CycloneDX / CycloneDX/specification

Support more relationship types

Open
#135 7 comments 1 reaction 0 assignees View on GitHub
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

Hi,
Currently, CycloneDX supports only relationships of parts in a system - dependencies and compositions.
There is a need express several types of relationships.
A thorough list of examples can be found in the [Chapter 11 of the SPDX spec](https://spdx.github.io/spdx-spec/relationships-between-SPDX-elements/).

An example:
`Component A is documented in component C and also Component B is documented in component C, where component C is a part of the software BOM'd (C is "installation_manual.pdf").`

`Component A is documented in document C, and also B is documented in document C, but document C is an external document - not part of the SBOM. So it is does not make sense to add a component C object (because it is not really a component).`

Suggestions:
1. Add to the existing relationship objects (dependencies and compositions) also a properties object - so application specific relationships can describe the relationship. In the first example - one would create a property:
"name":"relationship type"
"value":"documentation"
Even better to add an optional name field to the dependencies and composition objects.

2. Add a generic relationships object, which will be populated by any relationship imagined. In such an object I would recommend defining at least a relationship name field.

Thanks

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.