CycloneDX / CycloneDX/specification
Support more relationship types
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
Hi,
Currently, CycloneDX supports only relationships of parts in a system - dependencies and compositions.
There is a need express several types of relationships.
A thorough list of examples can be found in the [Chapter 11 of the SPDX spec](https://spdx.github.io/spdx-spec/relationships-between-SPDX-elements/).
An example:
`Component A is documented in component C and also Component B is documented in component C, where component C is a part of the software BOM'd (C is "installation_manual.pdf").`
`Component A is documented in document C, and also B is documented in document C, but document C is an external document - not part of the SBOM. So it is does not make sense to add a component C object (because it is not really a component).`
Suggestions:
1. Add to the existing relationship objects (dependencies and compositions) also a properties object - so application specific relationships can describe the relationship. In the first example - one would create a property:
"name":"relationship type"
"value":"documentation"
Even better to add an optional name field to the dependencies and composition objects.
2. Add a generic relationships object, which will be populated by any relationship imagined. In such an object I would recommend defining at least a relationship name field.
Thanks
Contributor guide
Assessment
This issue has not been assessed yet.