CycloneDX / CycloneDX/specification
revisit formulations
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
formulations have some issues:
- steps can not have own input/output, but tasks can -- how would you craft a task that runs multiple steps, where every step then hands over a new piece of information to the next one?
- docs are misleading or confusing
- where does this "inbound"/"outbound" come from? what is a "data flow"?
- https://github.com/CycloneDX/specification/blob/a1c8aeb2e4e6a72851fd937f210e9b5add1cf514/schema/2.0/model/cyclonedx-formulation-2.0.schema.json#L653
- https://github.com/CycloneDX/specification/blob/a1c8aeb2e4e6a72851fd937f210e9b5add1cf514/schema/2.0/model/cyclonedx-formulation-2.0.schema.json#L753
- ... to be continued ...
- examples dont validate against own schema.
- per JSON schema spec, examples should validate against their schema.
see
- here, the `target` is a complex object(`resourceReferenceChoice`), but the example is a string
https://github.com/CycloneDX/specification/blob/a1c8aeb2e4e6a72851fd937f210e9b5add1cf514/schema/2.0/model/cyclonedx-formulation-2.0.schema.json#L751-L756
- ... to be continued ...
- input/output in general are not system-independent
- a workflow must have a `taskTypes`, but may have no `tasks` at all
- a workflow may have a task and steps, while a task has steps itself.
- ... to be continued ...
relevant resources: https://github.com/CycloneDX/guides/tree/main/MBOM/en
----
PS: Some of the "issues" I raised may be mistaken on my part — feel free to correct me in the discussion.
Contributor guide
Assessment
This issue has not been assessed yet.