Add `source-distribution` element to `externalReferenceType` #269

tsjensen · 2023-07-26T14:12:15Z

Resolves #98

After a lot of discussions in #98, I thought it might help to have this PR in order to be as clear as possible about what the proposed change would be that we are discussing.

Please upvote this if you agree! Maybe we are lucky and the thing turns out to be simple. 😄
@stevespringett @jkowalleck Let me know if I missed something, I'll be happy to rework as needed.

Thank you for considering this.

gernot-h · 2023-07-26T14:40:03Z

Cool, thanks, @tsjensen for taking the initiative here!

tsjensen · 2023-09-04T09:30:24Z

@jkowalleck @stevespringett friendly ping 😄

jkowalleck · 2023-09-04T10:40:36Z

Let me know if I missed something, I'll be happy to rework as needed.

protobuff is missing.

tsjensen · 2023-09-04T12:08:09Z

protobuff is missing.

Dang, right! Fixed now.

tsjensen · 2023-09-27T08:24:13Z

@jkowalleck What do you think now?

jkowalleck · 2023-09-27T09:28:03Z

looks like a promising draft. 👍

@stevespringett this looks ready for the IWG,
and it appears ready for consideration for the upcoming 1.6

agschrei · 2023-12-04T17:06:29Z

@jkowalleck I just realized that the tentative deadline for the 1.6 milestone is Dec 31st 2023 - can you already disclose whether the IWG has decided for this change to be included in 1.6? Currently it's still assigned to the milestone.

Are there ways I can support here?
This would be a very valuable addition to the format from my perspective.

jkowalleck · 2023-12-07T17:50:07Z

we discussed this topic in our last core working group meeting.
It is still considered for 1.6. We might use an alternative wording. Something along "source-distribution".
CC @stevespringett @coderpatros @DarthHater @CycloneDX/core-team

tsjensen · 2023-12-08T08:29:05Z

Glad to hear that! Let me know when the decision for the exact wording is made, and I'll update the PR.

jkowalleck · 2023-12-10T19:22:57Z

@tsjensen please change it to "source-distribution"
and put the new enum value one over the existing value "distribution".

tsjensen · 2023-12-11T13:19:43Z

Working on it!

tsjensen · 2023-12-11T14:47:57Z

Done!

jkowalleck · 2024-01-11T15:51:44Z

@tsjensen @agschrei @gernot-h

this feature was agreed and accepted in todays meeting.
CC @stevespringett @coderpatros @DarthHater

NEXT steps:
I will rebase/back-merge and fix conflicts SOON :-D (i assume i have permission to modify your branch)
And then it will be merged to 1.6 dev branch 🚀

jkowalleck · 2024-01-11T16:14:58Z

something went wrong. need to investigate and revert my changes. sry.

jkowalleck · 2024-01-11T16:40:20Z

@tsjensen i am very sorry, something stupid happened.
after i pushed the rebased and fixed version, github closed this PR and dropped my write-permission to your branhc.
In result, your changes and my fixes were dropped, your branch is just on upstream's HEAD< and this PR was auto-closed by github since there was nothing new.

I am very sorry for the inconvenience, but ...
could you please redo your changes nd my fixes:

add "source-distribution" to the enum in XML, JSON, ProtoBuff
for JSON: add a description to "meta:enum"
push your changes
reopen this PR

your previous changes are still there: 037eb89

you could revert to the previous state by

git checkout 1.6-dev
git reset --hard 037eb89697ba5d400db7641d75554b3e0dc686f2
git push -f

tsjensen · 2024-01-11T21:12:02Z

Great to hear that it was accepted! No worries about the GitHub mishap, I'll restore stuff tomorrow.

…X#98 Signed-off-by: Thomas Jensen <tsjensen@users.noreply.github.com>

tsjensen · 2024-01-12T10:20:31Z

@jkowalleck I restored the commit on my fork and rebased to the latest 1.6-dev:
https://github.com/tsjensen/specification/commits/1.6-dev/

However I seem to lack permissions to reopen the PR. Can you try to reopen the PR?
Then we see if the commit appears back here. If not, then it seems we'll have to do a new PR.

jkowalleck · 2024-01-12T10:52:38Z

thank you for your effort, @tsjensen

I just reopened this PR, tests are passing.
I am happy to merge your changes.

## Added * Core enhancement: Attestation ([#192](#192) via [#348](#348)) * Core enhancement: Cryptography Bill of Materials — CBOM ([#171](#171), [#291](#291) via [#347](#347)) * Feature to express the URL to source distribution ([#98](#98) via [#269](#269)) * Feature to express the URL to RFC 9116 compliant documents ([#380](#380) via [#381](#381)) * Feature to express tags/keywords for services and components (via [#383](#383)) * Feature to express details for component authors ([#335](#335) via [#379](#379)) * Feature to express details for component and BOM manufacturer ([#346](#346) via [#379](#379)) * Feature to express communicate concluded values from observed evidences ([#411](#411) via [#412](#412)) * Features to express license acknowledgement ([#407](#407) via [#408](#408)) * Feature to express environmental consideration information for model cards ([#396](#396) via [#395](#395)) * Feature to express the address of organizational entities (via [#395](#395)) * Feature to express additional component identifiers: Universal Bill Of Receipts Identifier and Software Heritage persistent IDs ([#413](#413) via [#414](#414)) ## Fixed * Allow multiple evidence identities by XML/JSON schema ([#272](#272) via [#359](#359)) This was already correct via ProtoBuff schema. * Prevent empty `license` entities by XML schema ([#288](#288) via [#292](#292)) This was already correct in JSON/ProtoBuff schema. * Prevent empty or malformed `property` entities by JSON schema ([#371](#371) via [#375](#375)) This was already correct in XML/ProtoBuff schema. * Allow multiple `licenses` in `Metadata` by ProtoBuff schema ([#264](#264) via [#401](#401)) This was already correct in XML/JSON schema. ## Changed * Allow arbitrary `$schema` values by JSON schema ([#402](#402) via [#403](#403)) * Increased max length of `versionRange` (via [`3e01ce6`](3e01ce6)) * Harmonized length of `version` (via [#417](#417)) ## Deprecated * Data model "Component"'s field `author` was deprecated. (via [#379](#379)) Use field `authors` or field `manufacturer` instead. * Data model "Metadata"'s field `manufacture` was deprecated. ([#346](#346) via [#379](#379)) Use "Metadata"'s field `component`'s field `manufacturer` instead. - for XML: `/bom/metadata/component/manufacturer` - for JSON: `$.metadata.component.manufacturer` - for ProtoBuf: `Bom:metadata.component.manufacturer` ## Documentation * Centralize version and version-range (via [#322](#322)) * Streamlined SPDX expression related descriptions (via [#327](#327)) * Enhanced descriptions of `bom-ref`/`refType` ([#336](#336) via [#344](#344)) * Enhanced readability of enum documentation in JSON schema ([#361](#361) via [#362](#362)) * Fixed typo "compliment" -> "complement" (via [#369](#369)) * Added documentation for enum "ComponentScope"'s values in JSON schema ([#293](#293) via [`d92e58e`](d92e58e)) Texts were a taken from the existing ones in XML/ProtoBuff schema. * Added documentation for enum "TaskType"'s values ([#245](#245) via [#377](#377)) * Improve documentation for data model "Metadata"'s field `licenses` ([#273](#273) via [#378](#378)) * Added documentation for enum "MachineLearningApproachType"'s values ([#351](#351) via [#416](#416)) * Rephrased some texts here and there. ## Test data * Added test data for newly added use cases * Added quality assurance for our ProtoBuf schemas ([#384](#384) via [#385](#385))

tsjensen force-pushed the 1.6-dev branch from 2dcdca5 to e34422d Compare July 26, 2023 14:13

jkowalleck requested a review from a team July 26, 2023 18:05

jkowalleck added proposed core enhancement request for comment labels Jul 26, 2023

stevespringett added this to the 1.6 milestone Jul 27, 2023

tsjensen force-pushed the 1.6-dev branch from e34422d to 25f6096 Compare September 4, 2023 12:04

jkowalleck approved these changes Oct 15, 2023

View reviewed changes

jkowalleck linked an issue Dec 4, 2023 that may be closed by this pull request

externalReferences type for "source" packages #98

Closed

jkowalleck requested a review from a team December 7, 2023 17:51

jkowalleck mentioned this pull request Dec 9, 2023

externalReferences type for "source" packages #98

Closed

tsjensen force-pushed the 1.6-dev branch from 25f6096 to 037eb89 Compare December 11, 2023 14:43

tsjensen changed the title ~~Add source element to externalReferenceType~~ Add source-distribution element to externalReferenceType Dec 11, 2023

stevespringett approved these changes Dec 28, 2023

View reviewed changes

stevespringett added promote to tc54 Promote to Ecma Technical Committee 54 and removed request for comment labels Dec 28, 2023

jkowalleck closed this Jan 11, 2024

jkowalleck force-pushed the 1.6-dev branch from 037eb89 to 6f4665c Compare January 11, 2024 16:13

stevespringett added tc54 reviewed Ecma TC54 has reviewed the feature candidate tc54 accepted Ecma TC54 has accepted the feature candidate labels Jan 11, 2024

Add source-distribution element to externalReferenceType CycloneD…

ae45d7c

…X#98 Signed-off-by: Thomas Jensen <tsjensen@users.noreply.github.com>

jkowalleck reopened this Jan 12, 2024

jkowalleck merged commit 517e694 into CycloneDX:1.6-dev Jan 12, 2024
9 checks passed

jkowalleck mentioned this pull request Jan 12, 2024

v1.6 #323

Merged

mr-zepol mentioned this pull request Mar 14, 2024

Add values to External References for 1.6 CycloneDX/cyclonedx-core-java#380

Merged

andreas-hilti mentioned this pull request Aug 25, 2024

support cdx 1.6 CycloneDX/cyclonedx-dotnet-library#288

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `source-distribution` element to `externalReferenceType` #269

Add `source-distribution` element to `externalReferenceType` #269

tsjensen commented Jul 26, 2023

gernot-h commented Jul 26, 2023

tsjensen commented Sep 4, 2023

jkowalleck commented Sep 4, 2023

tsjensen commented Sep 4, 2023

tsjensen commented Sep 27, 2023

jkowalleck commented Sep 27, 2023 •

edited

Loading

agschrei commented Dec 4, 2023

jkowalleck commented Dec 7, 2023 •

edited

Loading

tsjensen commented Dec 8, 2023

jkowalleck commented Dec 10, 2023 •

edited

Loading

tsjensen commented Dec 11, 2023

tsjensen commented Dec 11, 2023

jkowalleck commented Jan 11, 2024 •

edited

Loading

jkowalleck commented Jan 11, 2024 •

edited

Loading

jkowalleck commented Jan 11, 2024 •

edited

Loading

tsjensen commented Jan 11, 2024

tsjensen commented Jan 12, 2024

jkowalleck commented Jan 12, 2024

Add source-distribution element to externalReferenceType #269

Add source-distribution element to externalReferenceType #269

Conversation

tsjensen commented Jul 26, 2023

gernot-h commented Jul 26, 2023

tsjensen commented Sep 4, 2023

jkowalleck commented Sep 4, 2023

tsjensen commented Sep 4, 2023

tsjensen commented Sep 27, 2023

jkowalleck commented Sep 27, 2023 • edited Loading

agschrei commented Dec 4, 2023

jkowalleck commented Dec 7, 2023 • edited Loading

tsjensen commented Dec 8, 2023

jkowalleck commented Dec 10, 2023 • edited Loading

tsjensen commented Dec 11, 2023

tsjensen commented Dec 11, 2023

jkowalleck commented Jan 11, 2024 • edited Loading

jkowalleck commented Jan 11, 2024 • edited Loading

jkowalleck commented Jan 11, 2024 • edited Loading

tsjensen commented Jan 11, 2024

tsjensen commented Jan 12, 2024

jkowalleck commented Jan 12, 2024

Add `source-distribution` element to `externalReferenceType` #269

Add `source-distribution` element to `externalReferenceType` #269

jkowalleck commented Sep 27, 2023 •

edited

Loading

jkowalleck commented Dec 7, 2023 •

edited

Loading

jkowalleck commented Dec 10, 2023 •

edited

Loading

jkowalleck commented Jan 11, 2024 •

edited

Loading

jkowalleck commented Jan 11, 2024 •

edited

Loading

jkowalleck commented Jan 11, 2024 •

edited

Loading