feat: external reference type for RFC-9116 (#381)

fixes #380
CycloneDX · Feb 22, 2024 · b5ae1b3 · b5ae1b3
2 parents 2734b3f + 138e249
commit b5ae1b3
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 0 deletions.
diff --git a/schema/bom-1.6.proto b/schema/bom-1.6.proto
@@ -286,6 +286,8 @@ enum ExternalReferenceType {
   EXTERNAL_REFERENCE_TYPE_ELECTRONIC_SIGNATURE = 39;
   // A signature that leverages cryptography, typically public/private key pairs, which provides strong authenticity verification.
   EXTERNAL_REFERENCE_TYPE_DIGITAL_SIGNATURE = 40;
+  // Document that complies with RFC-9116 (A File Format to Aid in Security Vulnerability Disclosure)
+  EXTERNAL_REFERENCE_TYPE_RFC_9116 = 41;
 }
 
 enum HashAlg {

diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json
@@ -1712,6 +1712,7 @@
             "poam",
             "electronic-signature",
             "digital-signature",
+            "rfc-9116",
             "other"
           ],
           "meta:enum": {
@@ -1756,6 +1757,7 @@
             "poam": "Plans of Action and Milestones (POAM) complement an \"attestation\" external reference. POAM is defined by NIST as a \"document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks and scheduled completion dates for the milestones\".",
             "electronic-signature": "An e-signature is commonly a scanned representation of a written signature or a stylized script of the persons name.",
             "digital-signature": "A signature that leverages cryptography, typically public/private key pairs, which provides strong authenticity verification.",
+            "rfc-9116": "Document that complies with RFC-9116 (A File Format to Aid in Security Vulnerability Disclosure)",
             "other": "Use this if no other types accurately describe the purpose of the external reference."
           }
 

diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd
@@ -1479,6 +1479,11 @@ limitations under the License.
                     <xs:documentation>A signature that leverages cryptography, typically public/private key pairs, which provides strong authenticity verification.</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
+            <xs:enumeration value="rfc-9116">
+                <xs:annotation>
+                    <xs:documentation>Document that complies with RFC-9116 (A File Format to Aid in Security Vulnerability Disclosure)</xs:documentation>
+                </xs:annotation>
+            </xs:enumeration>
             <xs:enumeration value="other">
                 <xs:annotation>
                     <xs:documentation>Use this if no other types accurately describe the purpose of the external reference</xs:documentation>