CycloneDX / CycloneDX/specification

feat: allow a mix of tools of type `components` and `services`

Open
#271 1 comment 0 reactions 0 assignees View on GitHub
CDX 1.5
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

Going line-by-line through the v1.5 schema and see the following use of the
```
oneOf
```
constraint (i.e., **“is valid if exactly one of the sub-schemas is valid”**)…
```
"tools": {
"oneOf":
"properties": {
"components": {
...
},
"services": {
...
}
}
```
However, if my tooling is a hybrid of both “components” and “services” the `anyOf` constraint (i.e. “**valid if at least one of the sub-schemas is valid**”) would make more sense and not restrict me to either just "components" or "services"?

This especially makes sense where “tools” is reused for many purposes, such as CI/CD in workflows… where it is almost always hybrid.

Spec. Ref: https://json-schema.org/understanding-json-schema/reference/combining.html

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.