feat: decouple metadata from its component #379

jkowalleck · 2024-02-14T18:01:38Z

The following changes were made with the intent to not introduce breaking changes,
neither syntactic nor semantic(!)

Changes

add component.manufacturer as "OrganizationalEntity"
-- fixes Should manufacture be a property of component, rather than metadata? #346
add component.authors as list of "OrganizationalContact"
-- fixes feat: multiple component authors #335
deprecate component.author in favour of component.authors and component.manufacturer
- reason: value was described to be a string that could represent person(s) or organization(s).
  So let's introduce dedicated fields for both of these:
  Organizations are represented by the new @.manufacturer &
  persons are represented by the new @.authors.
add metatada.manufacturer as "OrganizationalEntity"
-- fixes Rename "manufacture" to "manufacturer"? #57
deprecate metatada.manufacture in favour of metadata.component.manufacturer
-- fixes Should manufacture be a property of component, rather than metadata? #346

TODO

update JSON schema
update XSD
update protobuff schema
add examples and test resources

Follow up tasks

update use cases on the Website
- see https://github.com/CycloneDX/cyclonedx.org/issues/281
update SBOM guide
- see add to guide: component.author & component.manufacturer guides#19
- see update guide on metadata.manufacturer & metadata.component.manufacturer guides#20
create a BC task for 2.0: remove deprecated metadata.manufacture
see BC: remove deprecated metadata.manufacture #386
create a BC task for 2.0: remove deprecated component.author
see BC: remove deprecated component.author #387

- add `component.manufacturer` - add `component.authors` - deprecate `component.author` in favour of `component.authors` and `component.manufacturer` - deprecate `metatada.manufature` in favour of `metadata.component.manufacturer` - deprecate `metadata.supplier` in favour of `metadata.component.supplier` Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck · 2024-02-14T21:34:10Z

current state supersedes #370 #372
current state is a basis for further discussions.

jkowalleck · 2024-02-15T08:05:33Z

originally i had planned
the following:

deprecate metadata.supplier in favour of metadta.component.supplier
-- fixes Description of metadata.supplier is confusing #345

in a discussion with members of the CoreWorkingGroup, they told to do the following instead:

state in the description, that metadata.supplier so that it stated that the field has different meaning per spec version.
- < 1.6, the meaning was "supplier of the component described by the BOM" (old/legacy)
- >= 1.6, the meaning will be "supplier of the BOM"
  previous capability would be shifted to in favour of metadata.component.supplier

the proposal would cause breaking semantic changes. I do not want to bring any breaking change into the spec.
Therefore I will drop the aspect 'supplier' entirely from this PR.

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

nscuro · 2024-02-16T15:53:16Z

the proposal would cause breaking semantic changes. I do not want to bring any breaking change into the spec.
Therefore I will drop the aspect 'supplier' entirely from this PR.

Are you referring to the original proposal, the proposal of the ICWG, or both? Reads like the latter.

jkowalleck · 2024-02-16T16:27:17Z

the proposal would cause breaking semantic changes. I do not want to bring any breaking change into the spec.
Therefore I will drop the aspect 'supplier' entirely from this PR.

Are you referring to the original proposal, the proposal of the IWG, or both? Reads like the latter.

The latter one. The idea from the CWG would include breaking changes, literally.
My original proposal would be no breaking in no way.

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

## Added * Core enhancement: Attestation ([#192](#192) via [#348](#348)) * Core enhancement: Cryptography Bill of Materials — CBOM ([#171](#171), [#291](#291) via [#347](#347)) * Feature to express the URL to source distribution ([#98](#98) via [#269](#269)) * Feature to express the URL to RFC 9116 compliant documents ([#380](#380) via [#381](#381)) * Feature to express tags/keywords for services and components (via [#383](#383)) * Feature to express details for component authors ([#335](#335) via [#379](#379)) * Feature to express details for component and BOM manufacturer ([#346](#346) via [#379](#379)) * Feature to express communicate concluded values from observed evidences ([#411](#411) via [#412](#412)) * Features to express license acknowledgement ([#407](#407) via [#408](#408)) * Feature to express environmental consideration information for model cards ([#396](#396) via [#395](#395)) * Feature to express the address of organizational entities (via [#395](#395)) * Feature to express additional component identifiers: Universal Bill Of Receipts Identifier and Software Heritage persistent IDs ([#413](#413) via [#414](#414)) ## Fixed * Allow multiple evidence identities by XML/JSON schema ([#272](#272) via [#359](#359)) This was already correct via ProtoBuff schema. * Prevent empty `license` entities by XML schema ([#288](#288) via [#292](#292)) This was already correct in JSON/ProtoBuff schema. * Prevent empty or malformed `property` entities by JSON schema ([#371](#371) via [#375](#375)) This was already correct in XML/ProtoBuff schema. * Allow multiple `licenses` in `Metadata` by ProtoBuff schema ([#264](#264) via [#401](#401)) This was already correct in XML/JSON schema. ## Changed * Allow arbitrary `$schema` values by JSON schema ([#402](#402) via [#403](#403)) * Increased max length of `versionRange` (via [`3e01ce6`](3e01ce6)) * Harmonized length of `version` (via [#417](#417)) ## Deprecated * Data model "Component"'s field `author` was deprecated. (via [#379](#379)) Use field `authors` or field `manufacturer` instead. * Data model "Metadata"'s field `manufacture` was deprecated. ([#346](#346) via [#379](#379)) Use "Metadata"'s field `component`'s field `manufacturer` instead. - for XML: `/bom/metadata/component/manufacturer` - for JSON: `$.metadata.component.manufacturer` - for ProtoBuf: `Bom:metadata.component.manufacturer` ## Documentation * Centralize version and version-range (via [#322](#322)) * Streamlined SPDX expression related descriptions (via [#327](#327)) * Enhanced descriptions of `bom-ref`/`refType` ([#336](#336) via [#344](#344)) * Enhanced readability of enum documentation in JSON schema ([#361](#361) via [#362](#362)) * Fixed typo "compliment" -> "complement" (via [#369](#369)) * Added documentation for enum "ComponentScope"'s values in JSON schema ([#293](#293) via [`d92e58e`](d92e58e)) Texts were a taken from the existing ones in XML/ProtoBuff schema. * Added documentation for enum "TaskType"'s values ([#245](#245) via [#377](#377)) * Improve documentation for data model "Metadata"'s field `licenses` ([#273](#273) via [#378](#378)) * Added documentation for enum "MachineLearningApproachType"'s values ([#351](#351) via [#416](#416)) * Rephrased some texts here and there. ## Test data * Added test data for newly added use cases * Added quality assurance for our ProtoBuf schemas ([#384](#384) via [#385](#385))

jkowalleck added this to the 1.6 milestone Feb 14, 2024

jkowalleck changed the title ~~feat: devide metadata from its component~~ [DRAFT] feat: devide metadata from its component Feb 14, 2024

This was referenced Feb 14, 2024

feat: add component.manufacture #372

Closed

docs: make metadata field description more clear #370

Closed

jkowalleck added the draft label Feb 14, 2024

jkowalleck mentioned this pull request Feb 14, 2024

Should manufacture be a property of component, rather than metadata? #346

Closed

This was linked to issues Feb 14, 2024

Rename "manufacture" to "manufacturer"? #57

Closed

feat: multiple component authors #335

Closed

Description of metadata.supplier is confusing #345

Open

Should manufacture be a property of component, rather than metadata? #346

Closed

jkowalleck changed the title ~~[DRAFT] feat: devide metadata from its component~~ [DRAFT] feat: decouple metadata from its component Feb 14, 2024

jkowalleck removed a link to an issue Feb 15, 2024

Description of metadata.supplier is confusing #345

Open

revert proposed changes on metadata.supplier

cbd6265

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck mentioned this pull request Feb 15, 2024

Description of metadata.supplier is confusing #345

Open

jkowalleck added 7 commits February 20, 2024 18:58

Merge branch '1.6-dev' into 1.6-dev_draft-devide_metadata_from_component

25e2a5a

sam fix indended JSON data structures

702653c

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

add JSON test data

4cc4e14

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

fix typo

5639eef

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

xml

cd1fbe9

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

protobuf

c8f97ce

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

typo

8b0f6e6

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck added proposed core enhancement ready for review and removed draft labels Feb 20, 2024

jkowalleck marked this pull request as ready for review February 20, 2024 23:08

jkowalleck requested a review from a team as a code owner February 20, 2024 23:08

jkowalleck changed the title ~~[DRAFT] feat: decouple metadata from its component~~ feat: decouple metadata from its component Feb 20, 2024

protobuff test case

b31cdb1

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

stevespringett approved these changes Feb 21, 2024

View reviewed changes

stevespringett added promote to tc54 Promote to Ecma Technical Committee 54 tc54 reviewed Ecma TC54 has reviewed the feature candidate tc54 accepted Ecma TC54 has accepted the feature candidate labels Feb 21, 2024

Merge branch '1.6-dev' into 1.6-dev_draft-devide_metadata_from_component

f4049d8

stevespringett merged commit 2734b3f into CycloneDX:1.6-dev Feb 22, 2024
7 checks passed

mr-zepol mentioned this pull request Mar 14, 2024

Update data model for 1.6 CycloneDX/cyclonedx-core-java#381

Merged

snyk-tim mentioned this pull request May 21, 2024

feat: add manufacturer and authors CycloneDX/cyclonedx-go#171

Merged

andreas-hilti mentioned this pull request Aug 25, 2024

support cdx 1.6 CycloneDX/cyclonedx-dotnet-library#288

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: decouple metadata from its component #379

feat: decouple metadata from its component #379

jkowalleck commented Feb 14, 2024 •

edited

Loading

jkowalleck commented Feb 14, 2024

jkowalleck commented Feb 15, 2024 •

edited

Loading

nscuro commented Feb 16, 2024 •

edited

Loading

jkowalleck commented Feb 16, 2024 •

edited

Loading

feat: decouple metadata from its component #379

feat: decouple metadata from its component #379

Conversation

jkowalleck commented Feb 14, 2024 • edited Loading

Changes

TODO

Follow up tasks

jkowalleck commented Feb 14, 2024

jkowalleck commented Feb 15, 2024 • edited Loading

nscuro commented Feb 16, 2024 • edited Loading

jkowalleck commented Feb 16, 2024 • edited Loading

jkowalleck commented Feb 14, 2024 •

edited

Loading

jkowalleck commented Feb 15, 2024 •

edited

Loading

nscuro commented Feb 16, 2024 •

edited

Loading

jkowalleck commented Feb 16, 2024 •

edited

Loading