From ca3a30fcbd350c880c43e40ed1681bec1e6f3980 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=88=98=E5=A4=A9=E8=B5=AB?= Date: Mon, 26 Oct 2026 09:52:21 +0800 Subject: [PATCH 1/2] test(2.0): add CBOM fixtures for family-only observations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two fixtures for the case discussed in CycloneDX/specification#1175: an algorithm family is observed, the parameter set is unknown, and no NIST category was assessed. - nistQuantumSecurityLevel is omitted, not set to 0: 0 means "none of the categories are met", which is a different and stronger claim - no custom namespaced property encodes assessment status, so the fixtures stay valid against the 2.0 schema on their own - the names carry the valid- prefix because AbstractJsonSchemaVerificationTest only picks up resources whose names start with "valid" or "invalid" Validated with ajv 8.20 against both the bundled and the modular 2.0 schema. Controls confirm the validation is not vacuous: a bogus algorithmFamily is rejected, nistQuantumSecurityLevel = 7 is rejected, = 0 is accepted. Signed-off-by: 刘天赫 --- .../2.0/valid-cbom-family-only-mlkem-2.0.json | 35 +++++++++++++++++++ .../2.0/valid-cbom-family-only-sm2-2.0.json | 35 +++++++++++++++++++ 2 files changed, 70 insertions(+) create mode 100644 tools/src/test/resources/2.0/valid-cbom-family-only-mlkem-2.0.json create mode 100644 tools/src/test/resources/2.0/valid-cbom-family-only-sm2-2.0.json diff --git a/tools/src/test/resources/2.0/valid-cbom-family-only-mlkem-2.0.json b/tools/src/test/resources/2.0/valid-cbom-family-only-mlkem-2.0.json new file mode 100644 index 000000000..277ef6928 --- /dev/null +++ b/tools/src/test/resources/2.0/valid-cbom-family-only-mlkem-2.0.json @@ -0,0 +1,35 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:0d3a9f2e-5c41-4b8e-9f67-2a1b3c4d5e01", + "version": 1, + "metadata": { + "timestamp": "2026-10-26T00:00:00Z" + }, + "inventories": [ + { + "subject": { + "bom-ref": "subject-mlkem-family-only", + "type": "application", + "name": "family-only observation: ML-KEM", + "version": "1.0" + }, + "components": [ + { + "bom-ref": "ml-kem-family-only", + "type": "cryptographic-asset", + "name": "ML-KEM", + "description": "Algorithm family observed without a parameter set and without a NIST category. nistQuantumSecurityLevel is omitted because the assessment was not performed; the omission is not a statement that no category is met.", + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "kem", + "algorithmFamily": "ML-KEM" + } + } + } + ] + } + ] +} diff --git a/tools/src/test/resources/2.0/valid-cbom-family-only-sm2-2.0.json b/tools/src/test/resources/2.0/valid-cbom-family-only-sm2-2.0.json new file mode 100644 index 000000000..4abf4d85c --- /dev/null +++ b/tools/src/test/resources/2.0/valid-cbom-family-only-sm2-2.0.json @@ -0,0 +1,35 @@ +{ + "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json", + "specFormat": "CycloneDX", + "specVersion": "2.0", + "serialNumber": "urn:uuid:0d3a9f2e-5c41-4b8e-9f67-2a1b3c4d5e02", + "version": 1, + "metadata": { + "timestamp": "2026-10-26T00:00:00Z" + }, + "inventories": [ + { + "subject": { + "bom-ref": "subject-sm2-family-only", + "type": "application", + "name": "family-only observation: SM2", + "version": "1.0" + }, + "components": [ + { + "bom-ref": "sm2-family-only", + "type": "cryptographic-asset", + "name": "SM2", + "description": "Algorithm family observed without a parameter set and without a NIST category. nistQuantumSecurityLevel is omitted because the assessment was not performed; the omission is not a statement that no category is met.", + "cryptoProperties": { + "assetType": "algorithm", + "algorithmProperties": { + "primitive": "signature", + "algorithmFamily": "SM2" + } + } + } + ] + } + ] +} From 055d96dcf1ef7cfe9380ce026ad27ac67beb3044 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=88=98=E5=A4=A9=E8=B5=AB?= Date: Mon, 26 Oct 2026 16:46:28 +0800 Subject: [PATCH 2/2] fixtures: stop asserting an assessment status from an omitted field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both family-only fixtures said the omission existed "because the assessment was not performed". That is the same inference this fixture pair is meant to disprove: omission records that no assertion was made, and says nothing about whether an assessment happened. It also implied SM2 cannot be assessed. Adopt the reviewer's wording, which describes only the recorded observation: Algorithm family observed without a recorded parameter set or asserted NIST security strength category. Omission of nistQuantumSecurityLevel does not establish whether an assessment was performed. No schema or structural change; the two description strings are the only edit. Validated against schema/2.0/cyclonedx-2.0-bundled.schema.json from 2.0-dev 76f185c45deb28c98b2555da9c752b9d43f50ecd with ajv 8.20.0 (draft 2020-12): both fixtures valid, bogus algorithmFamily rejected, level 7 rejected, explicit level 0 accepted. Signed-off-by: 刘天赫 --- .../test/resources/2.0/valid-cbom-family-only-mlkem-2.0.json | 2 +- .../src/test/resources/2.0/valid-cbom-family-only-sm2-2.0.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/src/test/resources/2.0/valid-cbom-family-only-mlkem-2.0.json b/tools/src/test/resources/2.0/valid-cbom-family-only-mlkem-2.0.json index 277ef6928..77a538cae 100644 --- a/tools/src/test/resources/2.0/valid-cbom-family-only-mlkem-2.0.json +++ b/tools/src/test/resources/2.0/valid-cbom-family-only-mlkem-2.0.json @@ -20,7 +20,7 @@ "bom-ref": "ml-kem-family-only", "type": "cryptographic-asset", "name": "ML-KEM", - "description": "Algorithm family observed without a parameter set and without a NIST category. nistQuantumSecurityLevel is omitted because the assessment was not performed; the omission is not a statement that no category is met.", + "description": "Algorithm family observed without a recorded parameter set or asserted NIST security strength category. Omission of nistQuantumSecurityLevel does not establish whether an assessment was performed.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { diff --git a/tools/src/test/resources/2.0/valid-cbom-family-only-sm2-2.0.json b/tools/src/test/resources/2.0/valid-cbom-family-only-sm2-2.0.json index 4abf4d85c..7a2ad41d3 100644 --- a/tools/src/test/resources/2.0/valid-cbom-family-only-sm2-2.0.json +++ b/tools/src/test/resources/2.0/valid-cbom-family-only-sm2-2.0.json @@ -20,7 +20,7 @@ "bom-ref": "sm2-family-only", "type": "cryptographic-asset", "name": "SM2", - "description": "Algorithm family observed without a parameter set and without a NIST category. nistQuantumSecurityLevel is omitted because the assessment was not performed; the omission is not a statement that no category is met.", + "description": "Algorithm family observed without a recorded parameter set or asserted NIST security strength category. Omission of nistQuantumSecurityLevel does not establish whether an assessment was performed.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": {