CycloneDX / CycloneDX/specification

[Defect]: Regression in the latest 2.0 schema WIP where component identifiers details are lost

Open
#1,008 0 comments 0 reactions 1 assignee Claimed by @stevespringett View on GitHub
defect
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

## Describe the defect

In previous versions each component identifier (and PURL in particular) had a detailed description including links to the spec, providing important information for implementers.

With this commit, the doc is gone
- https://github.com/CycloneDX/specification/commit/10b343a3f2271e23fe8ad2d1f64e47866c4cd38f

For example with PURL, before we had title, rich description with URLs and examples:

```json
{
"purl": {
"type": "string",
"title": "Package URL (purl)",
"description": "Asserts the identity of the component using package-url (purl). The purl, if specified, must be valid and conform to the specification defined at: [https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec). Refer to `@.evidence.identity` to optionally provide evidence that substantiates the assertion of the component's identity.",
"examples": ["pkg:maven/com.acme/tomcat-catalina@9.0.14?packaging=jar"]
}
}
```

(at https://github.com/CycloneDX/specification/blame/522d5b7fe4ade53e5e4f540981cd34b0763e8fa7/schema/2.0/model/cyclonedx-component-2.0.schema.json#L165 )

After, we only have this information, essentially a title, and have lost all the other details:
```json
{
"purl": "Package-URL identifier, conforming to the Package-URL specification.",
}
```

(at https://github.com/CycloneDX/specification/blame/67d3ec8d604361f28b8789907c9d6c5aa33eb341/schema/2.0/model/cyclonedx-component-2.0.schema.json#L788 )

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.