CycloneDX / CycloneDX/specification
Consider extensible signature standards support
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
i am a bit concerned about possible changes in the future.
What if might transition from JSS to something else some day?
the way it is currently structured will block any path for this.
i'd rather go with something like
```json5
{
// ...
"signatures": {
"type": "array",
"minItems": 1,
"items": {
"oneOf": [
{
"type": "object",
"description": "description from cyclonedx-jss_X590_2023_10-2.0.schema.json#/$defs/signatureObject",
"properties": {
"type": { "const": "JSS_X590" },
"data": { "$ref": "cyclonedx-jss_X590_2023_10-2.0.schema.json#/$defs/signatureObject" }
},
"required": ["type", "data"],
"unevaluatedProperties": false
},
// any later type of signature we might add in the future
]
}
}
}
```
_Originally posted by @jkowalleck in https://github.com/CycloneDX/specification/pull/858#discussion_r3334967070_
---
While the recommended approach will not "technically" work, the desire to support multiple signature standards remains. Attempt to devise a way this can be supported in the future.
Contributor guide
Assessment
This issue has not been assessed yet.