Inventory refactor and definitions registry

schema/2.0/cyclonedx-2.0.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json",
   "type": "object",
-  "title": "CycloneDX Transparency Expression Language",
+  "title": "CycloneDX Transparency Exchange Language",
   "$comment" : "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.",
   "required": [
     "specFormat",
@@ -50,9 +50,8 @@
     "metadata": {
       "$ref": "model/cyclonedx-metadata-2.0.schema.json#/$defs/metadata"
     },
-    "components": {
-      "$ref": "model/cyclonedx-component-2.0.schema.json#/$defs/components",
-      "description": "A collection of components. When a metadata component is present, this array represents the inventory of components associated with that subject, forming a bill of materials. When the metadata component is omitted, the array provides component data for interchange purposes without establishing a compositional relationship."
+    "inventories": {
+      "$ref": "model/cyclonedx-component-2.0.schema.json#/$defs/inventories"
     },
     "dependencies": {
       "$ref": "model/cyclonedx-dependency-2.0.schema.json#/$defs/dependencies"
@@ -87,9 +86,6 @@
     "blueprints": {
       "$ref": "model/cyclonedx-blueprint-2.0.schema.json#/$defs/blueprints"
     },
-    "profiles": {
-      "$ref": "model/cyclonedx-profile-2.0.schema.json#/$defs/profiles"
-    },
     "citations": {
       "$ref": "model/cyclonedx-citation-2.0.schema.json#/$defs/citations"
     },

schema/2.0/cyclonedx-api-2.0.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://cyclonedx.org/schema/2.0/cyclonedx-api-2.0.schema.json",
   "type": "object",
-  "title": "CycloneDX Transparency Expression Language: API",
+  "title": "CycloneDX Transparency Exchange Language: API",
   "$comment" : "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.",
   "$defs": {
 

schema/2.0/model/cyclonedx-annotation-2.0.schema.json

@@ -89,7 +89,7 @@
             },
             "component": {
               "description": "The tool or component that created the annotation",
-              "$ref": "cyclonedx-component-2.0.schema.json#/$defs/component"
+              "$ref": "cyclonedx-component-2.0.schema.json#/$defs/componentEntry"
             }
           }
         },

schema/2.0/model/cyclonedx-blueprint-2.0.schema.json

@@ -817,7 +817,7 @@
         "dataProfiles": {
           "type": "array",
           "title": "Data Profiles",
-          "description": "Data profiles that govern the dataset. Each entry is either an inline profile object or a reference using bom-link or bom-ref to a previously declared profile, typically declared in the root profiles catalogue.",
+          "description": "Data profiles that govern the dataset. Each entry is either an inline profile object or a reference using bom-link or bom-ref to a previously declared profile, typically declared in the definitions.",
           "uniqueItems": true,
           "items": {
             "$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataProfileChoice"

schema/2.0/model/cyclonedx-certification-2.0.schema.json

@@ -7,6 +7,7 @@
   "$defs": {
     "certifications": {
       "type": "array",
+      "uniqueItems": true,
       "title": "Certifications",
       "description": "Certifications held by or applicable to the subject.",
       "items": { "$ref": "#/$defs/certification" }
@@ -97,6 +98,31 @@
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
         }
       }
+    },
+    "certificationReference": {
+      "type": "object",
+      "title": "Certification Reference",
+      "description": "A reference to a certification defined elsewhere, such as in the definitions or in another document via BOM-Link. A reference includes the referenced certification exactly as defined: every position that references the same certification includes an identical certification.",
+      "required": [
+        "ref"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "ref": {
+          "title": "Reference",
+          "description": "Reference using bom-link or bom-ref to the certification.",
+          "anyOf": [
+            {
+              "title": "Ref",
+              "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
+            },
+            {
+              "title": "BOM-Link Element",
+              "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType"
+            }
+          ]
+        }
+      }
     }
   }
 }

schema/2.0/model/cyclonedx-citation-2.0.schema.json

@@ -27,22 +27,22 @@
           "items": {
             "type": "string",
             "title": "Field Reference",
-            "description": "A [JSON Pointer](https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM field to which the attribution applies."
+            "description": "A [JSON Pointer](https://datatracker.ietf.org/doc/html/rfc6901) identifying the JSON property to which the attribution applies."
           },
           "minItems": 1,
           "title": "Field References",
-          "description": "One or more [JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM fields to which the attribution applies.\nExactly one of the \"pointers\" or \"expressions\" elements must be present."
+          "description": "One or more [JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901) identifying the JSON properties to which the attribution applies.\nExactly one of the \"pointers\" or \"expressions\" elements must be present."
         },
         "expressions": {
           "type": "array",
           "items": {
             "type": "string",
             "title": "Path Expression",
-            "description": "Specifies a [JSONPath](https://datatracker.ietf.org/doc/html/rfc9535) expression used to locate a value within a BOM."
+            "description": "Specifies a [JSONPath](https://datatracker.ietf.org/doc/html/rfc9535) expression used to locate a value within a CycloneDX artifact or payload."
           },
           "minItems": 1,
           "title": "Path Expressions",
-          "description": "One or more path expressions used to locate values within a BOM.\nExactly one of the \"pointers\" or \"expressions\" elements must be present."
+          "description": "One or more path expressions used to locate values within a CycloneDX artifact or payload.\nExactly one of the \"pointers\" or \"expressions\" elements must be present."
         },
         "timestamp": {
           "type": "string",

schema/2.0/model/cyclonedx-common-2.0.schema.json

@@ -97,13 +97,13 @@
     "mediaType": {
       "type": "string",
       "title": "Media Type",
-      "description": "The media type of the object. The media type can provide additional context about the kind of data being represented, such as an image, font, or executable.",
+      "description": "The media type of the object, optionally including media type parameters. The media type can provide additional context about the kind of data being represented, such as an image, font, or executable.",
       "examples": [
-        "text/plain",
         "application/json",
-        "image/png"
+        "image/png",
+        "text/html; charset=utf-8"
       ],
-      "pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+$"
+      "pattern": "^[-+a-z0-9.]+/[-+a-z0-9.]+(\\s*;\\s*[a-zA-Z0-9!#$&^_.+-]+=(\"[^\"]*\"|[^\\s;\"]+))*$"
     },
     "attachment": {
       "type": "object",
@@ -255,7 +255,7 @@
             "log": "A record of events that occurred in a computer system or application, such as problems, errors, or information on current operations.",
             "configuration": "Parameters or settings that may be used by other components or services.",
             "evidence": "Information used to substantiate a claim.",
-            "formulation": "Describes the formulation of any referencable object within the BOM, including components, services, metadata, declarations, or the BOM itself.",
+            "formulation": "Describes the formulation of any referencable object within the CycloneDX artifact or payload, including components, services, metadata, declarations, or the CycloneDX artifact or payload itself.",
             "attestation": "Human or machine-readable statements containing facts, evidence, or testimony.",
             "threat-model": "An enumeration of identified weaknesses, threats, and countermeasures, dataflow diagram (DFD), attack tree, and other supporting documentation in human-readable or machine-readable format.",
             "adversary-model": "The defined assumptions, goals, and capabilities of an adversary.",
@@ -279,7 +279,7 @@
             "patent": "References information about patents which may be defined in human-readable documents or in machine-readable formats such as CycloneDX or ST.96. For detailed patent information or to reference the information provided directly by patent offices, it is recommended to leverage standards from the World Intellectual Property Organization (WIPO) such as [ST.96](https://www.wipo.int/standards/en/st96).",
             "patent-family": "References information about a patent family which may be defined in human-readable documents or in machine-readable formats such as CycloneDX or ST.96. A patent family is a group of related patent applications or granted patents that cover the same or similar invention. For detailed patent family information or to reference the information provided directly by patent offices, it is recommended to leverage standards from the World Intellectual Property Organization (WIPO) such as [ST.96](https://www.wipo.int/standards/en/st96).",
             "patent-assertion" : "References assertions made regarding patents associated with a component or service. Assertions distinguish between ownership, licensing, and other relevant interactions with patents.",
-            "citation": "A reference to external citations applicable to the object identified by this BOM entry or the BOM itself. When used with a BOM-Link, this allows offloading citations into a separate CycloneDX BOM.",
+            "citation": "A reference to external citations applicable to the object identified in a CycloneDX artifact or payload or the CycloneDX artifact or payload itself. When used with a BOM-Link, this allows offloading citations into a separate CycloneDX artifacts or payloads.",
             "swid-tag": "A Software Identification (SWID) tag document conforming to ISO/IEC 19770-2. The reference resolves to the XML SoftwareIdentity document itself, including all of its metadata (entities, evidence, payload, links, and meta elements). This is distinct from the `swid` identifier scheme, which carries only the tagId of a SWID tag.",
             "gs1-digital-link": "A [GS1 Digital Link URI](https://ref.gs1.org/standards/digital-link/uri-syntax/) that connects the component's GS1 identification key, such as a GTIN, to online sources of information, including product data, safety documentation, digital product passports, and recall status. The URI may include key qualifiers, such as a batch or serial number, enabling identification at the class, batch, or individual item level. Component identity shall be derived from the component's identifiers, not from keys embedded in this URI.",
             "other": "Use this if no other types accurately describe the purpose of the external reference."
@@ -793,6 +793,11 @@
       ],
       "additionalProperties": false,
       "properties": {
+        "bom-ref": {
+          "$ref": "#/$defs/refType",
+          "title": "BOM Reference",
+          "description": "An identifier which can be used to reference the patch elsewhere in the document, such as from an annotation. Every `bom-ref` shall be unique within the document."
+        },
         "type": {
           "type": "string",
           "enum": [
@@ -817,9 +822,38 @@
         },
         "resolves": {
           "type": "array",
-          "items": {"$ref": "#/$defs/issue"},
+          "items": {
+            "oneOf": [
+              {"$ref": "#/$defs/issue"},
+              {
+                "type": "object",
+                "title": "Resolved Reference",
+                "description": "A reference to the item the patch resolves, such as a weakness, vulnerability, use case, requirement, or threat declared elsewhere.",
+                "required": [
+                  "ref"
+                ],
+                "additionalProperties": false,
+                "properties": {
+                  "ref": {
+                    "title": "Reference",
+                    "description": "Reference using bom-link or bom-ref to the resolved item.",
+                    "anyOf": [
+                      {
+                        "title": "Ref",
+                        "$ref": "#/$defs/refLinkType"
+                      },
+                      {
+                        "title": "BOM-Link Element",
+                        "$ref": "#/$defs/bomLinkElementType"
+                      }
+                    ]
+                  }
+                }
+              }
+            ]
+          },
           "title": "Resolves",
-          "description": "A collection of issues the patch resolves"
+          "description": "A collection of items the patch resolves. Each entry is an inline issue or a reference to the weakness, vulnerability, use case, requirement, or threat that the patch resolves."
         }
       }
     },