CycloneDX / CycloneDX/specification

[Defect]: relatedCryptographicAsset.type description is copied from securedBy.mechanism

Open Beginner friendly
#1,045 0 comments 0 reactions 0 assignees View on GitHub
defect
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

## Describe the defect

In [bom-1.7.schema.json](https://github.com/CycloneDX/specification/blob/1.7/schema/bom-1.7.schema.json), `relatedCryptographicAsset.type` is described as:

> Specifies the mechanism by which the cryptographic asset is secured by.

This is the same sentence as `securedBy.mechanism`, which describes a different thing. The examples given for the field (`publicKey`, `privateKey`, `algorithm`) say what the referenced asset is, not how the component is protected.

The field is new in 1.7, and `securedBy` already existed in 1.6, so this looks like a copy when the field was added.

## Additional context

A possible wording:

> Specifies the type of the related cryptographic asset.

Contributor guide

Open the contributing guide

Research direction

Open bom-1.7.schema.json and compare the description for relatedCryptographicAsset.type with securedBy.mechanism. Update the former to describe the referenced asset type, then verify that the wording matches the issue's proposed meaning and does not alter the existing securedBy description.

Written by the indexing model from the issue text.

Assessment

Tech stack
json
Domain
documentation
Issue type
Documentation
Difficulty
1/5
Estimated time
Under an hour
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
91/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.