CycloneDX / CycloneDX/specification

Consider extensible signature standards support

Open
#943 0 comments 0 reactions 0 assignees View on GitHub
proposed core enhancement
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

i am a bit concerned about possible changes in the future.
What if might transition from JSS to something else some day?
the way it is currently structured will block any path for this.

i'd rather go with something like

```json5
{
// ...

"signatures": {
"type": "array",
"minItems": 1,
"items": {
"oneOf": [
{
"type": "object",
"description": "description from cyclonedx-jss_X590_2023_10-2.0.schema.json#/$defs/signatureObject",
"properties": {
"type": { "const": "JSS_X590" },
"data": { "$ref": "cyclonedx-jss_X590_2023_10-2.0.schema.json#/$defs/signatureObject" }
},
"required": ["type", "data"],
"unevaluatedProperties": false
},
// any later type of signature we might add in the future
]
}
}

}
```

_Originally posted by @jkowalleck in https://github.com/CycloneDX/specification/pull/858#discussion_r3334967070_

---
While the recommended approach will not "technically" work, the desire to support multiple signature standards remains. Attempt to devise a way this can be supported in the future.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.