CycloneDX / CycloneDX/specification
Should cryptoProperties only be specified for components of type cryptographic-asset?
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
### Discussed in https://github.com/CycloneDX/specification/discussions/520
Originally posted by **andreas-hilti** September 11, 2024
ModelCard
https://cyclonedx.org/docs/1.6/json/#components_items_modelCard
has the following restriction:
```
This object SHOULD be specified for any component of type machine-learning-model and MUST NOT be specified for other component types.
```
Similarly, data
https://cyclonedx.org/docs/1.6/json/#components_items_data
has the restriction:
```
This object SHOULD be specified for any component of type data and MUST NOT be specified for other component types.
```
This makes me wonder whether the CryptoProperties:
https://cyclonedx.org/docs/1.6/json/#components_items_cryptoProperties
should have a similar restriction? Should they be specified only for components of type cryptographic-asset? The description kind of implies it, however, it is not explicitly specified.
Contributor guide
Assessment
This issue has not been assessed yet.