diff --git a/schema/2.0/cyclonedx-2.0.schema.json b/schema/2.0/cyclonedx-2.0.schema.json index 8e757386..79de8140 100644 --- a/schema/2.0/cyclonedx-2.0.schema.json +++ b/schema/2.0/cyclonedx-2.0.schema.json @@ -18,7 +18,7 @@ "specFormat": { "type": "string", "title": "Specification Format", - "description": "Specifies the format. This value shall be \"CycloneDX\".", + "description": "Specifies the format. This value shall be `\"CycloneDX\"`.", "enum": [ "CycloneDX" ] @@ -43,7 +43,7 @@ "version": { "type": "integer", "title": "BOM Version", - "description": "Whenever an existing BOM is modified, either manually or through automated processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM. The default version is '1'.", + "description": "Whenever an existing BOM is modified, either manually or through automated processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM. The default version is `1`.", "minimum": 1, "default": 1 }, @@ -52,7 +52,7 @@ }, "components": { "$ref": "model/cyclonedx-component-2.0.schema.json#/$defs/components", - "description": "A collection of components. When a metadata component is present, this array represents the inventory of components associated with that subject, forming a bill of materials. When the metadata component is omitted, the array provides component data for interchange purposes without establishing a compositional relationship." + "description": "A collection of components. When a metadata component is present, this array represents the inventory of components associated with that subject, forming a bill of materials. When the `metadata.component` is omitted, the array provides component data for interchange purposes without establishing a compositional relationship." }, "dependencies": { "$ref": "model/cyclonedx-dependency-2.0.schema.json#/$defs/dependencies" diff --git a/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json b/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json index 5bb06287..da31dfe7 100644 --- a/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json @@ -9,7 +9,7 @@ "$comment": "Model card support in CycloneDX is derived from TensorFlow Model Card Toolkit released under the Apache 2.0 license and available from https://github.com/tensorflow/model-card-toolkit/blob/main/model_card_toolkit/schema/v0.0.2/model_card.schema.json. In addition, CycloneDX model card support includes portions of VerifyML, also released under the Apache 2.0 license and available from https://github.com/cylynx/verifyml/blob/main/verifyml/model_card_toolkit/schema/v0.0.4/model_card.schema.json.", "type": "object", "title": "Model Card", - "description": "A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component of type `machine-learning-model` and must not be specified for other component types.", + "description": "A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component with `type=\"machine-learning-model\"` and must not be specified for other component types.", "additionalProperties": false, "properties": { "bom-ref": { diff --git a/schema/2.0/model/cyclonedx-behavior-2.0.schema.json b/schema/2.0/model/cyclonedx-behavior-2.0.schema.json index ca2b5ca2..25a7f194 100644 --- a/schema/2.0/model/cyclonedx-behavior-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-behavior-2.0.schema.json @@ -266,7 +266,7 @@ ], "meta:enum": { "activity": "An action that is performed, identified by a behavior, a behavior-instance reference, or a nested graph. The activity-flow counterpart of a step.", - "state": "A durable condition the subject rests in until a transition fires. The state-machine counterpart of a node. A composite state references its nested region through 'graph'.", + "state": "A durable condition the subject rests in until a transition fires. The state-machine counterpart of a node. A composite state references its nested region through `graph`.", "event": "An intermediate event that occurs during the graph.", "gateway": "A branch or merge point whose outgoing transitions carry the guards.", "initial": "The starting point of the graph or of a composite node.", @@ -287,22 +287,22 @@ "type": "integer", "title": "Ordinal", "minimum": 1, - "description": "Position within a sequential graph. Required when the graph ordering is 'sequential'. Ignored when transitions define the order." + "description": "Position within a sequential graph. Required when the graph's `ordering=\"sequential\"`. Ignored when transitions define the order." }, "behavior": { "$ref": "../../behavior-taxonomy.schema.json", "title": "Behavior", - "description": "For an activity node, the behavior performed, drawn from the taxonomy. Mutually exclusive with 'ref' and 'graph'." + "description": "For an activity node, the behavior performed, drawn from the taxonomy. Mutually exclusive with `ref` and `graph`." }, "ref": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "title": "Behavior Reference", - "description": "For an activity node, a reference to a behavior instance. Mutually exclusive with 'behavior' and 'graph'." + "description": "For an activity node, a reference to a behavior instance. Mutually exclusive with `behavior` and `graph`." }, "graph": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "title": "Graph Reference", - "description": "A reference to a nested behavior graph. For an activity node it is the sub-process performed and is mutually exclusive with 'behavior' and 'ref'; for a composite node it is the nested region." + "description": "A reference to a nested behavior graph. For an activity node it is the sub-process performed and is mutually exclusive with `behavior` and `ref`; for a composite node it is the nested region." }, "actors": { "type": "array", diff --git a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json index 28a4937b..62c99dfc 100644 --- a/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-blueprint-2.0.schema.json @@ -283,11 +283,11 @@ "items": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice" }, - "description": "The parties that created the blueprint. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` should include `author`." + "description": "The parties that created the blueprint. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` should include `\"author\"`." }, "reviewer": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", - "description": "The party that reviewed the blueprint. The party's `roles` should include `reviewer`." + "description": "The party that reviewed the blueprint. The party's `roles` should include `\"reviewer\"`." }, "reviewDate": { "type": "string", @@ -297,7 +297,7 @@ }, "approver": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", - "description": "The party that approved the blueprint. The party's `roles` should include `signatory` or a custom role identifying the approving authority." + "description": "The party that approved the blueprint. The party's `roles` should include `\"signatory\"` or a custom role identifying the approving authority." }, "approvalDate": { "type": "string", @@ -338,7 +338,7 @@ "type": "string", "title": "Review Frequency", "pattern": "^P(?!$)(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?$", - "description": "ISO 8601 duration for review frequency (e.g., P3M for quarterly)." + "description": "ISO 8601 duration for review frequency (e.g., `\"P3M\"` for quarterly)." } } }, @@ -410,7 +410,7 @@ }, "componentRef": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", - "description": "Reference using bom-link or bom-ref to the component this asset represents, including components of type `service`." + "description": "Reference using bom-link or bom-ref to the component this asset represents, including components of type `\"service\"`." }, "partyRef": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", @@ -844,7 +844,7 @@ "items": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice" }, - "description": "Parties that own the dataset. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` should include `owner`." + "description": "Parties that own the dataset. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` should include `\"owner\"`." }, "authorization": { "type": "array", @@ -967,7 +967,7 @@ }, "dataFormat": { "type": "string", - "description": "Data format (e.g., JSON, XML, Protocol Buffers)." + "description": "Data format (e.g., `\"JSON\"`, `\"XML\"`, `\"Protocol Buffers\"`)." }, "authentication": { "type": "array", @@ -1727,7 +1727,7 @@ }, "owner": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice", - "description": "The party responsible for tracking, validating, and maintaining this assumption over the lifecycle of the model. May be an inline party object or a reference to a previously declared party. The party's `roles` should include `owner`." + "description": "The party responsible for tracking, validating, and maintaining this assumption over the lifecycle of the model. May be an inline party object or a reference to a previously declared party. The party's `roles` should include `\"owner\"`." }, "validationMethod": { "type": "string", @@ -1943,7 +1943,7 @@ "ownership": { "type": "array", "title": "Ownership", - "description": "Parties responsible for the asset. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` carry the relationship (`owner`, `steward`, `custodian`, `end-user`, or a custom role). Multiple parties may share the same role; preference among them is expressed via `role.order`.", + "description": "Parties responsible for the asset. Each entry is either an inline party object or a reference to a previously declared party. The party's `roles` carry the relationship (`\"owner\"`, `\"steward\"`, `\"custodian\"`, `\"end-user\"`, or a custom role). Multiple parties may share the same role; preference among them is expressed via `role.order`.", "uniqueItems": true, "items": { "$ref": "cyclonedx-party-2.0.schema.json#/$defs/partyChoice" diff --git a/schema/2.0/model/cyclonedx-certification-2.0.schema.json b/schema/2.0/model/cyclonedx-certification-2.0.schema.json index 05c08f0e..fcd2a179 100644 --- a/schema/2.0/model/cyclonedx-certification-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-certification-2.0.schema.json @@ -60,7 +60,7 @@ "jurisdiction": { "type": "string", "title": "Jurisdiction", - "description": "ISO 3166-1 alpha-2 country code, ISO 3166-2 subdivision, or supranational identifier such as `EU`, where the certification applies.", + "description": "ISO 3166-1 alpha-2 country code, ISO 3166-2 subdivision, or supranational identifier such as `\"EU\"`, where the certification applies.", "examples": [ "US", "EU", "GB", "AU", "US-CA" ] }, "level": { diff --git a/schema/2.0/model/cyclonedx-citation-2.0.schema.json b/schema/2.0/model/cyclonedx-citation-2.0.schema.json index f917370c..7ea40c9a 100644 --- a/schema/2.0/model/cyclonedx-citation-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-citation-2.0.schema.json @@ -31,7 +31,7 @@ }, "minItems": 1, "title": "Field References", - "description": "One or more [JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM fields to which the attribution applies.\nExactly one of the \"pointers\" or \"expressions\" elements must be present." + "description": "One or more [JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM fields to which the attribution applies.\nExactly one of the `pointers` or `expressions` elements must be present." }, "expressions": { "type": "array", @@ -42,7 +42,7 @@ }, "minItems": 1, "title": "Path Expressions", - "description": "One or more path expressions used to locate values within a BOM.\nExactly one of the \"pointers\" or \"expressions\" elements must be present." + "description": "One or more path expressions used to locate values within a BOM.\nExactly one of the `pointers` or `expressions` elements must be present." }, "timestamp": { "type": "string", @@ -53,12 +53,12 @@ "attributedTo": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "title": "Attributed To", - "description": "The `bom-ref` of an object, such as a component, service, tool, organisational entity, or person that supplied the cited information.\nAt least one of the \"attributedTo\" or \"process\" elements must be present." + "description": "The `bom-ref` of an object, such as a component, service, tool, organisational entity, or person that supplied the cited information.\nAt least one of the `attributedTo` or `process` elements must be present." }, "process": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType", "title": "Process Reference", - "description": "The `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.\nAt least one of the \"attributedTo\" or \"process\" elements must be present." + "description": "The `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.\nAt least one of the `attributedTo` or `process` elements must be present." }, "note": { "type": "string", diff --git a/schema/2.0/model/cyclonedx-common-2.0.schema.json b/schema/2.0/model/cyclonedx-common-2.0.schema.json index 6e53d544..e8acf76a 100644 --- a/schema/2.0/model/cyclonedx-common-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-common-2.0.schema.json @@ -259,7 +259,7 @@ "support": "Community or commercial support", "source-distribution": "The location where the source code distributable can be obtained. This is often an archive format such as zip or tgz. The source-distribution type complements use of the version control (vcs) type.", "distribution": "Direct or repository download location", - "distribution-intake": "The location where a component was published to. This is often the same as \"distribution\" but may also include specialized publishing processes that act as an intermediary.", + "distribution-intake": "The location where a component was published to. This is often the same as `\"distribution\"` but may also include specialized publishing processes that act as an intermediary.", "license": "The reference to the license file. If a license URL has been defined in the license node, it should also be defined as an external reference for completeness.", "build-meta": "Build-system specific meta file (i.e. pom.xml, package.json, .nuspec, etc)", "build-system": "Reference to an automated build system", @@ -285,7 +285,7 @@ "certification-report": "Industry, regulatory, or other certification from an accredited (if applicable) certification body.", "codified-infrastructure": "Code or configuration that defines and provisions virtualized infrastructure, commonly referred to as Infrastructure as Code (IaC).", "quality-metrics": "Report or system in which quality metrics can be obtained.", - "poam": "Plans of Action and Milestones (POA&M) complement an \"attestation\" external reference. POA&M is defined by NIST as a \"document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks and scheduled completion dates for the milestones\".", + "poam": "Plans of Action and Milestones (POA&M) complement an `\"attestation\"` external reference. POA&M is defined by NIST as a \"document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks and scheduled completion dates for the milestones\".", "perspective": "A CycloneDX perspective defines a domain-specific view, enabling different audiences to interpret and navigate the data through their own conceptual lens.", "electronic-signature": "An e-signature is commonly a scanned representation of a written signature or a stylized script of the person's name.", "digital-signature": "A signature that leverages cryptography, typically public/private key pairs, which provides strong authenticity verification.", @@ -294,7 +294,7 @@ "patent-family": "References information about a patent family which may be defined in human-readable documents or in machine-readable formats such as CycloneDX or ST.96. A patent family is a group of related patent applications or granted patents that cover the same or similar invention. For detailed patent family information or to reference the information provided directly by patent offices, it is recommended to leverage standards from the World Intellectual Property Organization (WIPO) such as [ST.96](https://www.wipo.int/standards/en/st96).", "patent-assertion" : "References assertions made regarding patents associated with a component or service. Assertions distinguish between ownership, licensing, and other relevant interactions with patents.", "citation": "A reference to external citations applicable to the object identified by this BOM entry or the BOM itself. When used with a BOM-Link, this allows offloading citations into a separate CycloneDX BOM.", - "swid-tag": "A Software Identification (SWID) tag document conforming to ISO/IEC 19770-2. The reference resolves to the XML SoftwareIdentity document itself, including all of its metadata (entities, evidence, payload, links, and meta elements). This is distinct from the `swid` identifier scheme, which carries only the tagId of a SWID tag.", + "swid-tag": "A Software Identification (SWID) tag document conforming to ISO/IEC 19770-2. The reference resolves to the XML SoftwareIdentity document itself, including all of its metadata (entities, evidence, payload, links, and meta elements). This is distinct from the \"swid\" identifier scheme, which carries only the tagId of a SWID tag.", "gs1-digital-link": "A [GS1 Digital Link URI](https://ref.gs1.org/standards/digital-link/uri-syntax/) that connects the component's GS1 identification key, such as a GTIN, to online sources of information, including product data, safety documentation, digital product passports, and recall status. The URI may include key qualifiers, such as a batch or serial number, enabling identification at the class, batch, or individual item level. Component identity shall be derived from the component's identifiers, not from keys embedded in this URI.", "other": "Use this if no other types accurately describe the purpose of the external reference." } @@ -531,7 +531,7 @@ "distribution": { "type": "array", "title": "Origin Distribution", - "description": "The distribution of the origin across regions. The percentages of all entries shall total 100, within rounding of the stated precision.", + "description": "The distribution of the origin across regions. The percentages of all entries shall total `100`, within rounding of the stated precision.", "minItems": 1, "items": { "$ref": "#/$defs/originRegion" } } @@ -547,14 +547,14 @@ "isoCode": { "type": "string", "title": "ISO Code", - "description": "The country or subdivision of origin, expressed as an ISO 3166-1 alpha-2 country code (for example, 'CA' for Canada) or an ISO 3166-2 subdivision code (for example, 'US-CA' for California, United States).", + "description": "The country or subdivision of origin, expressed as an ISO 3166-1 alpha-2 country code (for example, 'CA' for Canada) or an ISO 3166-2 subdivision code (for example, `\"US-CA\"` for California, United States).", "pattern": "^[A-Z]{2}(-[A-Z0-9]{1,3})?$", "examples": [ "CA", "US-CA" ] }, "percentage": { "type": "number", "title": "Percentage", - "description": "The percentage of the whole attributable to this region. The percentages of all entries in a distribution must total 100, within rounding of the stated precision.", + "description": "The percentage of the whole attributable to this region. The percentages of all entries in a distribution must total `100`, within rounding of the stated precision.", "minimum": 0, "maximum": 100 }, @@ -597,7 +597,7 @@ "extensibleProperties": { "type": "object", "title": "Extensible Properties", - "$comment": "This is a mixin. It intentionally does NOT restrict additional/unevaluated properties itself; schemas composing it via `allOf` are expected to close themselves with `unevaluatedProperties: false` so that both their own defined properties and these patternProperties remain usable.", + "$comment": "This is a mixin. It intentionally does NOT restrict additional/unevaluated properties itself; schemas composing it via `allOf` are expected to close themselves with `unevaluatedProperties=false` so that both their own defined properties and these patternProperties remain usable.", "patternProperties": { "^ext:[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}:.+$": { "description": "CycloneDX supports a structured and namespace-aware mechanism for extensibility through the use of extensible properties. This mechanism enables organizations, ecosystems, and tool vendors to safely introduce custom properties without conflicting with the core schema or other extensions.\n\nExtensible properties are defined as a JSON object whose keys must conform to a strict pattern that resembles a reverse domain name structure, prefixed with ext:. This pattern provides a namespacing convention that aligns with well-established practices in other structured formats (e.g., XML namespaces).\n\nValues that are objects must declare the schema they conform to via `$schema`. This requirement applies recursively to objects contained in arrays, at any nesting depth.", @@ -650,7 +650,7 @@ "baseObject": { "type": "object", "description": "Base object for all CycloneDX entities. Automatically includes support for extensible properties.", - "$comment": "This is a mixin. It intentionally does NOT set `unevaluatedProperties: false` — that keyword cannot see properties defined by schemas composing this one via `allOf`, and would reject them. Concrete (leaf) schemas composing this mixin must close themselves with `unevaluatedProperties: false`.", + "$comment": "This is a mixin. It intentionally does NOT set `unevaluatedProperties=false` — that keyword cannot see properties defined by schemas composing this one via `allOf`, and would reject them. Concrete (leaf) schemas composing this mixin must close themselves with `unevaluatedProperties=false`.", "allOf": [ { "$ref": "#/$defs/extensibleProperties" } ], @@ -668,7 +668,7 @@ "format": "date-time", "title": "Timestamp", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?Z$", - "description": "An RFC 3339-compliant UTC timestamp using Zulu time (i.e., ending with 'Z'). The format must be 'YYYY-MM-DDTHH:MM:SSZ' or include optional fractional seconds, e.g., 'YYYY-MM-DDTHH:MM:SS.sssZ'. Offsets such as '+00:00' are not allowed." + "description": "An RFC 3339-compliant UTC timestamp using Zulu time (i.e., ending with `\"Z\"`). The format must be `YYYY-MM-DDTHH:MM:SSZ` or include optional fractional seconds, e.g., `YYYY-MM-DDTHH:MM:SS.sssZ`. Offsets such as `\"+00:00\"` are not allowed." }, "ordinalVersion": { "title": "Ordinal Version", @@ -959,7 +959,7 @@ "type": "string", "pattern": "^([a-z]{2})(-[A-Z]{2})?$", "title": "Locale", - "description": "Defines a syntax for representing two character language code (ISO-639) followed by an optional two character country code. The language code must be lower case. If the country code is specified, the country code must be upper case. The language code and country code must be separated by a minus sign. Examples: en, en-US, fr, fr-CA" + "description": "Defines a syntax for representing two character language code (ISO-639) followed by an optional two character country code. The language code must be lower case. If the country code is specified, the country code must be upper case. The language code and country code must be separated by a minus sign. Examples: `\"en\"`, `\"en-US\"`, `\"fr\"`, `\"fr-CA\"`." }, "signatures": { "$ref": "cyclonedx-jss_X590_2023_10-2.0.schema.json#/$defs/signatures", diff --git a/schema/2.0/model/cyclonedx-component-2.0.schema.json b/schema/2.0/model/cyclonedx-component-2.0.schema.json index af1b29ef..1ffb6bef 100644 --- a/schema/2.0/model/cyclonedx-component-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-component-2.0.schema.json @@ -46,14 +46,14 @@ "container": "A packaging and/or runtime format, not specific to any particular technology, which isolates software inside the container from software outside of a container through virtualization technology. Refer to [https://en.wikipedia.org/wiki/OS-level_virtualization](https://en.wikipedia.org/wiki/OS-level_virtualization).", "platform": "A runtime environment that interprets or executes software. This may include runtimes such as those that execute bytecode, just-in-time compilers, interpreters, or low-code/no-code application platforms.", "operating-system": "A software operating system without regard to deployment model (i.e. installed on physical hardware, virtual machine, image, etc) Refer to [https://en.wikipedia.org/wiki/Operating_system](https://en.wikipedia.org/wiki/Operating_system).", - "device": "A hardware device such as a processor or chip-set. A hardware device containing firmware SHOULD include a component for the physical hardware itself and another component of type 'firmware' or 'operating-system' (whichever is relevant), describing information about the software running on the device. See also the list of [known device properties](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md).", + "device": "A hardware device such as a processor or chip-set. A hardware device containing firmware SHOULD include a component for the physical hardware itself and another component of `type=\"firmware\"` or `type=\"operating-system\"` (whichever is relevant), describing information about the software running on the device. See also the list of [known device properties](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md).", "device-driver": "A special type of software that operates or controls a particular type of device. Refer to [https://en.wikipedia.org/wiki/Device_driver](https://en.wikipedia.org/wiki/Device_driver).", "firmware": "A special type of software that provides low-level control over a device's hardware. Refer to [https://en.wikipedia.org/wiki/Firmware](https://en.wikipedia.org/wiki/Firmware).", "file": "A computer file. Refer to [https://en.wikipedia.org/wiki/Computer_file](https://en.wikipedia.org/wiki/Computer_file) for information about files.", "machine-learning-model": "A model based on training data that can make predictions or decisions without being explicitly programmed to do so.", "data": "A collection of discrete values that convey information.", "cryptographic-asset": "A cryptographic asset including algorithms, protocols, certificates, keys, tokens, and secrets.", - "material": "A physical substance in raw or processed form that is used to make, maintain, or repair an item, such as a metal, alloy, polymer, chemical, or other matter. Materials are commonly tracked for sourcing, provenance, and regulatory compliance. A finished physical item should be classified as 'device' instead.", + "material": "A physical substance in raw or processed form that is used to make, maintain, or repair an item, such as a metal, alloy, polymer, chemical, or other matter. Materials are commonly tracked for sourcing, provenance, and regulatory compliance. A finished physical item should be classified as 'type=\"device\"` instead.", "service": "A service, including microservices, function-as-a-service, and other types of network or intra-process services. Service-specific attributes, endpoints and the data profiles characterizing the data the service handles, apply exclusively to this component type." }, "title": "Component Type", @@ -91,23 +91,23 @@ "name": { "type": "string", "title": "Component Name", - "description": "The name of the component. This will often be a shortened, single name of the component. Examples: commons-lang3 and jquery", + "description": "The name of the component. This will often be a shortened, single name of the component. Examples: `\"commons-lang3\"` and `\"jquery\"`.", "examples": ["tomcat-catalina"] }, "version": { "$ref": "#/$defs/version", "title": "Component Version", - "description": "The component version. The version should ideally comply with semantic versioning but is not enforced.\nMust be used exclusively, either 'version' or 'versionRange', but not both." + "description": "The component version. The version should ideally comply with semantic versioning but is not enforced.\nMust be used exclusively, either `version` or `versionRange`, but not both." }, "versionRange": { "$ref": "#/$defs/versionRange", "title": "Component Version Range", - "description": "For an external component, this specifies the accepted version range.\nThe value must adhere to the Package URL Version Range syntax (vers), as defined at