Skip to content

Commit bcdcaca

Browse files
jkowalleckjkowalleck
authored
Merge branch '1.7-dev' into 1.7-dev-citations
2 parents f315e00 + e95af17 commit bcdcaca

11 files changed

+696
-41
lines changed

‎schema/bom-1.7.proto‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ message Component {
125125
optional Scope scope = 11;
126126
// The hashes of the component.
127127
repeated Hash hashes = 12;
128-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)
128+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
129129
repeated LicenseChoice licenses = 13;
130130
// An optional copyright notice informing users of the underlying claims to copyright ownership in a published work.
131131
optional string copyright = 14;
@@ -577,7 +577,7 @@ message Metadata {
577577
// The organization that supplied the component that the BOM describes. The supplier may often be the manufacture, but may also be a distributor or repackager.
578578
optional OrganizationalEntity supplier = 6;
579579
// The license information for the BOM document. This may be different from the license(s) of the component(s) that the BOM describes.
580-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)
580+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
581581
repeated LicenseChoice licenses = 7;
582582
// Specifies optional, custom, properties
583583
repeated Property properties = 8;
@@ -714,7 +714,7 @@ message Service {
714714
optional bool x_trust_boundary = 9;
715715
// Specifies information about the data including the directional flow of data and the data classification.
716716
repeated DataFlow data = 10;
717-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)
717+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
718718
repeated LicenseChoice licenses = 11;
719719
// Provides the ability to document external references related to the service.
720720
repeated ExternalReference external_references = 12;
@@ -836,7 +836,7 @@ message EvidenceCopyright {
836836

837837
// Provides the ability to document evidence collected through various forms of extraction or analysis.
838838
message Evidence {
839-
// EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)
839+
// A list of SPDX licenses and/or named licenses and/or SPDX License Expression.
840840
repeated LicenseChoice licenses = 1;
841841
// Copyright evidence captures intellectual property assertions, providing evidence of possible ownership and legal protection.
842842
repeated EvidenceCopyright copyright = 2;

‎schema/bom-1.7.schema.json‎

Lines changed: 27 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1532,36 +1532,31 @@
15321532
},
15331533
"licenseChoice": {
15341534
"title": "License Choice",
1535-
"description": "EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one SPDX License Expression)",
1535+
"description": "A list of SPDX licenses and/or named licenses and/or SPDX License Expression.",
15361536
"type": "array",
1537-
"oneOf": [
1538-
{
1539-
"title": "Multiple licenses",
1540-
"description": "A list of SPDX licenses and/or named licenses.",
1541-
"type": "array",
1542-
"items": {
1537+
"items": {
1538+
"oneOf": [
1539+
{
15431540
"type": "object",
15441541
"title": "License",
1545-
"required": ["license"],
1542+
"required": [
1543+
"license"
1544+
],
15461545
"additionalProperties": false,
15471546
"properties": {
1548-
"license": {"$ref": "#/definitions/license"}
1547+
"license": {
1548+
"$ref": "#/definitions/license"
1549+
}
15491550
}
1550-
}
1551-
},
1552-
{
1553-
"title": "SPDX License Expression",
1554-
"description": "A tuple of exactly one SPDX License Expression.",
1555-
"type": "array",
1556-
"additionalItems": false,
1557-
"minItems": 1,
1558-
"maxItems": 1,
1559-
"items": [{
1551+
},
1552+
{
15601553
"title": "License Expression",
15611554
"description": "Specifies the details and attributes related to a software license.\nIt must be a valid SPDX license expression, along with additional properties such as license acknowledgment.",
15621555
"type": "object",
15631556
"additionalProperties": false,
1564-
"required": ["expression"],
1557+
"required": [
1558+
"expression"
1559+
],
15651560
"properties": {
15661561
"expression": {
15671562
"type": "string",
@@ -1607,7 +1602,9 @@
16071602
"type": "string",
16081603
"title": "License URL",
16091604
"description": "The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness",
1610-
"examples": ["https://www.apache.org/licenses/LICENSE-2.0.txt"],
1605+
"examples": [
1606+
"https://www.apache.org/licenses/LICENSE-2.0.txt"
1607+
],
16111608
"format": "iri-reference"
16121609
}
16131610
},
@@ -1622,17 +1619,21 @@
16221619
"title": "BOM Reference",
16231620
"description": "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
16241621
},
1625-
"licensing": {"$ref": "#/definitions/licensing"},
1622+
"licensing": {
1623+
"$ref": "#/definitions/licensing"
1624+
},
16261625
"properties": {
16271626
"type": "array",
16281627
"title": "Properties",
16291628
"description": "Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.",
1630-
"items": {"$ref": "#/definitions/property"}
1629+
"items": {
1630+
"$ref": "#/definitions/property"
1631+
}
16311632
}
16321633
}
1633-
}]
1634-
}
1635-
]
1634+
}
1635+
]
1636+
}
16361637
},
16371638
"commit": {
16381639
"type": "object",

‎schema/bom-1.7.xsd‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2561,10 +2561,13 @@ limitations under the License.
25612561
</xs:simpleType>
25622562

25632563
<xs:complexType name="licenseChoiceType">
2564-
<xs:choice>
2565-
<xs:element name="license" type="bom:licenseType" minOccurs="0" maxOccurs="unbounded"/>
2566-
<xs:element name="expression" type="bom:licenseExpressionType" minOccurs="0" maxOccurs="1" />
2567-
<xs:element name="expression-detailed" type="bom:licenseExpressionDetailedType" minOccurs="0" maxOccurs="1" />
2564+
<xs:annotation>
2565+
<xs:documentation>A list of SPDX licenses and/or named licenses and/or SPDX License Expression.</xs:documentation>
2566+
</xs:annotation>
2567+
<xs:choice minOccurs="0" maxOccurs="unbounded">
2568+
<xs:element name="license" type="bom:licenseType"/>
2569+
<xs:element name="expression" type="bom:licenseExpressionType"/>
2570+
<xs:element name="expression-detailed" type="bom:licenseExpressionDetailedType"/>
25682571
</xs:choice>
25692572
</xs:complexType>
25702573

‎tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.json‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.6",
5+
"serialNumber": "urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42",
6+
"version": 1,
7+
"metadata": {
8+
"lifecycles": [{"phase": "design"}]
9+
},
10+
"components": [
11+
{
12+
"type": "library",
13+
"group": "com.example",
14+
"name": "situation-A",
15+
"version": "1",
16+
"description": "Multiple licenses: declared ids/names, and a concluded expression",
17+
"licenses": [
18+
{
19+
"license": {
20+
"id": "MIT",
21+
"acknowledgement": "declared"
22+
}
23+
},
24+
{
25+
"license": {
26+
"id": "PostgreSQL",
27+
"acknowledgement": "declared"
28+
}
29+
},
30+
{
31+
"license": {
32+
"name": "Apache Software License",
33+
"acknowledgement": "declared"
34+
}
35+
},
36+
{
37+
"expression": "(MIT OR PostgreSQL OR Apache-2.0)",
38+
"acknowledgement": "concluded"
39+
}
40+
]
41+
},
42+
{
43+
"type": "library",
44+
"group": "com.example",
45+
"name": "situation-B",
46+
"version": "1",
47+
"description": "Multiple license expressions: one declared, one concluded",
48+
"licenses": [
49+
{
50+
"expression": "MIT OR (GPL-3.0 OR GPL-2.0)",
51+
"acknowledgement": "declared"
52+
},
53+
{
54+
"expression": "(GPL-3.0-only AND LGPL-2.0-only)",
55+
"acknowledgement": "concluded"
56+
}
57+
]
58+
},
59+
{
60+
"type": "library",
61+
"group": "com.example",
62+
"name": "situation-C",
63+
"version": "1",
64+
"description": "Multiple license: one declared expression, one concluded id",
65+
"licenses": [
66+
{
67+
"expression": "GPL-3.0-or-later OR GPL-2.0",
68+
"acknowledgement": "declared"
69+
},
70+
{
71+
"license": {
72+
"id": "GPL-3.0-only",
73+
"acknowledgement": "concluded"
74+
}
75+
}
76+
]
77+
}
78+
]
79+
}

‎tools/src/test/resources/1.6/invalid-license-declared-concluded-mix-1.6.xml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?xml version="1.0"?>
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.6"
3+
serialNumber="urn:uuid:df628836-6b9b-41c9-a724-b44743c54d42"
4+
>
5+
<!--
6+
All license posture in here is for show-case ony.
7+
This is not a real law-case!
8+
-->
9+
<metadata>
10+
<lifecycles><lifecycle><phase>design</phase></lifecycle></lifecycles>
11+
</metadata>
12+
<components>
13+
<component type="library">
14+
<group>com.example</group>
15+
<name>situation-A</name>
16+
<version>1</version>
17+
<description>Multiple licenses: declared ids/names, and a concluded expression</description>
18+
<licenses>
19+
<license acknowledgement="declared"><id>MIT</id></license>
20+
<license acknowledgement="declared"><id>PostgreSQL</id></license>
21+
<license acknowledgement="declared"><name>Apache Software License</name></license>
22+
<expression acknowledgement="concluded">(MIT OR PostgreSQL OR Apache-2.0)</expression>
23+
</licenses>
24+
</component>
25+
<component type="library">
26+
<group>com.example</group>
27+
<name>situation-B</name>
28+
<version>1</version>
29+
<description>Multiple license expressions: one declared, one concluded</description>
30+
<licenses>
31+
<expression acknowledgement="declared">MIT OR (GPL-3.0 OR GPL-2.0)</expression>
32+
<expression acknowledgement="concluded">(GPL-3.0-only AND LGPL-2.0-only)</expression>
33+
</licenses>
34+
</component>
35+
<component type="library">
36+
<group>com.example</group>
37+
<name>situation-C</name>
38+
<version>1</version>
39+
<description>Multiple license: one declared expression, one concluded id</description>
40+
<licenses>
41+
<expression acknowledgement="declared">GPL-3.0-or-later OR GPL-2.0</expression>
42+
<license acknowledgement="concluded"><id>GPL-3.0-only</id></license>
43+
</licenses>
44+
</component>
45+
</components>
46+
</bom>

‎tools/src/test/resources/1.7/valid-license-choice-1.7.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.7",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"components": [
8+
{
9+
"type": "application",
10+
"publisher": "Acme Inc",
11+
"group": "com.acme",
12+
"name": "tomcat-catalina",
13+
"version": "9.0.14",
14+
"description": "Modified version of Apache Catalina",
15+
"scope": "required",
16+
"licenses": [
17+
{
18+
"license": {
19+
"id": "Apache-2.0"
20+
}
21+
},
22+
{
23+
"expression": "EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0"
24+
},
25+
{
26+
"license": {
27+
"name": "My Own License",
28+
"text": {
29+
"content": "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua."
30+
}
31+
}
32+
},
33+
{
34+
"expression": "LicenseRef-MIT-Style-2",
35+
"expressionDetails": [
36+
{
37+
"licenseIdentifier": "LicenseRef-MIT-Style-2",
38+
"url": "https://example.com/license"
39+
}
40+
]
41+
}
42+
]
43+
}
44+
]
45+
}

‎tools/src/test/resources/1.7/valid-license-choice-1.7.textproto‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# proto-file: schema/bom-1.7.proto
2+
# proto-message: Bom
3+
4+
# All license posture in here is for show-case ony.
5+
# This is not a real law-case!
6+
7+
spec_version: "1.7"
8+
serial_number: "urn:uuid:b1ef52c6-7cd8-43d5-9e42-5e69044bbe9e"
9+
version: 1
10+
components {
11+
type: CLASSIFICATION_APPLICATION
12+
publisher: "Acme Inc"
13+
group: "com.acme"
14+
name: "tomcat-catalina"
15+
version: "9.0.14"
16+
description: "Modified version of Apache Catalina"
17+
scope: SCOPE_REQUIRED
18+
licenses {
19+
license {
20+
id: "Apache-2.0"
21+
}
22+
}
23+
licenses {
24+
expression: "EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0"
25+
}
26+
licenses {
27+
license {
28+
name: "My Own License"
29+
text {
30+
value: "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua."
31+
}
32+
}
33+
}
34+
licenses {
35+
expression_detailed {
36+
expression: "LicenseRef-MIT-Style-2"
37+
details {
38+
license_identifier: "LicenseRef-MIT-Style-2"
39+
url: "https://example.com/license"
40+
}
41+
}
42+
}
43+
}

‎tools/src/test/resources/1.7/invalid-license-choice-1.7.xml‎ renamed to ‎tools/src/test/resources/1.7/valid-license-choice-1.7.xml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
<?xml version="1.0"?>
2-
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.7">
2+
<bom xmlns="http://cyclonedx.org/schema/bom/1.7"
3+
serialNumber="urn:uuid:b1ef52c6-7cd8-43d5-9e42-5e69044bbe9e"
4+
version="1"
5+
>
36
<components>
47
<component type="application">
58
<publisher>Acme Inc</publisher>
@@ -8,17 +11,20 @@
811
<version>9.0.14</version>
912
<description>Modified version of Apache Catalina</description>
1013
<scope>required</scope>
11-
<hashes>
12-
<hash alg="MD5">3942447fac867ae5cdb3229b658f4d48</hash>
13-
<hash alg="SHA-1">e6b1000b94e835ffd37f4c6dcbdad43f4b48a02a</hash>
14-
<hash alg="SHA-256">f498a8ff2dd007e29c2074f5e4b01a9a01775c3ff3aeaf6906ea503bc5791b7b</hash>
15-
<hash alg="SHA-512">e8f33e424f3f4ed6db76a482fde1a5298970e442c531729119e37991884bdffab4f9426b7ee11fccd074eeda0634d71697d6f88a460dce0ac8d627a29f7d1282</hash>
16-
</hashes>
1714
<licenses>
1815
<license>
1916
<id>Apache-2.0</id>
2017
</license>
2118
<expression>EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0</expression>
19+
<license>
20+
<name>My Own License</name>
21+
<text><![CDATA[Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.]]></text>
22+
</license>
23+
<expression-detailed expression="LicenseRef-MIT-Style-2">
24+
<details license-identifier="LicenseRef-MIT-Style-2">
25+
<url>https://example.com/license</url>
26+
</details>
27+
</expression-detailed>
2228
</licenses>
2329
<purl>pkg:maven/com.acme/tomcat-catalina@9.0.14?packaging=jar</purl>
2430
</component>

0 commit comments

Comments
 (0)