CycloneDX / CycloneDX/specification

[IDEA]: ProtoBuf - make `license.id` an (external) enum

Open
#574 1 comment 0 reactions 0 assignees View on GitHub
format: ProtoBuf
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

currently(CDX 1.6), we have the following situation:
- for JSON, the known SPDX licence IDs are in an own schema store:
- for XML, the known SPDX licence IDs are in an own schema store:
- for ProtoBuf, the known SPDX licence IDs are not an enum at all, they are just a free text(`string`):

## problem

Using arbitrary strings for `license.id` means, that there is just no baked-in safety.
To improve this, I propose to use a dedicated ProtoBuf package that can be maintained and released outside the regular CDX release cycle, just like the enum for JSON and XML.

## possible solution

- have a file `spdx.proto`
- use an own package `cyclonedx.spdx`
- declare the like
```proto
enum LicenseId {
LICENSEID_UNSPECIFIED = 0
// 0BSD
LICENSEID_0BSD = 1
// ...
// Apache-1.0
LICENSEID_Apache_1_0
// ...
}
- have this file checked against breaking changes
- see
- see
- have the license file updated with the other `spdx.*` schema files
- in the `bom-1.x.proto` file, use that enum (pseudocode)
```proto
import "cyclonedx.spdx";
message License {
oneof license {
// A known SPDX license identifier.
cyclonedx.spdx.LicenseId = 1;
// ...
}
// ...
}
```

## consideration & research

- ❗ this might be a breaking change - need to investigate
- ❕ need to investigate how/where to publish the schema file, so that has the intended effect

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.