Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added additional external references #189

Merged
merged 1 commit into from
Apr 9, 2023
Merged

Added additional external references #189

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions schema/bom-1.5.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,34 @@ enum ExternalReferenceType {
EXTERNAL_REFERENCE_TYPE_BUILD_SYSTEM = 14;
// Specifies a way to contact the maintainer, supplier, or provider in the event of a security incident. Common URIs include links to a disclosure procedure, a mailto (RFC-2368) that specifies an email address, a tel (RFC-3966) that specifies a phone number, or dns (RFC-4501]) that specifies the records containing DNS Security TXT.
EXTERNAL_REFERENCE_TYPE_SECURITY_CONTACT = 15;
// Human or machine-readable statements containing facts, evidence, or testimony
EXTERNAL_REFERENCE_TYPE_ATTESTATION = 16;
// An enumeration of identified weaknesses, threats, and countermeasures, dataflow diagram (DFD), attack tree, and other supporting documentation in human-readable or machine-readable format
EXTERNAL_REFERENCE_TYPE_THREAT_MODEL = 17;
// The location where a component was published to. This is often the same as "distribution" but may also include specialized publishing processes that act as an intermediary
EXTERNAL_REFERENCE_TYPE_DISTRIBUTION_INTAKE = 18;
// A Vulnerability Disclosure Report (VDR) which asserts the known and previously unknown vulnerabilities that affect a component, service, or product including the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on a component, service, or product
EXTERNAL_REFERENCE_TYPE_VULNERABILITY_ASSERTION = 19;
// A Vulnerability Exploitability eXchange (VEX) which asserts the known vulnerabilities that do not affect a product, product family, or organization, and optionally the ones that do. The VEX should include the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on the product, product family, or organization
EXTERNAL_REFERENCE_TYPE_EXPLOITABILITY_STATEMENT = 20;
// Results from an authorized simulated cyberattack on a component or service, otherwise known as a penetration test
EXTERNAL_REFERENCE_TYPE_PENTEST_REPORT = 21;
// SARIF or proprietary machine or human-readable report for which static analysis has identified code quality, security, and other potential issues with the source code
EXTERNAL_REFERENCE_TYPE_STATIC_ANALYSIS_REPORT = 22;
// Dynamic analysis report that has identified issues such as vulnerabilities and misconfigurations
EXTERNAL_REFERENCE_TYPE_DYNAMIC_ANALYSIS_REPORT = 23;
// Report generated by analyzing the call stack of a running application
EXTERNAL_REFERENCE_TYPE_RUNTIME_ANALYSIS_REPORT = 24;
// Report generated by Software Composition Analysis (SCA), container analysis, or other forms of component analysis
EXTERNAL_REFERENCE_TYPE_COMPONENT_ANALYSIS_REPORT = 25;
// Report containing a formal assessment of an organization, business unit, or team against a maturity model
EXTERNAL_REFERENCE_TYPE_MATURITY_REPORT = 26;
// Industry, regulatory, or other certification from an accredited (if applicable) certification body
EXTERNAL_REFERENCE_TYPE_CERTIFICATION_REPORT = 27;
// Report or system in which quality metrics can be obtained
EXTERNAL_REFERENCE_TYPE_QUALITY_METRICS = 28;
// Code or configuration that defines and provisions virtualized infrastructure, commonly referred to as Infrastructure as Code (IaC)
EXTERNAL_REFERENCE_TYPE_CODIFIED_INFRASTRUCTURE = 29;
}

enum HashAlg {
Expand Down
16 changes: 15 additions & 1 deletion schema/bom-1.5.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1028,7 +1028,7 @@
"type": {
"type": "string",
"title": "Type",
"description": "Specifies the type of external reference.\n\n* __vcs__ = Version Control System\n* __issue-tracker__ = Issue or defect tracking system, or an Application Lifecycle Management (ALM) system\n* __website__ = Website\n* __advisories__ = Security advisories\n* __bom__ = Bill of Materials (SBOM, OBOM, HBOM, SaaSBOM, etc)\n* __mailing-list__ = Mailing list or discussion group\n* __social__ = Social media account\n* __chat__ = Real-time chat platform\n* __documentation__ = Documentation, guides, or how-to instructions\n* __support__ = Community or commercial support\n* __distribution__ = Direct or repository download location\n* __license__ = The URL to the license file. If a license URL has been defined in the license node, it should also be defined as an external reference for completeness\n* __build-meta__ = Build-system specific meta file (i.e. pom.xml, package.json, .nuspec, etc)\n* __build-system__ = URL to an automated build system\n* __release-notes__ = URL to release notes\n* __security-contact__ = Specifies a way to contact the maintainer, supplier, or provider in the event of a security incident. Common URIs include links to a disclosure procedure, a mailto (RFC-2368) that specifies an email address, a tel (RFC-3966) that specifies a phone number, or dns (RFC-4501]) that specifies the records containing DNS Security TXT\n* __other__ = Use this if no other types accurately describe the purpose of the external reference",
"description": "Specifies the type of external reference.\n\n* __vcs__ = Version Control System\n* __issue-tracker__ = Issue or defect tracking system, or an Application Lifecycle Management (ALM) system\n* __website__ = Website\n* __advisories__ = Security advisories\n* __bom__ = Bill of Materials (SBOM, OBOM, HBOM, SaaSBOM, etc)\n* __mailing-list__ = Mailing list or discussion group\n* __social__ = Social media account\n* __chat__ = Real-time chat platform\n* __documentation__ = Documentation, guides, or how-to instructions\n* __support__ = Community or commercial support\n* __distribution__ = Direct or repository download location\n* __distribution-intake__ = The location where a component was published to. This is often the same as \"distribution\" but may also include specialized publishing processes that act as an intermediary\n* __license__ = The URL to the license file. If a license URL has been defined in the license node, it should also be defined as an external reference for completeness\n* __build-meta__ = Build-system specific meta file (i.e. pom.xml, package.json, .nuspec, etc)\n* __build-system__ = URL to an automated build system\n* __release-notes__ = URL to release notes\n* __security-contact__ = Specifies a way to contact the maintainer, supplier, or provider in the event of a security incident. Common URIs include links to a disclosure procedure, a mailto (RFC-2368) that specifies an email address, a tel (RFC-3966) that specifies a phone number, or dns (RFC-4501]) that specifies the records containing DNS Security TXT\n* __attestation__ = Human or machine-readable statements containing facts, evidence, or testimony\n* __threat-model__ = An enumeration of identified weaknesses, threats, and countermeasures, dataflow diagram (DFD), attack tree, and other supporting documentation in human-readable or machine-readable format\n* __vulnerability-assertion__ = A Vulnerability Disclosure Report (VDR) which asserts the known and previously unknown vulnerabilities that affect a component, service, or product including the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on a component, service, or product.\n* __exploitability-statement__ = A Vulnerability Exploitability eXchange (VEX) which asserts the known vulnerabilities that do not affect a product, product family, or organization, and optionally the ones that do. The VEX should include the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on the product, product family, or organization.\n* __pentest-report__ = Results from an authorized simulated cyberattack on a component or service, otherwise known as a penetration test\n* __static-analysis-report__ = SARIF or proprietary machine or human-readable report for which static analysis has identified code quality, security, and other potential issues with the source code\n* __dynamic-analysis-report__ = Dynamic analysis report that has identified issues such as vulnerabilities and misconfigurations\n* __runtime-analysis-report__ = Report generated by analyzing the call stack of a running application\n* __component-analysis-report__ = Report generated by Software Composition Analysis (SCA), container analysis, or other forms of component analysis\n* __maturity-report__ = Report containing a formal assessment of an organization, business unit, or team against a maturity model\n* __certification-report__ = Industry, regulatory, or other certification from an accredited (if applicable) certification body\n* __quality-metrics__ = Report or system in which quality metrics can be obtained\n* __codified-infrastructure__ = Code or configuration that defines and provisions virtualized infrastructure, commonly referred to as Infrastructure as Code (IaC)\n* __other__ = Use this if no other types accurately describe the purpose of the external reference",
"enum": [
"vcs",
"issue-tracker",
Expand All @@ -1041,11 +1041,25 @@
"documentation",
"support",
"distribution",
"distribution-intake",
"license",
"build-meta",
"build-system",
"release-notes",
"security-contact",
"attestation",
"threat-model",
"vulnerability-assertion",
"exploitability-statement",
"pentest-report",
"static-analysis-report",
"dynamic-analysis-report",
"runtime-analysis-report",
"component-analysis-report",
"maturity-report",
"certification-report",
"codified-infrastructure",
"quality-metrics",
"other"
]
},
Expand Down
70 changes: 70 additions & 0 deletions schema/bom-1.5.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1002,6 +1002,11 @@ limitations under the License.
<xs:documentation>Direct or repository download location</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="distribution-intake">
<xs:annotation>
<xs:documentation>The location where a component was published to. This is often the same as "distribution" but may also include specialized publishing processes that act as an intermediary</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="license">
<xs:annotation>
<xs:documentation>The URL to the license file. If a license URL has been defined in the license
Expand All @@ -1028,6 +1033,71 @@ limitations under the License.
<xs:documentation>Specifies a way to contact the maintainer, supplier, or provider in the event of a security incident. Common URIs include links to a disclosure procedure, a mailto (RFC-2368) that specifies an email address, a tel (RFC-3966) that specifies a phone number, or dns (RFC-4501]) that specifies the records containing DNS Security TXT.</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="attestation">
<xs:annotation>
<xs:documentation>Human or machine-readable statements containing facts, evidence, or testimony</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="threat-model">
<xs:annotation>
<xs:documentation>An enumeration of identified weaknesses, threats, and countermeasures, dataflow diagram (DFD), attack tree, and other supporting documentation in human-readable or machine-readable format</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="vulnerability-assertion">
<xs:annotation>
<xs:documentation>A Vulnerability Disclosure Report (VDR) which asserts the known and previously unknown vulnerabilities that affect a component, service, or product including the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on a component, service, or product.</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="exploitability-statement">
<xs:annotation>
<xs:documentation>A Vulnerability Exploitability eXchange (VEX) which asserts the known vulnerabilities that do not affect a product, product family, or organization, and optionally the ones that do. The VEX should include the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on the product, product family, or organization.</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="pentest-report">
<xs:annotation>
<xs:documentation>Results from an authorized simulated cyberattack on a component or service, otherwise known as a penetration test</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="static-analysis-report">
<xs:annotation>
<xs:documentation>SARIF or proprietary machine or human-readable report for which static analysis has identified code quality, security, and other potential issues with the source code</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="dynamic-analysis-report">
<xs:annotation>
<xs:documentation>Dynamic analysis report that has identified issues such as vulnerabilities and misconfigurations</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="runtime-analysis-report">
<xs:annotation>
<xs:documentation>Report generated by analyzing the call stack of a running application</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="component-analysis-report">
<xs:annotation>
<xs:documentation>Report generated by Software Composition Analysis (SCA), container analysis, or other forms of component analysis</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="maturity-report">
<xs:annotation>
<xs:documentation>Report containing a formal assessment of an organization, business unit, or team against a maturity model</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="certification-report">
<xs:annotation>
<xs:documentation>Industry, regulatory, or other certification from an accredited (if applicable) certification body</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="quality-metrics">
<xs:annotation>
<xs:documentation>Report or system in which quality metrics can be obtained</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="codified-infrastructure">
<xs:annotation>
<xs:documentation>Code or configuration that defines and provisions virtualized infrastructure, commonly referred to as Infrastructure as Code (IaC)</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="other">
<xs:annotation>
<xs:documentation>Use this if no other types accurately describe the purpose of the external reference</xs:documentation>
Expand Down