CycloneDX / CycloneDX/specification
[Defect]: relatedCryptographicAsset.type description is copied from securedBy.mechanism
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
## Describe the defect
In [bom-1.7.schema.json](https://github.com/CycloneDX/specification/blob/1.7/schema/bom-1.7.schema.json), `relatedCryptographicAsset.type` is described as:
> Specifies the mechanism by which the cryptographic asset is secured by.
This is the same sentence as `securedBy.mechanism`, which describes a different thing. The examples given for the field (`publicKey`, `privateKey`, `algorithm`) say what the referenced asset is, not how the component is protected.
The field is new in 1.7, and `securedBy` already existed in 1.6, so this looks like a copy when the field was added.
## Additional context
A possible wording:
> Specifies the type of the related cryptographic asset.
Contributor guide
Research direction
Open bom-1.7.schema.json and compare the description for relatedCryptographicAsset.type with securedBy.mechanism. Update the former to describe the referenced asset type, then verify that the wording matches the issue's proposed meaning and does not alter the existing securedBy description.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- json
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 91/100