CycloneDX / CycloneDX/specification

[DISCUSS]: Need means to declare "root" workflow(s) for a formula

Open
#565 0 comments 2 reactions 1 assignee Claimed by @mrutkows View on GitHub
CDX 1.7 proposed core enhancement
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

The `formula` element allows the declaration of multiple `workflow` elements; however, there is no easy means to determine (looking strictly at the workflow definitions) the execution order without comparing (and inferring) such from the workflow timestamps.

## Describe the feature

Discuss if a new field/fields is/are necessary to indicate a "root" or starting workflow (or task) to assist tooling/humans in analyzing the MBOM.

## Possible solutions

Add a field to declare a "root" workflow (by its `bom-ref`); however it MAY (TBD) be possible to have parallel workflows all be considered root (conceptually initiated by the same "trigger" (event).

Drawbacks/issues...

These fields would need to optional as the underlying platform's tool used for generating an MBOM may not have full context/view of all workflows...

- What if declared "root" does not match "timestamps"?

## Alternatives

TBD

## Additional context

None

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.