CycloneDX / CycloneDX/specification
[Defect]: Regression in the latest 2.0 schema WIP where component identifiers details are lost
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
## Describe the defect
In previous versions each component identifier (and PURL in particular) had a detailed description including links to the spec, providing important information for implementers.
With this commit, the doc is gone
- https://github.com/CycloneDX/specification/commit/10b343a3f2271e23fe8ad2d1f64e47866c4cd38f
For example with PURL, before we had title, rich description with URLs and examples:
```json
{
"purl": {
"type": "string",
"title": "Package URL (purl)",
"description": "Asserts the identity of the component using package-url (purl). The purl, if specified, must be valid and conform to the specification defined at: [https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec). Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the component's identity.",
"examples": ["pkg:maven/com.acme/tomcat-catalina@9.0.14?packaging=jar"]
}
}
```
(at https://github.com/CycloneDX/specification/blame/522d5b7fe4ade53e5e4f540981cd34b0763e8fa7/schema/2.0/model/cyclonedx-component-2.0.schema.json#L165 )
After, we only have this information, essentially a title, and have lost all the other details:
```json
{
"purl": "Package-URL identifier, conforming to the Package-URL specification.",
}
```
(at https://github.com/CycloneDX/specification/blame/67d3ec8d604361f28b8789907c9d6c5aa33eb341/schema/2.0/model/cyclonedx-component-2.0.schema.json#L788 )
Contributor guide
Assessment
This issue has not been assessed yet.