CycloneDX / CycloneDX/specification

revisit formulations

Open
#1,089 1 comment 0 reactions 1 assignee Claimed by @jkowalleck View on GitHub
cap: formulation
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

formulations have some issues:
- steps can not have own input/output, but tasks can -- how would you craft a task that runs multiple steps, where every step then hands over a new piece of information to the next one?
- docs are misleading or confusing
- where does this "inbound"/"outbound" come from? what is a "data flow"?
- https://github.com/CycloneDX/specification/blob/a1c8aeb2e4e6a72851fd937f210e9b5add1cf514/schema/2.0/model/cyclonedx-formulation-2.0.schema.json#L653
- https://github.com/CycloneDX/specification/blob/a1c8aeb2e4e6a72851fd937f210e9b5add1cf514/schema/2.0/model/cyclonedx-formulation-2.0.schema.json#L753
- ... to be continued ...
- examples dont validate against own schema.
- per JSON schema spec, examples should validate against their schema.
see
- here, the `target` is a complex object(`resourceReferenceChoice`), but the example is a string
https://github.com/CycloneDX/specification/blob/a1c8aeb2e4e6a72851fd937f210e9b5add1cf514/schema/2.0/model/cyclonedx-formulation-2.0.schema.json#L751-L756
- ... to be continued ...
- input/output in general are not system-independent
- a workflow must have a `taskTypes`, but may have no `tasks` at all
- a workflow may have a task and steps, while a task has steps itself.
- ... to be continued ...

relevant resources: https://github.com/CycloneDX/guides/tree/main/MBOM/en

----

PS: Some of the "issues" I raised may be mistaken on my part — feel free to correct me in the discussion.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.