Describe the defect
In bom-1.7.schema.json, relatedCryptographicAsset.type is described as:
Specifies the mechanism by which the cryptographic asset is secured by.
This is the same sentence as securedBy.mechanism, which describes a different thing. The examples given for the field (publicKey, privateKey, algorithm) say what the referenced asset is, not how the component is protected.
The field is new in 1.7, and securedBy already existed in 1.6, so this looks like a copy when the field was added.
Additional context
A possible wording:
Specifies the type of the related cryptographic asset.
Describe the defect
In bom-1.7.schema.json,
relatedCryptographicAsset.typeis described as:This is the same sentence as
securedBy.mechanism, which describes a different thing. The examples given for the field (publicKey,privateKey,algorithm) say what the referenced asset is, not how the component is protected.The field is new in 1.7, and
securedByalready existed in 1.6, so this looks like a copy when the field was added.Additional context
A possible wording: