CycloneDX / CycloneDX/specification

[2.0] refactor component for specificcomponent types

Open
#1,024 0 comments 0 reactions 0 assignees View on GitHub
CDX 2.0
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

after
- https://github.com/CycloneDX/specification/pull/982
- https://github.com/CycloneDX/specification/pull/975

the current `component` should be split in
- `baseComponent` - core properties of a component
- `serviceComponent` - inherit from `baseComponent` and add service-specific properties and requirements
- `softwareComponent` - inherit from `baseComponent` and add {application,framework,library,...}-specific properties and requirements
- `hardwareComponent` - inherit from `baseComponent` and add service-specific properties and requirements
- `fileComponent` - inherit from `baseComponent` and add file-specific properties and requirements
- `dataComponent` - inherit from `baseComponent` and add data-specific properties and requirements
- ... and so on - for each component type

I would even put the `baseComponent`, `serviceComponent`, etc ... under `/$defs/component/$defs/`,
not under `/$defs/`

after that split, the current `component` becomes a oneOf ala
```json5
{
"$defs": {
"component" : {
"oneOf": [
{"$ref": "#$defs/component/$defs/serviceComponent"}
{"$ref": "#$defs/component/$defs/hardwareComponent"},
{"$ref": "#$defs/component/$defs/...Component"},
],

"$defs": {
"baseComponent": {
"$comment": "This is a mixin. make sure to use `unevaluatedProperties` in the usage downstream"
"type": "object",
"required": [ ... ]
"properties": {
"type": { "enum": ["service", "device", ...] },
"bom-ref": ...,
"parties": ...
"group": ...,
"name": ...,
"description": ...,
"version": ...,
"versionRange": ...,
"isExternal": ...,
...
"components": { "$ref": "#$defs/components" }
}
},
"serviceComponent": {
"allOf": [{ "$ref": "#/$defs/component/$defs/baseComponent" }],
"titile": "Service Component",
"type": "object",
"required": ["endpoint", ...]
"properties": {
"type": { "enum": ["service"] },
// service-specific properties
"endpoint": ...,
"isExternal": { "default": true },
...
"components": { "$comment": "opportunity: make all items requiring a certain `type`" }
},
"unevaluatedProperties": false
},
"...Component": { ... },
}
}
}

}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.