 'cryptography-defs.schema.json'), 'utf-8').then(JSON.parse),
2324
glob(join(schemaDir, bomSchemasGlob)).then(l => l.sort())
2425
])
2526
assert.notStrictEqual(bomSchemas.length, 0)
@@ -53,7 +54,8 @@ function getAjv(strict) {
5354
keywords: ["meta:enum"],
5455
schemas: {
5556
'http://cyclonedx.org/schema/spdx.schema.json': spdxSchema,
56-
'http://cyclonedx.org/schema/jsf-0.82.schema.json': jsfSchema
57+
'http://cyclonedx.org/schema/jsf-0.82.schema.json': jsfSchema,
58+
'http://cyclonedx.org/schema/cryptography-defs.schema.json': cryptoDefsSchema,
5759
}
5860
});
5961
addFormats(ajv)
@@ -112,4 +114,4 @@ for (const bomSchemaFile of bomSchemas) {
112114

113115
// Exit statuses should be in the range 0 to 254.
114116
// The status 0 is used to terminate the program successfully.
115-
process.exitCode = Math.min(errCnt, 254)
117+
process.exitCode = Math.min(errCnt, 254)

‎tools/src/test/proto/test.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ function schema-breaking-version () {
5454
NEW_NP="$(mktemp)"
5555
OLD_NP="$(mktemp)"
5656

57-
# remove package identifier -> so that the comparisson works as expected
57+
# remove package identifier -> so that the comparison works as expected
5858
sed 's/^package .*//' "${ROOT_PATH}/${SCHEMA_DIR}/${NEW}" > "$NEW_NP"
5959
sed 's/^package .*//' "${ROOT_PATH}/${SCHEMA_DIR}/${OLD}" > "$OLD_NP"
6060

0 commit comments

Comments
 (0)