CycloneDX / CycloneDX/specification

[2.0]: Proposal - Pre-defined perspectives: stable spec-provided identity with incorporation by reference

Open
#1,066 0 comments 0 reactions 0 assignees View on GitHub
CDX 2.0 proposed core enhancement
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

## Describe the feature

Perspectives (#736, #745) are fully author-defined: identity is carried only by the free-text name. This leaves two gaps:

1. No stable identity. Tooling cannot reliably recognize that a document carries, say, a model card view, since matching on free-text names is fragile (case, wording, localization). This matters more now that #990 points model cards at perspectives: "Model Card" is an industry-adopted term, and consumers need a stable way to find that view.
2. No reference form. A well-known perspective must be restated in full in every document that wants it.

## Possible solutions

Add an optional predefined field to perspective:

```
{
"perspectives": [
{ "predefined": "model-card" }
]
}
```

## Alternatives

Considered:
- Reserved name values (registry-governed, like the property taxonomy): no schema change and registry-paced growth, but the schema cannot express "mappings optional iff the name is reserved" without embedding the reserved list, so the reference form is impossible — and it overloads display text as machine identity.
- Identity field on inline perspectives (tagging inline mappings with a well-known identity): rejected — nothing could validate that the inline content faithfully represents the claimed identity, inviting stripped-down or contradictory "model cards."

## Additional context
References:
#736 / #745 — perspectives concept and model
#990 — model cards expressed via perspectives (this proposal closes the loop that PR opens)
#960 — perspectives/ catalog precedent (PQC readiness)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.