CycloneDX / CycloneDX/specification
[Defect]: 1.7 XML schema omits protocol relatedCryptographicAssets
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
## Describe the defect
The CycloneDX 1.7 JSON schema defines
`cryptoProperties.protocolProperties.relatedCryptographicAssets` and marks the
older `cryptoRefArray` property as deprecated in favor of it. The 1.7 XML
schema, however, only allows repeated `cryptoRef` children under
`protocolProperties`; it does not define `relatedCryptographicAssets` there.
This makes the JSON and XML representations inconsistent. A 1.7 document with
one protocol-related cryptographic asset passes the JSON schema, but the
equivalent XML is rejected with:
```text
Element '{http://cyclonedx.org/schema/bom/1.7}relatedCryptographicAssets':
This element is not expected. Expected is (... cryptoRef).
```
Expected behavior: the 1.7 XSD should permit the preferred
`relatedCryptographicAssets` representation for protocol properties, matching
the JSON schema and the corresponding certificate/material representations.
## Additional context
- Current specification `master` checked at commit
`e02a34ae42a48239f54e04f75280b9000b29f1fb`.
- The `protocolProperties` section in the vendored XSD used by
`cyclonedx-python-lib` is byte-for-byte identical to the current
specification section and has the same omission.
- No open or closed specification issue/PR matching
`relatedCryptographicAssets` + `protocolProperties` was found before filing.
- This was found while reviewing
[cyclonedx-python-lib#1016](https://github.com/CycloneDX/cyclonedx-python-lib/pull/1016),
where the model can now round-trip the field but strict XML schema validation
exposes the specification mismatch.
Report prepared with OpenAI Codex assistance and independently reproduced by
the submitter.
Contributor guide
Research direction
Start with the 1.7 XML XSD's protocolProperties section and compare it with the JSON schema and the corresponding certificate/material representations. Update the XSD so protocol properties permit relatedCryptographicAssets while retaining the deprecated cryptoRefArray behavior, then validate an equivalent XML document to confirm the element is accepted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- xml
- Domain
- documentation
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100