CycloneDX / CycloneDX/specification

Should cryptoProperties only be specified for components of type cryptographic-asset?

Open
#522 0 comments 0 reactions 0 assignees View on GitHub
proposed core enhancement
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

### Discussed in https://github.com/CycloneDX/specification/discussions/520

Originally posted by **andreas-hilti** September 11, 2024
ModelCard
https://cyclonedx.org/docs/1.6/json/#components_items_modelCard
has the following restriction:
```
This object SHOULD be specified for any component of type machine-learning-model and MUST NOT be specified for other component types.
```
Similarly, data
https://cyclonedx.org/docs/1.6/json/#components_items_data
has the restriction:
```
This object SHOULD be specified for any component of type data and MUST NOT be specified for other component types.
```

This makes me wonder whether the CryptoProperties:
https://cyclonedx.org/docs/1.6/json/#components_items_cryptoProperties
should have a similar restriction? Should they be specified only for components of type cryptographic-asset? The description kind of implies it, however, it is not explicitly specified.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.