Identifier for referable and therefore interlink-able elements.
Simple Type refLinkType
Descriptor for an element identified by the attribute "bom-ref" in the same BOM document. In contrast to `bomLinkElementType`.
Simple Type versionType
A single disjunctive version identifier, for a component or service. Example values: - "9.0.14" - "v1.33.7" - "7.0.0-M1" - "2.0pre1" - "1.0.0-beta1" - "0.8.15"
Simple Type versionRangeType
A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst Example values: - "vers:cargo/9.0.14" - "vers:npm/1.2.3|>=2.0.0|<5.0.0" - "vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1" - "vers:tomee/>=1.0.0-beta1|<=1.7.5|>=7.0.0-M1|<=7.0.7|>=7.1.0|<=7.1.2|>=8.0.0-M1|<=8.0.1" - "vers:gem/>=2.2.0|!= 2.2.1|<2.3.0"
Simple Type bomLinkDocumentType
Descriptor for another BOM document. See https://cyclonedx.org/capabilities/bomlink/
Simple Type bomLinkElementType
Descriptor for an element in another BOM document. See https://cyclonedx.org/capabilities/bomlink/
Element timestamp
The date and time (timestamp) when the BOM was created.
Element lifecycles
Lifecycles communicate the stage(s) in which data in the BOM was captured. Different types of data may be available at various phases of a lifecycle, such as the Software Development Lifecycle (SDLC), IT Asset Management (ITAM), and Software Asset Management (SAM). Thus, a BOM may include data specific to or only obtainable in a given lifecycle.
Element phase
A pre-defined phase in the product lifecycle.
Element name
The name of the lifecycle phase
Element description
The description of the lifecycle phase
Element tools
The tool(s) used in the creation of the BOM.
Element tool
DEPRECATED. Use tools\components or tools\services instead.
Element components
A list of software and hardware components used as tools.
Element services
A list of services used as tools.
Element authors
The person(s) who created the BOM. Authors are common in BOMs created through manual processes. BOMs created through automated means may have './manufacturer' instead.
Element component
The component that the BOM describes.
Element manufacturer
The organization that created the BOM. Manufacturer is common in BOMs created through automated processes. BOMs created through manual means may have './authors' instead.
Element manufacture
DEPRECATED - DO NOT USE. This will be removed in a future version. Use the `./component/manufacturer` instead. The organization that manufactured the component that the BOM describes.
Element supplier
The organization that supplied the component that the BOM describes. The supplier may often be the manufacturer, but may also be a distributor or repackager.
Element licenses
The license information for the BOM document. This may be different from the license(s) of the component(s) that the BOM describes.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element name
The name of the organization
Element address
The physical address (location) of the organization.
Element url
The URL of the organization. Multiple URLs are allowed. Example: https://example.com
Element contact
A contact person at the organization. Multiple contacts are allowed.
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element vendor
The name of the vendor who created the tool
Element name
The name of the tool
Element version
The version of the tool
Element externalReferences
Provides the ability to document external references related to the tool.
Element name
The name of the contact
Element email
The email address of the contact.
Element phone
The phone number of the contact.
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element supplier
The organization that supplied the component. The supplier may often be the manufacturer, but may also be a distributor or repackager.
Element manufacturer
The organization that created the component. Manufacturer is common in components created through automated processes. Components created through manual means may have './authors' instead.
Element authors
The person(s) who created the component. Authors are common in components created through manual processes. Components created through automated means may have `./manufacturer` instead.
Element author
DEPRECATED - DO NOT USE. This will be removed in a future version. Use `./authors` or `./manufacturer` instead. The person(s) or organization(s) that authored the component.
Element publisher
The person(s) or organization(s) that published the component
Element group
The grouping name or identifier. This will often be a shortened, single name of the company or project that produced the component, or the source package or domain name. Whitespace and special characters should be avoided. Examples include: apache, org.apache.commons, and apache.org.
Element name
The name of the component. This will often be a shortened, single name of the component. Examples: commons-lang3 and jquery
Element version
The component version. The version should ideally comply with semantic versioning but is not enforced.
Element description
Specifies a description for the component
Element scope
Specifies the scope of the component. If scope is not specified, 'required' scope SHOULD be assumed by the consumer of the BOM.
Element hashes
The hashes of the component.
Element copyright
A copyright notice informing users of the underlying claims to copyright ownership in a published work.
Element cpe
Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe
Element purl
Specifies the package-url (purl). The purl, if specified, must be valid and conform to the specification defined at: https://github.com/package-url/purl-spec
Element omniborId
Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, must be valid and conform to the specification defined at: https://www.iana.org/assignments/uri-schemes/prov/gitoid
Element swhid
Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, must be valid and conform to the specification defined at: https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html
Element swid
Specifies metadata and content for ISO-IEC 19770-2 Software Identification (SWID) Tags.
Element modified
DEPRECATED - DO NOT USE. This will be removed in a future version. Use the pedigree element instead to supply information on exactly how the component was modified. A boolean value indicating if the component has been modified from the original. A value of true indicates the component is a derivative of the original. A value of false indicates the component has not been modified from the original.
Element pedigree
Component pedigree is a way to document complex supply chain scenarios where components are created, distributed, modified, redistributed, combined with other components, etc.
Element externalReferences
Provides the ability to document external references related to the component or to the project the component describes.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element components
A list of software and hardware components included in the parent component. This is not a dependency tree. It provides a way to specify a hierarchical representation of component assemblies, similar to system -> subsystem -> parts assembly in physical supply chains.
Element evidence
Provides the ability to document evidence collected through various forms of extraction or analysis.
Element releaseNotes
Specifies optional release notes.
Element modelCard
A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component of type `machine-learning-model` and must not be specified for other component types.
Element data
This object SHOULD be specified for any component of type `data` and must not be specified for other component types.
Element cryptoProperties
Cryptographic assets have properties that uniquely define them and that make them actionable for further reasoning. As an example, it makes a difference if one knows the algorithm family (e.g. AES) or the specific variant or instantiation (e.g. AES-128-GCM). This is because the security level and the algorithm primitive (authenticated encryption) is only defined by the definition of the algorithm variant. The presence of a weak cryptographic algorithm like SHA1 vs. HMAC-SHA1 also makes a difference.
Attribute type
Specifies the type of component. For software components, classify as application if no more specific appropriate classification is available or cannot be determined for the component.
Attribute mime-type
The optional mime-type of the component. When used on file components, the mime-type can provide additional context about the kind of file being represented such as an image, font, or executable. Some library or framework components may also have an associated mime-type.
Attribute bom-ref
An optional identifier which can be used to reference the component elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element id
A valid SPDX license identifier. If specified, this value must be one of the enumeration of valid SPDX license identifiers defined in the spdx.schema.json (or spdx.xml) subschema which is synchronized with the official SPDX license list.
Element name
The name of the license. This may include the name of a commercial or proprietary license or an open source license that may not be defined by SPDX.
Element text
Specifies the optional full text of the attachment
Element url
The URL to the attachment file. If the attachment is a license or BOM, an externalReference should also be specified for completeness.
Element licensing
Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata
Element altIds
License identifiers that may be used to manage licenses and their lifecycle
Element licensor
The individual or organization that grants a license to another individual or organization
Element organization
The organization that granted the license
Element individual
The individual, not associated with an organization, that granted the license
Element licensee
The individual or organization for which a license was granted to
Element organization
The organization that was granted the license
Element individual
The individual, not associated with an organization, that was granted the license
Element purchaser
The individual or organization that purchased the license
Element organization
The organization that purchased the license
Element individual
The individual, not associated with an organization, that purchased the license
Element purchaseOrder
The purchase order identifier the purchaser sent to a supplier or vendor to authorize a purchase
Element licenseTypes
The type of license(s) that was granted to the licensee
Element lastRenewal
The timestamp indicating when the license was last renewed. For new purchases, this is often the purchase or acquisition date. For non-perpetual licenses or subscriptions, this is the timestamp of when the license was last renewed.
Element expiration
The timestamp indicating when the current license expires (if applicable).
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Attribute bom-ref
An optional identifier which can be used to reference the license elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Attribute acknowledgement
Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.
Attribute content-type
Specifies the format and nature of the data being attached, helping systems correctly interpret and process the content. Common content type examples include `application/json` for JSON data and `text/plain` for plan text documents. RFC 2045 section 5.1 outlines the structure and use of content types. For a comprehensive list of registered content types, refer to the IANA media types registry at https://www.iana.org/assignments/media-types/media-types.xhtml.
Attribute encoding
Specifies the optional encoding the text is represented in
Attribute alg
Specifies the algorithm used to create the hash
Simple Type cpe
Define the format for acceptable CPE URIs. Supports CPE 2.2 and CPE 2.3 formats. Refer to https://nvd.nist.gov/products/cpe for official specification.
Element text
Specifies the full content of the SWID tag.
Element url
The URL to the SWID file.
Attribute tagId
Maps to the tagId of a SoftwareIdentity.
Attribute name
Maps to the name of a SoftwareIdentity.
Attribute version
Maps to the version of a SoftwareIdentity.
Attribute tagVersion
Maps to the tagVersion of a SoftwareIdentity.
Attribute patch
Maps to the patch of a SoftwareIdentity.
Simple Type urnUuid
Defines a string representation of a UUID conforming to RFC 4122.
Element reference
Zero or more external references can be defined
Element url
The URI (URL or URN) to the external reference. External references are URIs and therefore can accept any URL scheme including https, mailto, tel, and dns. External references may also include formally registered URNs such as CycloneDX BOM-Link to reference CycloneDX BOMs or any object within a BOM. BOM-Link transforms applicable external references into relationships that can be expressed in a BOM or across BOMs. Refer to: https://cyclonedx.org/capabilities/bomlink/
Element comment
An optional comment describing the external reference
Attribute type
Specifies the type of external reference. There are built-in types to describe common references. If a type does not exist for the reference being referred to, use the "other" type.
Element commit
Specifies an individual commit.
Element uid
A unique identifier of the commit. This may be version control specific. For example, Subversion uses revision numbers whereas git uses commit hashes.
Element url
The URL to the commit. This URL will typically point to a commit in a version control system.
Element author
The author who created the changes in the commit
Element committer
The person who committed or pushed the commit
Element message
The text description of the contents of the commit
Element patch
Specifies an individual patch.
Element diff
The patch file (or diff) that show changes. Refer to https://en.wikipedia.org/wiki/Diff
Attribute type
Specifies the purpose for the patch including the resolution of defects, security issues, or new behavior or functionality
Element text
Specifies the optional text of the diff
Element url
Specifies the URL to the diff
Element id
The identifier of the issue assigned by the source of the issue
Element name
The name of the issue
Element description
A description of the issue
Element name
The name of the source. For example "National Vulnerability Database", "NVD", and "Apache"
Element url
The url of the issue documentation as provided by the source
Element references
A collection of URL's for reference. Multiple URLs are allowed. Example: "https://example.com"
Attribute type
Specifies the type of issue
Element timestamp
The timestamp in which the action occurred
Element name
The name of the individual who performed the action
Element email
The email address of the individual who performed the action
Element ancestors
Describes zero or more components in which a component is derived from. This is commonly used to describe forks from existing projects where the forked version contains a ancestor node containing the original component it was forked from. For example, Component A is the original component. Component B is the component being used and documented in the BOM. However, Component B contains a pedigree node with a single ancestor documenting Component A - the original component from which Component B is derived from.
Element descendants
Descendants are the exact opposite of ancestors. This provides a way to document all forks (and their forks) of an original or root component.
Element variants
Variants describe relations where the relationship between the components are not known. For example, if Component A contains nearly identical code to Component B. They are both related, but it is unclear if one is derived from the other, or if they share a common ancestor.
Element commits
A list of zero or more commits which provide a trail describing how the component deviates from an ancestor, descendant, or variant.
Element patches
A list of zero or more patches describing how the component deviates from an ancestor, descendant, or variant. Patches may be complementary to commits or may be used in place of commits.
Element notes
Notes, observations, and other non-structured commentary describing the components pedigree.
Element dependency
The component or service that is a dependency of this dependency object.
Element provides
The component or service that define a given specification or standard, which is provided or implemented by this dependency object. For example, a cryptographic library which implements a cryptographic algorithm. A component which implements another component does not imply that the implementation is in use.
Attribute ref
References a component or service by its bom-ref attribute
Attribute ref
References a component or service by its bom-ref attribute
Element dependency
Defines the direct dependencies of a component or service. Components or services that do not have their own dependencies must be declared as empty elements within the graph. Components or services that are not represented in the dependency graph may have unknown dependencies. It is recommended that implementations assume this to be opaque and not an indicator of a object being dependency-free. It is recommended to leverage compositions to indicate unknown dependency graphs.
Element provider
The organization that provides the service.
Element group
The grouping name, namespace, or identifier. This will often be a shortened, single name of the company or project that produced the service or domain name. Whitespace and special characters should be avoided.
Element name
The name of the service. This will often be a shortened, single name of the service.
Element version
The service version.
Element description
Specifies a description for the service.
Element endpoints
The endpoint URIs of the service. Multiple endpoints are allowed. Example: "https://example.com/api/v1/ticker"
Element endpoint
A service endpoint URI.
Element authenticated
A boolean value indicating if the service requires authentication. A value of true indicates the service requires authentication prior to use. A value of false indicates the service does not require authentication.
Element x-trust-boundary
A boolean value indicating if use of the service crosses a trust zone or boundary. A value of true indicates that by using the service, a trust boundary is crossed. A value of false indicates that by using the service, a trust boundary is not crossed.
Element trustZone
The name of the trust zone the service resides in.
Element data
Specifies information about the data including the directional flow of data and the data classification.
Element classification
DEPRECATED: Specifies the data classification. THIS FIELD IS DEPRECATED AS OF v1.5. Use dataflow\classification instead
Element dataflow
Specifies the data classification.
Element classification
Specifies the data classification.
Element source
The URI, URL, or BOM-Link of the components or services the data came in from.
Element destination
The URI, URL, or BOM-Link of the components or services the data is sent to.
Attribute name
Name for the defined data.
Attribute description
Short description of the data content and usage.
Element externalReferences
Provides the ability to document external references related to the service.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element services
A list of services included or deployed behind the parent service. This is not a dependency tree. It provides a way to specify a hierarchical representation of service assemblies.
Element releaseNotes
Specifies optional release notes.
Attribute bom-ref
An optional identifier which can be used to reference the service elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Attribute flow
Specifies the flow direction of the data.
Simple Type dataFlowType
Specifies the flow direction of the data. Valid values are: inbound, outbound, bi-directional, and unknown. Direction is relative to the service. Inbound flow states that data enters the service. Outbound flow states that data leaves the service. Bi-directional states that data flows both ways, and unknown states that the direction is not known.
Element expression
A valid SPDX license expression. Refer to https://spdx.org/specifications for syntax requirements Example values: - Apache-2.0 AND (MIT OR GPL-2.0-only) - GPL-3.0-only WITH Classpath-exception-2.0
Attribute bom-ref
An optional identifier which can be used to reference the license elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Attribute acknowledgement
Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.
Element identity
Evidence that substantiates the identity of a component. The identify may be an object or an array of identity objects. Support for specifying identity as a single object was introduced in CycloneDX v1.5. "unbounded" was introduced in v1.6. It is recommended that all implementations are aware of "unbounded".
Element field
The identity field of the component which the evidence describes.
Element confidence
The overall confidence of the evidence from 0 - 1, where 1 is 100% confidence.
Element concludedValue
The value of the field (cpe, purl, etc) that has been concluded based on the aggregate of all methods (if available).
Element methods
The methods used to extract and/or analyze the evidence.
Element technique
The technique used in this method of analysis.
Element confidence
The confidence of the evidence from 0 - 1, where 1 is 100% confidence. Confidence is specific to the technique used. Each technique of analysis can have independent confidence.
Element value
The value or contents of the evidence.
Element tools
The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs. Tools used for analysis should already be defined in the BOM, either in the metadata/tools, components, or formulation.
Element occurrences
Evidence of individual instances of a component spread across multiple locations.
Element location
The location or path to where the component was found.
Element line
The line number where the component was found.
Element offset
The offset where the component was found.
Element symbol
The symbol name that was found associated with the component.
Element additionalContext
Any additional context of the detected component (e.g. a code snippet).
Attribute bom-ref
An optional identifier which can be used to reference the occurrence elsewhere in the BOM. Every bom-ref must be unique within the BOM.
Element callstack
Evidence of the components use through the callstack.
Element frame
Within a call stack, a frame is a discrete unit that encapsulates an execution context, including local variables, parameters, and the return address. As function calls are made, frames are pushed onto the stack, forming an array-like structure that orchestrates the flow of program execution and manages the sequence of function invocations.
Element package
A package organizes modules into namespaces, providing a unique namespace for each type it contains.
Element module
A module or class that encloses functions/methods and other code.
Element function
A block of code designed to perform a particular task.
Element parameters
Optional arguments that are passed to the module or function.
Element line
The line number the code that is called resides on.
Element column
The column the code that is called resides.
Element fullFilename
The full path and filename of the module.
Element tools
The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs. Tools used for analysis should already be defined in the BOM, either in the metadata/tools, components, or formulation.
Element copyright
Copyright evidence captures intellectual property assertions, providing evidence of possible ownership and legal protection.
Element aggregate
Specifies an aggregate type that describes how complete a relationship is.
Element assemblies
The bom-ref identifiers of the components or services being described. Assemblies refer to nested relationships whereby a constituent part may include other constituent parts. References do not cascade to child parts. References are explicit for the specified constituent part only.
Element dependencies
The bom-ref identifiers of the components or services being described. Dependencies refer to a relationship whereby an independent constituent part requires another independent constituent part. References do not cascade to transitive dependencies. References are explicit for the specified dependency only.
Element vulnerabilities
The bom-ref identifiers of the vulnerabilities being described.
Attribute bom-ref
An optional identifier which can be used to reference the composition elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Simple Type localeType
Defines a syntax for representing two character language code (ISO-639) followed by an optional two character country code. The language code must be lower case. If the country code is specified, the country code must be upper case. The language code and country code must be separated by a minus sign. Examples: en, en-US, fr, fr-CA
Element type
The software versioning type. It is recommended that the release type use one of 'major', 'minor', 'patch', 'pre-release', or 'internal'. Representing all possible software release types is not practical, so standardizing on the recommended values, whenever possible, is strongly encouraged. * major = A major release may contain significant changes or may introduce breaking changes. * minor = A minor release, also known as an update, may contain a smaller number of changes than major releases. * patch = Patch releases are typically unplanned and may resolve defects or important security issues. * pre-release = A pre-release may include alpha, beta, or release candidates and typically have limited support. They provide the ability to preview a release prior to its general availability. * internal = Internal releases are not for public consumption and are intended to be used exclusively by the project or manufacturer that produced it.
Element title
The title of the release.
Element featuredImage
The URL to an image that may be prominently displayed with the release note.
Element socialImage
The URL to an image that may be used in messaging on social media platforms.
Element description
A short description of the release.
Element timestamp
The date and time (timestamp) when the release note was created.
Element alias
One or more alternate names the release may be referred to. This may include unofficial terms used by development and marketing teams (e.g. code names).
Element resolves
A collection of issues that have been resolved.
Element note
Zero or more release notes containing the locale and content. Multiple note elements may be specified to support release notes in a wide variety of languages.
Element locale
The ISO-639 (or higher) language code and optional ISO-3166 (or higher) country code. Examples include: "en", "en-US", "fr" and "fr-CA".
Element text
Specifies the full content of the release note.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element modelParameters
Hyper-parameters for construction of the model.
Element approach
The overall approach to learning used by the model for problem solving.
Element type
Learning types describing the learning problem or hybrid learning problem.
Element task
Directly influences the input and/or output. Examples include classification, regression, clustering, etc.
Element architectureFamily
The model architecture family such as transformer network, convolutional neural network, residual neural network, LSTM neural network, etc.
Element modelArchitecture
The specific architecture of the model such as GPT-1, ResNet-50, YOLOv3, etc.
Element datasets
The datasets used to train and evaluate the model.
Element ref
References a data component by the components bom-ref attribute
Element dataset
Inline Data Information
Element inputs
The input format(s) of the model
Element format
The data format for input to the model. Example formats include string, image, time-series
Element outputs
The output format(s) from the model
Element format
The data format for output from the model. Example formats include string, image, time-series
Element quantitativeAnalysis
A quantitative analysis of the model
Element type
The type of performance metric.
Element value
The value of the performance metric.
Element slice
The name of the slice this metric was computed on. By default, assume this metric is not sliced.
Element confidenceInterval
The confidence interval of the metric.
Element lowerBound
The lower bound of the confidence interval.
Element upperBound
The upper bound of the confidence interval.
Element graphics
A collection of graphics that represent various measurements
Element description
A description of this collection of graphics.
Element collection
A collection of graphics.
Element name
The name of the graphic.
Element image
The graphic (vector or raster). Base64 encoding must be specified for binary images.
Element considerations
What considerations should be taken into account regarding the model's construction, training, and application?
Element users
Who are the intended users of the model?
Element useCases
What are the intended use cases of the model?
Element technicalLimitations
What are the known technical limitations of the model? E.g. What kind(s) of data should the model be expected not to perform well on? What are the factors that might degrade model performance?
Element performanceTradeoffs
What are the known tradeoffs in accuracy/performance of the model?
Element ethicalConsiderations
What are the ethical risks involved in the application of this model?
Element name
The name of the risk
Element mitigationStrategy
Strategy used to address this risk
Element environmentalConsiderations
What are the various environmental impacts the corresponding machine learning model has exhibited across its lifecycle?
Element fairnessAssessments
How does the model affect groups at risk of being systematically disadvantaged? What are the harms and benefits to the various affected groups?
Element groupAtRisk
The groups or individuals at risk of being systematically disadvantaged by the model.
Element benefits
Expected benefits to the identified groups.
Element harms
Expected harms to the identified groups.
Element mitigationStrategy
With respect to the benefits and harms outlined, please describe any mitigation strategy implemented.
Attribute bom-ref
An optional identifier which can be used to reference the model card elsewhere in the BOM. Every bom-ref must be unique within the BOM.
Element energyConsumptions
Describes energy consumption information incurred for one or more component lifecycle activities.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element activity
The type of activity that is part of a machine learning model development or operational lifecycle.
Element energyProviders
The provider(s) of the energy consumed by the associated model development lifecycle activity.
Element activityEnergyCost
The total energy cost associated with the model lifecycle activity.
Element co2CostEquivalent
The CO2 cost (debit) equivalent to the total energy cost.
Element co2CostOffset
The CO2 offset (credit) for the CO2 equivalent cost.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element value
Quantity of energy.
Element unit
Unit of energy.
Element value
Quantity of carbon dioxide (CO2).
Element unit
Unit of carbon dioxide (CO2).
Element description
A description of the energy provider.
Element organization
The organization of the energy provider.
Element energySource
The energy source for the energy provider.
Element energyProvided
The energy provided by the energy source for an associated activity.
Element externalReferences
External references provide a way to document systems, sites, and information that may be relevant but are not included with the BOM. They may also establish specific relationships within or external to the BOM.
Attribute bom-ref
An optional identifier which can be used to reference the energy provider elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element country
The country name or the two-letter ISO 3166-1 country code.
Element region
The region or state in the country. For example, Texas.
Element locality
The locality or city within the country. For example, Austin.
Element postOfficeBoxNumber
The post office box number. For example, 901.
Element postalCode
The postal code. For example, 78758.
Element streetAddress
The street address. For example, 100 Main Street.
Attribute bom-ref
An optional identifier which can be used to reference the address elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element type
The general theme or subject matter of the data being specified.
Element name
The name of the dataset.
Element contents
The contents or references to the contents of the data being described.
Element attachment
An optional way to include textual or encoded data.
Element url
The URL to where the data can be retrieved.
Element properties
Provides the ability to document name-value parameters used for configuration.
Element classification
Data classification tags data according to its type, sensitivity, and value if altered, stolen, or destroyed.
Element sensitiveData
A description of any sensitive data in a dataset.
Element graphics
A collection of graphics that represent various measurements.
Element description
A description of the dataset. Can describe size of dataset, whether it's used for source code, training, testing, or validation, etc.
Attribute bom-ref
An optional identifier which can be used to reference the dataset elsewhere in the BOM. Every bom-ref must be unique within the BOM.
Element custodians
Data custodians are responsible for the safe custody, transport, and storage of data.
Element stewards
Data stewards are responsible for data content, context, and associated business rules.
Element owners
Data owners are concerned with risk and appropriate access to data.
Element description
A description of this collection of graphics.
Element collection
A collection of graphics.
Element name
The name of the graphic.
Element image
The graphic (vector or raster). Base64 encoding must be specified for binary images.
Attribute ref
References a component or service by its bom-ref attribute
Attribute name
The name of the property. Duplicate names are allowed, each potentially having a different value.
Element vulnerability
Defines a weakness in a component or service that could be exploited or triggered by a threat source.
Element id
The identifier that uniquely identifies the vulnerability. For example: CVE-2021-39182, GHSA-35m5-8cvj-8783, and SNYK-PYTHON-ENROCRYPT-1912876.
Element source
The source that published the vulnerability.
Element references
Zero or more pointers to vulnerabilities that are the equivalent of the vulnerability specified. Often times, the same vulnerability may exist in multiple sources of vulnerability intelligence, but have different identifiers. References provide a way to correlate vulnerabilities across multiple sources of vulnerability intelligence.
Element reference
A pointer to a vulnerability that is the equivalent of the vulnerability specified.
Element id
The identifier that uniquely identifies the vulnerability. For example: CVE-2021-39182, GHSA-35m5-8cvj-8783, and SNYK-PYTHON-ENROCRYPT-1912876.
Element source
The source that published the vulnerability.
Element ratings
List of vulnerability ratings.
Element description
A description of the vulnerability as provided by the source.
Element detail
If available, an in-depth description of the vulnerability as provided by the source organization. Details often include information useful in understanding root cause.
Element recommendation
Recommendations of how the vulnerability can be remediated or mitigated.
Element workaround
A bypass, usually temporary, of the vulnerability that reduces its likelihood and/or impact. Workarounds often involve changes to configuration or deployments.
Element reproductionSteps
Precise steps to reproduce the vulnerability.
Element environment
A description of the environment in which reproduction was possible.
Element supportingMaterial
Supporting material that helps in reproducing or understanding how reproduction is possible. This may include screenshots, payloads, and PoC exploit code.
Element created
The date and time (timestamp) when the vulnerability record was created in the vulnerability database.
Element published
The date and time (timestamp) when the vulnerability record was first published.
Element updated
The date and time (timestamp) when the vulnerability record was last updated.
Element rejected
The date and time (timestamp) when the vulnerability record was rejected (if applicable).
Element credits
Individuals or organizations credited with the discovery of the vulnerability.
Element organizations
The organizations credited with vulnerability discovery.
Element individuals
The individuals, not associated with organizations, that are credited with vulnerability discovery.
Element tools
The tool(s) used to identify, confirm, or score the vulnerability.
Element tool
DEPRECATED. Use tools\components or tools\services instead.
Element components
A list of software and hardware components used as tools.
Element services
A list of services used as tools.
Element state
Declares the current state of an occurrence of a vulnerability, after automated or manual analysis.
Element justification
The rationale of why the impact analysis state was asserted.
Element responses
A response to the vulnerability by the manufacturer, supplier, or project responsible for the affected component or service. More than one response is allowed. Responses are strongly encouraged for vulnerabilities where the analysis state is exploitable.
Element detail
Detailed description of the impact including methods used during assessment. If a vulnerability is not exploitable, this field should include specific details on why the component or service is not impacted by this vulnerability.
Element firstIssued
The date and time (timestamp) when the analysis was first issued.
Element lastUpdated
The date and time (timestamp) when the analysis was last updated.
Element affects
The components or services that are affected by the vulnerability.
Element ref
References a component or service by the objects bom-ref.
Element versions
Zero or more individual versions or range of versions.
Element version
A single version of a component or service.
Element range
A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst
Element status
The vulnerability status for the version or range of versions.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Attribute bom-ref
An optional identifier which can be used to reference the vulnerability elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element name
The name of the source. For example: NVD, National Vulnerability Database, OSS Index, VulnDB, and GitHub Advisories
Element url
The url of the vulnerability documentation as provided by the source. For example: https://nvd.nist.gov/vuln/detail/CVE-2021-39182
Element source
The source that calculated the severity or risk rating of the vulnerability.
Element score
The numerical score of the rating.
Element severity
Textual representation of the severity that corresponds to the numerical score of the rating.
Element method
The risk scoring methodology/standard used.
Element vector
Textual representation of the metric values used to score the vulnerability.
Element justification
An optional reason for rating the vulnerability as it was.
Element title
An optional name of the advisory.
Element url
Location where the advisory can be obtained.
Element organization
The organization that created the annotation
Element individual
The person that created the annotation
Element component
The tool or component that created the annotation
Element service
The service that created the annotation
Element subjects
The objects in the BOM identified by their bom-ref's. This is often components or services, but may be any object type supporting bom-refs.
Element annotator
The organization, individual, component, or service which created the textual content of the annotation.
Element timestamp
The date and time (timestamp) when the annotation was created.
Element text
The textual content of the annotation.
Attribute bom-ref
An optional identifier which can be used to reference the annotation elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Simple Type severityType
Textual representation of the severity of the vulnerability adopted by the analysis method. If the analysis method uses values other than what is provided, the user is expected to translate appropriately.
Simple Type impactAnalysisStateType
Declares the current state of an occurrence of a vulnerability, after automated or manual analysis.
Simple Type impactAnalysisJustificationType
The rationale of why the impact analysis state was asserted.
Simple Type scoreSourceType
Specifies the severity or risk scoring methodology or standard used.
Simple Type impactAnalysisResponsesType
The rationale of why the impact analysis state was asserted.
Simple Type impactAnalysisAffectedStatusType
The vulnerability status of a given version or range of versions of a product. The statuses 'affected' and 'unaffected' indicate that the version is affected or unaffected by the vulnerability. The status 'unknown' indicates that it is unknown or unspecified whether the given version is affected. There can be many reasons for an 'unknown' status, including that an investigation has not been undertaken or that a vendor has not disclosed the status.
Element components
Transient components that are used in tasks that constitute one or more of this formula's workflows
Element services
Transient services that are used in tasks that constitute one or more of this formula's workflows
Element workflows
List of workflows that can be declared to accomplish specific orchestrated goals and independently triggered.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Attribute bom-ref
An optional identifier which can be used to reference the formula elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element uid
The unique identifier for the resource instance within its deployment context.
Element name
The name of the resource instance.
Element description
The description of the resource instance.
Element resourceReferences
References to component or service resources that are used to realize the resource instance.
Element tasks
The tasks that comprise the workflow.
Element taskDependencies
The graph of dependencies between tasks within the workflow.
Element taskTypes
Indicates the types of activities performed by the set of workflow tasks.
Element trigger
The trigger that initiated the task.
Element steps
The sequence of steps for the task.
Element inputs
Represents resources and data brought into a task at runtime by executor or task commands
Element outputs
Represents resources and data output from a task at runtime by executor or task commands
Element timeStart
The date and time (timestamp) when the task started.
Element timeEnd
The date and time (timestamp) when the task ended.
Element workspaces
A set of named filesystem or data resource shareable by workflow tasks.
Element runtimeTopology
A graph of the component runtime topology for workflow's instance. A description of the runtime component and service topology. This can describe a partial or complete topology used to host and execute the task (e.g., hardware, operating systems, configurations, etc.)
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Attribute bom-ref
An optional identifier which can be used to reference the workflow elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element ref
References an object by its bom-ref attribute
Element externalReference
Reference to an externally accessible resource.
Element uid
The unique identifier for the resource instance within its deployment context.
Element name
The name of the resource instance.
Element description
The description of the resource instance.
Element resourceReferences
References to component or service resources that are used to realize the resource instance.
Element taskTypes
Indicates the types of activities performed by the set of workflow tasks.
Element trigger
The trigger that initiated the task.
Element steps
The sequence of steps for the task.
Element inputs
Represents resources and data brought into a task at runtime by executor or task commands.
Element outputs
Represents resources and data output from a task at runtime by executor or task commands
Element timeStart
The date and time (timestamp) when the task started.
Element timeEnd
The date and time (timestamp) when the task ended.
Element workspaces
A set of named filesystem or data resource shareable by workflow tasks.
Element runtimeTopology
A graph of the component runtime topology for task's instance.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Attribute bom-ref
An optional identifier which can be used to reference the task elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element uid
The unique identifier for the resource instance within its deployment context.
Element name
The name of the resource instance.
Element aliases
The names for the workspace as referenced by other workflow tasks. Effectively, a name mapping so other tasks can use their own local name in their steps.
Element description
The description of the resource instance.
Element resourceReferences
References to component or service resources that are used to realize the resource instance.
Element accessMode
Describes the read-write access control for the workspace relative to the owning resource instance.
Element mountPath
A path to a location on disk where the workspace will be available to the associated task's steps.
Element managedDataType
The name of a domain-specific data type the workspace represents. This property is for CI/CD frameworks that are able to provide access to structured, managed data at a more granular level than a filesystem.
Element volumeRequest
Identifies the reference to the request for a specific volume type and parameters.
Element volume
Information about the actual volume instance allocated to the workspace.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Attribute bom-ref
An optional identifier which can be used to reference the workflow elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element uid
The unique identifier for the volume instance within its deployment context.
Element name
The name of the volume instance
Element mode
The mode for the volume instance.
Element path
The underlying path created from the actual volume.
Element sizeAllocated
The allocated size of the volume accessible to the associated workspace. This should include the scalar size as well as IEC standard unit in either decimal or binary form.
Element persistent
Indicates if the volume persists beyond the life of the resource it is associated with.
Element remote
Indicates if the volume is remotely (i.e., network) attached.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element name
A name for the step.
Element description
A description of the step.
Element commands
Ordered list of commands or directives for the step
Element executed
A text representation of the executed command.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element uid
The unique identifier for the resource instance within its deployment context.
Element name
The name of the resource instance.
Element description
The description of the resource instance.
Element resourceReferences
References to component or service resources that are used to realize the resource instance.
Element type
The source type of event which caused the trigger to fire.
Element event
The event data that caused the associated trigger to activate.
Element conditions
A list of conditions used to determine if a trigger should be activated.
Element condition
A condition that was used to determine a trigger should be activated.
Element description
Describes the set of conditions which cause the trigger to activate.
Element expression
The logical expression that was evaluated that determined the trigger should be fired.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element timeActivated
The date and time (timestamp) when the trigger was activated.
Element inputs
Represents resources and data brought into a task at runtime by executor or task commands
Element outputs
Represents resources and data output from a task at runtime by executor or task commands
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Attribute bom-ref
An optional identifier which can be used to reference the trigger elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
Element uid
The unique identifier of the event.
Element description
A description of the event.
Element timeReceived
The date and time (timestamp) when the event was received.
Element data
Encoding of the raw event data.
Element source
References the component or service that was the source of the event
Element target
References the component or service that was the target of the event
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element resource
A reference to an independent resource provided as an input to a task by the workflow runtime.
Element parameters
Inputs that have the form of parameters with names and values.
Element environmentVars
Inputs that have the form of parameters with names and values.
Element data
Inputs that have the form of data.
Element source
A references to the component or service that provided the input to the task (e.g., reference to a service with data flow value of inbound)
Element target
A reference to the component or service that received or stored the input if not the task itself (e.g., a local, named storage workspace)
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element resource
A reference to an independent resource generated as output by the task.
Element environmentVars
Outputs that have the form of environment variables.
Element data
Outputs that have the form of data.
Element type
Describes the type of data output.
Element source
Component or service that generated or provided the output from the task (e.g., a build tool)
Element target
Component or service that received the output from the task (e.g., reference to an artifactory service with data flow value of outbound)
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element name
The name of the parameter.
Element value
The value of the parameter.
Element dataType
The data type of the parameter.
Element assetType
Cryptographic assets occur in several forms. Algorithms and protocols are most commonly implemented in specialized cryptographic libraries. They may however also be 'hardcoded' in software components. Certificates and related cryptographic material like keys, tokens, secrets or passwords are other cryptographic assets to be modelled.
Element algorithmProperties
Additional properties specific to a cryptographic algorithm.
Element primitive
Cryptographic building blocks used in higher-level cryptographic systems and protocols. Primitives represent different cryptographic routines: deterministic random bit generators (drbg, e.g. CTR_DRBG from NIST SP800-90A-r1), message authentication codes (mac, e.g. HMAC-SHA-256), blockciphers (e.g. AES), streamciphers (e.g. Salsa20), signatures (e.g. ECDSA), hash functions (e.g. SHA-256), public-key encryption schemes (pke, e.g. RSA), extended output functions (xof, e.g. SHAKE256), key derivation functions (e.g. pbkdf2), key agreement algorithms (e.g. ECDH), key encapsulation mechanisms (e.g. ML-KEM), authenticated encryption (ae, e.g. AES-GCM) and the combination of multiple algorithms (combiner, e.g. SP800-56Cr2).
Element parameterSetIdentifier
An identifier for the parameter set of the cryptographic algorithm. Examples: in AES128, '128' identifies the key length in bits, in SHA256, '256' identifies the digest length, '128' in SHAKE128 identifies its maximum security level in bits, and 'SHA2-128s' identifies a parameter set used in SLH-DSA (FIPS205).
Element curve
The specific underlying Elliptic Curve (EC) definition employed which is an indicator of the level of security strength, performance and complexity. Absent an authoritative source of curve names, CycloneDX recommends use of curve names as defined at https://neuromancer.sk/std/, the source from which can be found at https://github.com/J08nY/std-curves.
Element executionEnvironment
The target and execution environment in which the algorithm is implemented in.
Element implementationPlatform
The target platform for which the algorithm is implemented. The implementation can be 'generic', running on any platform or for a specific platform.
Element certificationLevel
The certification that the implementation of the cryptographic algorithm has received, if any. Certifications include revisions and levels of FIPS 140 or Common Criteria of different Extended Assurance Levels (CC-EAL).
Element mode
The mode of operation in which the cryptographic algorithm (block cipher) is used.
Element padding
The padding scheme that is used for the cryptographic algorithm.
Element cryptoFunctions
The cryptographic functions implemented by the cryptographic algorithm.
Element classicalSecurityLevel
The classical security level that a cryptographic algorithm provides (in bits).
Element nistQuantumSecurityLevel
The NIST security strength category as defined in https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). A value of 0 indicates that none of the categories are met.
Element certificateProperties
Properties for cryptographic assets of asset type 'certificate'
Element subjectName
The subject name for the certificate
Element issuerName
The issuer name for the certificate
Element notValidBefore
The date and time according to ISO-8601 standard from which the certificate is valid
Element notValidAfter
The date and time according to ISO-8601 standard from which the certificate is not valid anymore
Element signatureAlgorithmRef
The bom-ref to signature algorithm used by the certificate
Element subjectPublicKeyRef
The bom-ref to the public key of the subject
Element certificateFormat
The format of the certificate. Examples include X.509, PEM, DER, and CVC
Element certificateExtension
The file extension of the certificate. Examples include crt, pem, cer, der, and p12.
Element relatedCryptoMaterialProperties
Properties for cryptographic assets of asset type 'relatedCryptoMaterial'
Element type
The type for the related cryptographic material
Element id
The optional unique identifier for the related cryptographic material.
Element state
The key state as defined by NIST SP 800-57.
Element algorithmRef
The bom-ref to the algorithm used to generate the related cryptographic material.
Element creationDate
The date and time (timestamp) when the related cryptographic material was created.
Element activationDate
The date and time (timestamp) when the related cryptographic material was activated.
Element updateDate
The date and time (timestamp) when the related cryptographic material was updated.
Element expirationDate
The date and time (timestamp) when the related cryptographic material expires.
Element value
The associated value of the cryptographic material.
Element size
The size of the cryptographic asset (in bits).
Element format
The format of the related cryptographic material (e.g. P8, PEM, DER).
Element securedBy
The mechanism by which the cryptographic asset is secured by.
Element mechanism
Specifies the mechanism by which the cryptographic asset is secured by. Examples include HSM, TPM, XGX, Software, and None.
Element algorithmRef
The bom-ref to the algorithm.
Element protocolProperties
Properties specific to cryptographic assets of type: 'protocol'.
Element type
The concrete protocol type.
Element version
The version of the protocol. Examples include 1.0, 1.2, and 1.99.
Element cipherSuites
A list of cipher suites related to the protocol.
Element name
A common name for the cipher suite. For example: TLS_DHE_RSA_WITH_AES_128_CCM
Element algorithms
A list of algorithms related to the cipher suite.
Element algorithm
The bom-ref to algorithm cryptographic asset.
Element identifiers
A list of common identifiers for the cipher suite.
Element identifier
Cipher suite identifier. Examples include 0xC0 and 0x9E.
Element ikev2TransformTypes
The IKEv2 transform types supported (types 1-4), defined in RFC7296 section 3.3.2, and additional properties.
Element encr
Transform Type 1: encryption algorithms
Element prf
Transform Type 2: pseudorandom functions
Element integ
Transform Type 3: integrity algorithms
Element ke
Transform Type 4: Key Exchange Method (KE) per RFC9370, formerly called Diffie-Hellman Group (D-H)
Element esn
Specifies if an Extended Sequence Number (ESN) is used.
Element auth
IKEv2 Authentication method
Element cryptoRef
A protocol-related cryptographic assets
Element oid
The object identifier (OID) of the cryptographic asset.
Element assessors
The list of assessors evaluating claims and determining conformance to requirements and confidence in that assessment.
Element assessor
The assessor who evaluates claims and determines conformance to requirements and confidence in that assessment.
Element thirdParty
The boolean indicating if the assessor is outside the organization generating claims. A value of false indicates a self assessor.
Element organization
The entity issuing the assessment.
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref must be unique within the BOM.
Element attestations
The list of attestations asserted by an assessor that maps requirements to claims.
Element attestation
An attestation asserted by an assessor that maps requirements to claims.
Element summary
The short description explaining the main points of the attestation.
Element assessor
The `bom-ref` to the assessor asserting the attestation.
Element map
The grouping of requirements to claims and the attestors declared conformance and confidence thereof.
Element requirement
The `bom-ref` to the requirement being attested to.
Element claims
The list of `bom-ref` to the claims being attested to.
Element claim
The `bom-ref` to the claim being attested to.
Element counterClaims
The list of `bom-ref` to the counter claims being attested to.
Element counterClaim
The `bom-ref` to the counter claim being attested to.
Element conformance
The conformance of the claim meeting a requirement.
Element score
The conformance of the claim between and inclusive of 0 and 1, where 1 is 100% conformance.
Element rationale
The rationale for the score of conformance.
Element mitigationStrategies
The list of `bom-ref` to the evidence provided describing the mitigation strategies. Each mitigation strategy should include an explanation of how any weaknesses in the evidence will be mitigated.
Element confidence
The confidence of the claim meeting the requirement.
Element score
The confidence of the claim between and inclusive of 0 and 1, where 1 is 100% confidence.
Element rationale
The rationale for the confidence score.
Element claims
The list of claims.
Element target
The `bom-ref` to a target representing a specific system, application, API, module, team, person, process, business unit, company, etc... that this claim is being applied to.
Element predicate
The specific statement or assertion about the target.
Element mitigationStrategies
The list of `bom-ref` to the evidence provided describing the mitigation strategies. Each mitigation strategy should include an explanation of how any weaknesses in the evidence will be mitigated.
Element reasoning
The written explanation of why the evidence provided substantiates the claim.
Element evidence
The list of `bom-ref` to evidence that supports this claim.
Element counterEvidence
The list of `bom-ref` to counterEvidence that supports this claim.
Element externalReferences
Provides the ability to document external references related to the claim the BOM describes.
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref must be unique within the BOM.
Element evidence
The list of evidence
Element evidence
The list of evidence
Element propertyName
The reference to the property name as defined in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy/).
Element description
The written description of what this evidence is and how it was created.
Element data
The output or analysis that supports claims.
Element name
The name of the data.
Element contents
The contents or references to the contents of the data being described.
Element attachment
An optional way to include textual or encoded data.
Element url
The URL to where the data can be retrieved.
Element classification
Data classification tags data according to its type, sensitivity, and value if altered, stolen, or destroyed.
Element sensitiveData
A description of any sensitive data.
Element created
The date and time (timestamp) when the evidence was created.
Element expires
The optional date and time (timestamp) when the evidence is no longer valid.
Element author
The author of the evidence.
Element reviewer
The reviewer of the evidence.
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref must be unique within the BOM.
Element targets
The list of targets which claims are made against.
Element organizations
The list of organizations which claims are made against.
Element components
The list of components which claims are made against.
Element services
The list of services which claims are made against.
Element affirmation
A concise statement affirmed by an individual regarding all declarations, often used for third-party auditor acceptance or recipient acknowledgment. It includes a list of authorized signatories who assert the validity of the document on behalf of the organization.
Element statement
The brief statement affirmed by an individual regarding all declarations. This could be an affirmation of acceptance by a third-party auditor or receiving individual of a file. For example: "I certify, to the best of my knowledge, that all information is correct."
Element signatories
The list of signatories authorized on behalf of an organization to assert validity of this document.
Element name
The signatory's name.
Element role
The signatory's role within an organization.
Element organization
The signatory's organization.
Element externalReference
An External reference provide a way to document systems, sites, and information that may be relevant, but are not included with the BOM. They may also establish specific relationships within or external to the BOM.
Element name
The name of the standard. This will often be a shortened, single name of the standard.
Element version
The version of the standard.
Element description
The description of the standard.
Element owner
The owner of the standard, often the entity responsible for its release.
Element requirements
The list of requirements comprising the standard.
Element identifier
The unique identifier used in the standard to identify a specific requirement. This should match what is in the standard and should not be the requirements bom-ref.
Element title
The title of the requirement.
Element text
The textual content of the requirement.
Element descriptions
The supplemental text that provides additional guidance or context to the requirement, but is not directly part of the requirement.
Element openCre
The Common Requirements Enumeration (CRE) identifier(s). CRE is a structured and standardized framework for uniting security standards and guidelines. CRE links each section of a resource to a shared topic identifier (a Common Requirement). Through this shared topic link, all resources map to each other. Use of CRE promotes clear and unambiguous communication among stakeholders.
Element parent
The optional `bom-ref` to a parent requirement. This establishes a hierarchy of requirements. Top-level requirements must not define a parent. Only child requirements should define parents.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element externalReferences
Provides the ability to document external references related to the BOM or to the project the BOM describes.
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref must be unique within the BOM.
Element levels
The list of levels associated with the standard. Some standards have different levels of compliance.
Element identifier
The identifier used in the standard to identify a specific level.
Element title
The title of the level.
Element description
The description of the level.
Element requirements
The list of requirement `bom-ref`s that comprise the level.
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref must be unique within the BOM.
Element externalReferences
Provides the ability to document external references related to the BOM or to the project the BOM describes.
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere in the BOM. Every bom-ref must be unique within the BOM.
Element tag
Textual strings that aid in discovery, search, and retrieval of the associated object. Tags often serve as a way to group or categorize similar or related objects by various attributes. Examples include: "json-parser", "object-persistence", "text-to-image", "translation", and "object-detection"
Element metadata
Provides additional information about a BOM.
Element components
A list of software and hardware components.
Element services
A list of services. This may include microservices, function-as-a-service, and other types of network or intra-process services.
Element externalReferences
Provides the ability to document external references related to the BOM or to the project the BOM describes.
Element dependencies
Provides the ability to document dependency relationships.
Element compositions
Compositions describe constituent parts (including components, services, and dependency relationships) and their completeness. The completeness of vulnerabilities expressed in a BOM may also be described.
Element properties
Provides the ability to document properties in a name/value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. Formal registration is optional.
Element vulnerabilities
Vulnerabilities identified in components or services.
Element annotations
Comments made by people, organizations, or tools about any object with a bom-ref, such as components, services, vulnerabilities, or the BOM itself. Unlike inventory information, annotations may contain opinion or commentary from various stakeholders. Annotations may be inline (with inventory) or externalized via BOM-Link, and may optionally be signed.
Element formulation
Describes how a component or service was manufactured or deployed. This is achieved through the use of formulas, workflows, tasks, and steps, which declare the precise steps to reproduce along with the observed formulas describing the steps which transpired in the manufacturing process.
Element declarations
The list of declarations which describe the conformance to standards. Each declaration may include attestations, claims, and evidence.
Element definitions
A collection of reusable objects that are defined and may be used elsewhere in the BOM.
Attribute version
Whenever an existing BOM is modified, either manually or through automated processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM. The default version is '1'.
Attribute serialNumber
Every BOM generated SHOULD have a unique serial number, even if the contents of the BOM have not changed over time. If specified, the serial number must conform to RFC-4122. Use of serial numbers are recommended.
Whenever an existing BOM is modified, either manually or through automated
processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with
multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM.
The default version is '1'.
Every BOM generated SHOULD have a unique serial number, even if the contents of
the BOM have not changed over time. If specified, the serial number must conform to RFC-4122.
Use of serial numbers are recommended.
An optional identifier which can be used to reference the annotation elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
Allow any attributes from any namespace (lax validation).><bom:subjects>[0..1]Start Sequence[0..*]<bom:subject>bom:bomReferenceType</bom:subject>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</bom:subjects><bom:annotator>bom:annotatorChoiceType</bom:annotator>[1]<bom:timestamp>xs:dateTime</bom:timestamp>[1]<bom:text>xs:string</bom:text>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:annotation>bom:annotationType</bom:annotation>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
Specifies the format and nature of the data being attached, helping systems correctly
interpret and process the content. Common content type examples include `application/json`
for JSON data and `text/plain` for plan text documents.
RFC 2045 section 5.1 outlines the structure and use of content types. For a comprehensive
list of registered content types, refer to the IANA media types registry at
https://www.iana.org/assignments/media-types/media-types.xhtml.
<...><bom:uid>xs:normalizedString</bom:uid>[0..1]<bom:url>xs:anyURI</bom:url>[0..1]<bom:author>bom:identifiableActionType</bom:author>[0..1]<bom:committer>bom:identifiableActionType</bom:committer>[0..1]<bom:message>xs:normalizedString</bom:message>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
<...>Start Sequence[0..*]<bom:commit>bom:commitType</bom:commit>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
Specifies the type of component. For software components, classify as application if no more
specific appropriate classification is available or cannot be determined for the component.
The optional mime-type of the component. When used on file components, the mime-type
can provide additional context about the kind of file being represented such as an image,
font, or executable. Some library or framework components may also have an associated mime-type.
An optional identifier which can be used to reference the component elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
An optional identifier which can be used to reference the occurrence elsewhere
in the BOM. Every bom-ref must be unique within the BOM.
>[0..*]<bom:location>xs:string</bom:location>[1]<bom:line>xs:nonNegativeInteger</bom:line>[0..1]<bom:offset>xs:nonNegativeInteger</bom:offset>[0..1]<bom:symbol>xs:string</bom:symbol>[0..1]<bom:additionalContext>xs:string</bom:additionalContext>[0..1]</bom:occurrence></bom:occurrences><bom:callstack>[0..1]<bom:frames>[0..1]<bom:frame>[0..*]<bom:package>xs:string</bom:package>[0..1]<bom:module>xs:string</bom:module>[1]<bom:function>xs:string</bom:function>[0..1]<bom:parameters>[0..1]<bom:parameter>xs:string</bom:parameter>[0..*]</bom:parameters><bom:line>xs:integer</bom:line>[0..1]<bom:column>xs:integer</bom:column>[0..1]<bom:fullFilename>xs:string</bom:fullFilename>[0..1]</bom:frame></bom:frames><bom:tools>[0..1]<bom:tool>bom:bomReferenceType</bom:tool>[0..*]</bom:tools></bom:callstack><bom:licenses>bom:licenseChoiceType</bom:licenses>[0..1]<bom:copyright>bom:copyrightsType</bom:copyright>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:component>bom:component</bom:component>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
An optional identifier which can be used to reference the composition elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
>Start Sequence[0..*]<bom:aggregate>bom:aggregateType</bom:aggregate>[1]<bom:assemblies>[0..1]Start Sequence[0..*]<bom:assembly>bom:bomReferenceType</bom:assembly>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</bom:assemblies><bom:dependencies>[0..1]Start Sequence[0..*]<bom:dependency>bom:bomReferenceType</bom:dependency>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</bom:dependencies><bom:vulnerabilities>[0..1]Start Sequence[0..*]<bom:vulnerability>bom:bomReferenceType</bom:vulnerability>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</bom:vulnerabilities>End Sequence</...>
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:composition>bom:compositionType</bom:composition>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
Cryptographic assets have properties that uniquely define them and that make them actionable for further reasoning. As an example, it makes a difference if one knows the algorithm family (e.g. AES) or the specific variant or instantiation (e.g. AES-128-GCM). This is because the security level and the algorithm primitive (authenticated encryption) is only defined by the definition of the algorithm variant. The presence of a weak cryptographic algorithm like SHA1 vs. HMAC-SHA1 also makes a difference.
An optional identifier which can be used to reference the object elsewhere in the BOM.
Every bom-ref must be unique within the BOM.
Allow any attributes from a namespace other than this schema's namespace (lax validation).>[0..*]<bom:thirdParty>xs:boolean</bom:thirdParty>[0..1]<bom:organization>bom:organizationalEntity</bom:organization>[0..1]</bom:assessor></bom:assessors><bom:attestations>[0..1]<bom:attestation>[0..*]<bom:summary>xs:string</bom:summary>[0..1]<bom:assessor>bom:refLinkType</bom:assessor>[0..1]<bom:map>[0..*]<bom:requirement>bom:refLinkType</bom:requirement>[0..1]<bom:claims>[0..1]<bom:claim>bom:refLinkType</bom:claim>[0..*]</bom:claims><bom:counterClaims>[0..1]<bom:counterClaim>bom:refLinkType</bom:counterClaim>[0..*]</bom:counterClaims><bom:conformance>[0..1]<bom:score>xs:decimal (0 <= value <= 1)</bom:score>[1]<bom:rationale>xs:string</bom:rationale>[0..1]<bom:mitigationStrategies>[0..1]<bom:mitigationStrategy>bom:refLinkType</bom:mitigationStrategy>[0..*]</bom:mitigationStrategies></bom:conformance><bom:confidence>[0..1]<bom:score>xs:decimal (0 <= value <= 1)</bom:score>[1]<bom:rationale>xs:string</bom:rationale>[0..1]</bom:confidence></bom:map>Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</bom:attestation></bom:attestations><bom:claims>[0..1]<bom:claimbom-ref="bom:refType"[0..1]
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere
in the BOM. Every bom-ref must be unique within the BOM.
Allow any attributes from a namespace other than this schema's namespace (lax validation).>[0..*]<bom:target>bom:refLinkType</bom:target>[0..1]<bom:predicate>xs:string</bom:predicate>[0..1]<bom:mitigationStrategies>[0..1]<bom:mitigationStrategy>bom:refLinkType</bom:mitigationStrategy>[0..*]</bom:mitigationStrategies><bom:reasoning>xs:string</bom:reasoning>[0..1]<bom:evidence>bom:refLinkType</bom:evidence>[0..*]<bom:counterEvidence>bom:refLinkType</bom:counterEvidence>[0..*]<bom:externalReferences>bom:externalReferences</bom:externalReferences>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</bom:claim></bom:claims><bom:evidence>[0..1]<bom:evidencebom-ref="bom:refType"[0..1]
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere
in the BOM. Every bom-ref must be unique within the BOM.
Allow any attributes from a namespace other than this schema's namespace (lax validation).>[0..*]<bom:propertyName>xs:string</bom:propertyName>[0..1]<bom:description>xs:string</bom:description>[0..1]<bom:data>[0..*]<bom:name>xs:string</bom:name>[0..1]<bom:contents>[0..1]<bom:attachment>bom:attachedTextType</bom:attachment>[0..1]<bom:url>xs:anyURI</bom:url>[0..1]</bom:contents><bom:classification>xs:string</bom:classification>[0..1]<bom:sensitiveData> ... </bom:sensitiveData>[0..*]<bom:governance>bom:dataGovernance</bom:governance>[0..1]</bom:data><bom:created>xs:dateTime</bom:created>[0..1]<bom:expires>xs:dateTime</bom:expires>[0..1]<bom:author>bom:organizationalContact</bom:author>[0..1]<bom:reviewer>bom:organizationalContact</bom:reviewer>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</bom:evidence></bom:evidence><bom:targets>[0..1]<bom:organizations>[0..1]<bom:organization>bom:organizationalEntity</bom:organization>[0..*]</bom:organizations><bom:components>[0..1]<bom:component>bom:component</bom:component>[0..*]</bom:components><bom:services>[0..1]<bom:service>bom:service</bom:service>[0..*]</bom:services></bom:targets><bom:affirmation>[0..1]<bom:statement>xs:string</bom:statement>[0..1]<bom:signatories>[0..1]<bom:signatory>[0..*]<bom:name>xs:string</bom:name>[0..1]<bom:role>xs:string</bom:role>[0..1]<bom:organization>bom:organizationalEntity</bom:organization>[0..1]<bom:externalReference>bom:externalReference</bom:externalReference>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</bom:signatory></bom:signatories>Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</bom:affirmation>Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
References a component or service by its bom-ref attribute
Allow any attributes from a namespace other than this schema's namespace (lax validation).>Start Sequence[0..*]<bom:dependency>bom:dependencyType</bom:dependency>[0..1]<bom:providesref="bom:refLinkType"[1]
Attribute ref
References a component or service by its bom-ref attribute
<...><bom:text>bom:attachedTextType</bom:text>[0..1]<bom:url>xs:anyURI</bom:url>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:energyConsumption>bom:energyConsumptionType</bom:energyConsumption>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
An optional identifier which can be used to reference the energy provider elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
><bom:description>xs:string</bom:description>[0..1]<bom:organization>bom:organizationalEntity</bom:organization>[1]<bom:energySource>xs:string (value comes from list: {
'coal'|
'oil'|
'natural-gas'|
'nuclear'|
'wind'|
'solar'|
'geothermal'|
'hydropower'|
'biofuel'|
'unknown'|
'other'})</bom:energySource>[1]<bom:energyProvided>bom:energyMeasureType</bom:energyProvided>[1]<bom:externalReferences>bom:externalReferences</bom:externalReferences>[0..1]</...>
Specifies the type of external reference. There are built-in types to describe common
references. If a type does not exist for the reference being referred to, use the "other" type.
Allow any attributes from any namespace (lax validation).><bom:url>union of: [ xs:anyURI,bom:bomLinkType ]</bom:url>[1]<bom:comment>xs:string</bom:comment>[0..1]<bom:hashes>[0..1]Start Sequence[0..*]<bom:hash>bom:hashType</bom:hash>[1]End Sequence</bom:hashes></...>
External references provide a way to document systems, sites, and information that may be relevant, but are not included with the BOM. They may also establish specific relationships within or external to the BOM.
An optional identifier which can be used to reference the formula elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
Describes how a component or service was manufactured or deployed. This is achieved through the use of formulas, workflows, tasks, and steps, which declare the precise steps to reproduce along with the observed formulas describing the steps which transpired in the manufacturing process.
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:formula>bom:formulaType</bom:formula>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
<...><bom:timestamp>xs:dateTime</bom:timestamp>[0..1]<bom:name>xs:normalizedString</bom:name>[0..1]<bom:email>xs:normalizedString</bom:email>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
<xs:complexTypename="inputType"><xs:sequence><xs:choice><xs:elementname="resource"type="bom:resourceReferenceType"minOccurs="1"maxOccurs="1"/><xs:elementname="parameters"type="bom:parametersType"minOccurs="1"maxOccurs="1"/><xs:elementname="environmentVars"minOccurs="1"maxOccurs="1"><xs:complexType><xs:sequenceminOccurs="0"maxOccurs="unbounded"><-- maxOccurs="unbounded" NEEDS to be set on the sequence, not the individual elements --><xs:choice><xs:elementname="environmentVar"type="bom:propertyType"minOccurs="0"maxOccurs="1"/><xs:elementname="value"type="xs:string"minOccurs="0"maxOccurs="1"/></xs:choice></xs:sequence></xs:complexType></xs:element><xs:elementname="data"type="bom:attachedTextType"minOccurs="1"maxOccurs="1"/></xs:choice><xs:elementname="source"type="bom:resourceReferenceType"minOccurs="0"maxOccurs="1"/><xs:elementname="target"type="bom:resourceReferenceType"minOccurs="0"maxOccurs="1"/><xs:elementname="properties"type="bom:propertiesType"minOccurs="0"maxOccurs="1"/><xs:anynamespace="##other"processContents="lax"minOccurs="0"maxOccurs="unbounded"/></xs:sequence><xs:anyAttributenamespace="##any"processContents="lax"/></xs:complexType>
><bom:id>xs:normalizedString</bom:id>[0..1]<bom:name>xs:normalizedString</bom:name>[0..1]<bom:description>xs:normalizedString</bom:description>[0..1]<bom:source>[0..1]<bom:name>xs:normalizedString</bom:name>[0..1]<bom:url>xs:anyURI</bom:url>[0..1]</bom:source><bom:references>[0..1]Start Sequence[0..*]<bom:url>xs:anyURI</bom:url>[1]End Sequence</bom:references>Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
An optional identifier which can be used to reference the license elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
Declared licenses and concluded licenses represent two different stages in the
licensing process within software development. Declared licenses refer to the
initial intention of the software authors regarding the licensing terms under
which their code is released. On the other hand, concluded licenses are the
result of a comprehensive analysis of the project's codebase to identify and
confirm the actual licenses of the components used, which may differ from the
initially declared licenses. While declared licenses provide an upfront indication
of the licensing intentions, concluded licenses offer a more thorough understanding
of the actual licensing within a project, facilitating proper compliance and risk
management. Observed licenses are defined in `evidence.licenses`. Observed licenses
form the evidence necessary to substantiate a concluded license.
Specifies the details and attributes related to a software license. It can either include a valid SPDX license identifier or a named license, along with additional properties such as license acknowledgment, comprehensive commercial licensing information, and the full text of the license.
An optional identifier which can be used to reference the license elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
Declared licenses and concluded licenses represent two different stages in the
licensing process within software development. Declared licenses refer to the
initial intention of the software authors regarding the licensing terms under
which their code is released. On the other hand, concluded licenses are the
result of a comprehensive analysis of the project's codebase to identify and
confirm the actual licenses of the components used, which may differ from the
initially declared licenses. While declared licenses provide an upfront indication
of the licensing intentions, concluded licenses offer a more thorough understanding
of the actual licensing within a project, facilitating proper compliance and risk
management. Observed licenses are defined in `evidence.licenses`. Observed licenses
form the evidence necessary to substantiate a concluded license.
A model card describes the intended uses of a machine learning model and potential limitations, including biases and ethical considerations. Model cards typically contain the training parameters, which datasets were used to train the model, performance metrics, and other relevant data useful for ML transparency. This object SHOULD be specified for any component of type `machine-learning-model` and must not be specified for other component types.
<xs:complexTypename="modelCardType"><--
Model card support in CycloneDX is derived from TensorFlow Model Card Toolkit released under the Apache 2.0 license and
available from https://github.com/tensorflow/model-card-toolkit/blob/main/model_card_toolkit/schema/v0.0.2/model_card.schema.json.
In addition, CycloneDX model card support includes portions of VerifyML, also released under the Apache 2.0 license and
available from https://github.com/cylynx/verifyml/blob/main/verifyml/model_card_toolkit/schema/v0.0.4/model_card.schema.json.
--><xs:sequence><xs:elementname="modelParameters"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="approach"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="type"type="bom:machineLearningApproachType"minOccurs="0"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:elementname="task"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="architectureFamily"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="modelArchitecture"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="datasets"minOccurs="0"maxOccurs="1"><xs:complexType><xs:choiceminOccurs="0"maxOccurs="unbounded"><xs:elementname="ref"minOccurs="0"maxOccurs="1"><xs:simpleType><xs:unionmemberTypes="bom:refLinkTypebom:bomLinkElementType"/></xs:simpleType></xs:element><xs:elementname="dataset"type="bom:componentDataType"minOccurs="0"maxOccurs="1"/></xs:choice></xs:complexType></xs:element><xs:elementname="inputs"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="input"minOccurs="0"maxOccurs="unbounded"><xs:complexType><xs:sequence><xs:elementname="format"type="xs:string"minOccurs="1"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element><xs:elementname="outputs"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="output"minOccurs="0"maxOccurs="unbounded"><xs:complexType><xs:sequence><xs:elementname="format"type="xs:string"minOccurs="1"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element><xs:elementname="quantitativeAnalysis"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="performanceMetrics"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="performanceMetric"minOccurs="0"maxOccurs="unbounded"><xs:complexType><xs:sequence><xs:elementname="type"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="value"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="slice"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="confidenceInterval"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="lowerBound"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="upperBound"type="xs:string"minOccurs="0"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element><xs:elementname="graphics"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="description"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="collection"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="graphic"minOccurs="0"maxOccurs="unbounded"><xs:complexType><xs:sequence><xs:elementname="name"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="image"type="bom:attachedTextType"minOccurs="0"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element><xs:elementname="considerations"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="users"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="user"type="xs:string"minOccurs="0"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:elementname="useCases"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="useCase"type="xs:string"minOccurs="0"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:elementname="technicalLimitations"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="technicalLimitation"type="xs:string"minOccurs="0"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:elementname="performanceTradeoffs"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="performanceTradeoff"type="xs:string"minOccurs="0"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element><xs:elementname="ethicalConsiderations"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="ethicalConsideration"minOccurs="0"maxOccurs="unbounded"><xs:complexType><xs:sequence><xs:elementname="name"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="mitigationStrategy"type="xs:string"minOccurs="0"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element><xs:elementname="environmentalConsiderations"type="bom:environmentalConsiderationsType"minOccurs="0"maxOccurs="1"/><xs:elementname="fairnessAssessments"minOccurs="0"maxOccurs="1"><xs:complexType><xs:sequence><xs:elementname="fairnessAssessment"minOccurs="0"maxOccurs="unbounded"><xs:complexType><xs:sequence><xs:elementname="groupAtRisk"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="benefits"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="harms"type="xs:string"minOccurs="0"maxOccurs="1"/><xs:elementname="mitigationStrategy"type="xs:string"minOccurs="0"maxOccurs="1"/></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element></xs:sequence></xs:complexType></xs:element></xs:sequence><xs:attributename="bom-ref"type="bom:refType"/></xs:complexType>
An optional identifier which can be used to reference the object elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
Allow any attributes from a namespace other than this schema's namespace (lax validation).>Start Sequence[0..1]<bom:name>xs:normalizedString</bom:name>[0..1]<bom:email>xs:normalizedString</bom:email>[0..1]<bom:phone>xs:normalizedString</bom:phone>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
An optional identifier which can be used to reference the object elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
Allow any attributes from a namespace other than this schema's namespace (lax validation).>Start Sequence[0..1]<bom:name>xs:normalizedString</bom:name>[0..1]<bom:address>bom:postalAddressType</bom:address>[0..1]<bom:url>xs:anyURI</bom:url>[0..*]<bom:contact>bom:organizationalContact</bom:contact>[0..*]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
<xs:complexTypename="outputType"><xs:sequence><xs:choice><xs:elementname="resource"type="bom:resourceReferenceType"minOccurs="1"maxOccurs="1"/><xs:elementname="environmentVars"minOccurs="1"maxOccurs="1"><xs:complexType><xs:sequenceminOccurs="0"maxOccurs="unbounded"><-- maxOccurs="unbounded" NEEDS to be set on the sequence, not the individual elements --><xs:choice><xs:elementname="environmentVar"type="bom:propertyType"minOccurs="0"maxOccurs="1"/><xs:elementname="value"type="xs:string"minOccurs="0"maxOccurs="1"/></xs:choice></xs:sequence></xs:complexType></xs:element><xs:elementname="data"type="bom:attachedTextType"minOccurs="1"maxOccurs="1"/></xs:choice><xs:elementname="type"type="bom:outputTypeEnum"minOccurs="0"maxOccurs="1"/><xs:elementname="source"type="bom:resourceReferenceType"minOccurs="0"maxOccurs="1"/><xs:elementname="target"type="bom:resourceReferenceType"minOccurs="0"maxOccurs="1"/><xs:elementname="properties"type="bom:propertiesType"minOccurs="0"maxOccurs="1"/><xs:anynamespace="##other"processContents="lax"minOccurs="0"maxOccurs="unbounded"/></xs:sequence><xs:anyAttributenamespace="##any"processContents="lax"/></xs:complexType>
<...Allow any attributes from any namespace (lax validation).><bom:name>xs:string</bom:name>[0..1]<bom:value>xs:string</bom:value>[0..1]<bom:dataType>xs:string</bom:dataType>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
Specifies the purpose for the patch including the resolution of defects,
security issues, or new behavior or functionality
><bom:diff>bom:diffType</bom:diff>[0..1]<bom:resolves>[0..1]Start Sequence[0..*]<bom:issue>bom:issueType</bom:issue>[1]End Sequence</bom:resolves>Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
<...>Start Sequence[0..*]<bom:patch>bom:patchType</bom:patch>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
Component pedigree is a way to document complex supply chain scenarios where components are created, distributed, modified, redistributed, combined with other components, etc. Pedigree supports viewing this complex chain from the beginning, the end, or anywhere in the middle. It also provides a way to document variants where the exact relation may not be known.
An optional identifier which can be used to reference the address elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:property>bom:propertyType</bom:property>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:type>xs:normalizedString</bom:type>[1]<bom:title>xs:string</bom:title>[0..1]<bom:featuredImage>xs:anyURI</bom:featuredImage>[0..1]<bom:socialImage>xs:anyURI</bom:socialImage>[0..1]<bom:description>xs:string</bom:description>[0..1]<bom:timestamp>xs:dateTime</bom:timestamp>[0..1]<bom:aliases>[0..1]Start Sequence[0..*]<bom:alias>xs:normalizedString</bom:alias>[1]End Sequence</bom:aliases><bom:tags>bom:tagsType</bom:tags>[0..1]<bom:resolves>[0..1]Start Sequence[0..*]<bom:issue>bom:issueType</bom:issue>[1]End Sequence</bom:resolves><bom:notes>[0..1]Start Sequence[0..*]<bom:note>[1]Start Sequence[0..*]<bom:locale>bom:localeType</bom:locale>[0..1]<bom:text>bom:attachedTextType</bom:text>[1]End Sequence</bom:note>End Sequence</bom:notes><bom:properties>bom:propertiesType</bom:properties>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
<...Allow any attributes from any namespace (lax validation).>Start Choice[1]<bom:ref>union of: [ bom:refLinkType,bom:bomLinkElementType ]</bom:ref>[1]<bom:externalReference>bom:externalReference</bom:externalReference>[1]End ChoiceAllow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
<...Allow any attributes from any namespace (lax validation).><bom:resourceReference>bom:resourceReferenceType</bom:resourceReference>[0..*]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
An optional identifier which can be used to reference the service elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
Allow any attributes from any namespace (lax validation).><bom:provider>bom:organizationalEntity</bom:provider>[0..1]<bom:group>xs:normalizedString</bom:group>[0..1]<bom:name>xs:normalizedString</bom:name>[1]<bom:version>bom:versionType</bom:version>[0..1]<bom:description>xs:normalizedString</bom:description>[0..1]<bom:endpoints>[0..1]Start Sequence[0..*]<bom:endpoint>xs:anyURI</bom:endpoint>[1]End Sequence</bom:endpoints><bom:authenticated>xs:boolean</bom:authenticated>[0..1]<bom:x-trust-boundary>xs:boolean</bom:x-trust-boundary>[0..1]<bom:trustZone>xs:string</bom:trustZone>[0..1]<bom:data>[0..1]Start Choice[1]Start Sequence[0..*]<bom:classification>bom:dataClassificationType</bom:classification>[1]End Sequence<bom:dataflowname="xs:string"[0..1]
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:service>bom:service</bom:service>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
A standard may consist of regulations, industry or organizational-specific standards, maturity models, best practices, or any other requirements which can be evaluated against or attested to.
An optional identifier which can be used to reference the object elsewhere
in the BOM. Every bom-ref must be unique within the BOM.
Allow any attributes from a namespace other than this schema's namespace (lax validation).><bom:name>xs:string</bom:name>[1]<bom:version>xs:string</bom:version>[1]<bom:description>xs:string</bom:description>[1]<bom:owner>xs:string</bom:owner>[1]<bom:requirements>[0..1]<bom:requirementbom-ref="bom:refType"[0..1]
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere
in the BOM. Every bom-ref must be unique within the BOM.
Allow any attributes from a namespace other than this schema's namespace (lax validation).>[0..*]<bom:identifier>xs:string</bom:identifier>[0..1]<bom:title>xs:string</bom:title>[0..1]<bom:text>xs:string</bom:text>[0..1]<bom:descriptions>[0..1]<bom:description>xs:string</bom:description>[0..*]</bom:descriptions><bom:openCre>xs:string (pattern = CRE:[0-9]+-[0-9]+)</bom:openCre>[0..*]<bom:parent>bom:refLinkType</bom:parent>[0..1]<bom:properties>bom:propertiesType</bom:properties>[0..1]<bom:externalReferences>bom:externalReferences</bom:externalReferences>[0..1]</bom:requirement></bom:requirements><bom:levels>[0..1]<bom:levelbom-ref="bom:refType"[0..1]
Attribute bom-ref
An optional identifier which can be used to reference the object elsewhere
in the BOM. Every bom-ref must be unique within the BOM.
Allow any attributes from a namespace other than this schema's namespace (lax validation).>[0..*]<bom:identifier>xs:string</bom:identifier>[0..1]<bom:title>xs:string</bom:title>[0..1]<bom:description>xs:string</bom:description>[0..1]<bom:requirements>[0..1]<bom:requirement>bom:refLinkType</bom:requirement>[0..*]</bom:requirements></bom:level></bom:levels><bom:externalReferences>bom:externalReferences</bom:externalReferences>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
The list of standards which may consist of regulations, industry or organizational-specific standards, maturity models, best practices, or any other requirements which can be evaluated against or attested to.
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:standard>bom:standard</bom:standard>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
<...Allow any attributes from any namespace (lax validation).><bom:name>xs:string</bom:name>[0..1]<bom:description>xs:string</bom:description>[0..1]<bom:commands>[0..1]<bom:command>[0..*]<bom:executed>xs:string</bom:executed>[0..1]<bom:properties>bom:propertiesType</bom:properties>[0..1]</bom:command></bom:commands><bom:properties>bom:propertiesType</bom:properties>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
><bom:text>bom:attachedTextType</bom:text>[0..1]<bom:url>xs:anyURI</bom:url>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
An optional identifier which can be used to reference the task elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
<...Allow any attributes from any namespace (lax validation).><bom:task>bom:taskType</bom:task>[0..*]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
<...Allow any attributes from a namespace other than this schema's namespace (lax validation).>Start Sequence[0..1]<bom:vendor>xs:normalizedString</bom:vendor>[0..1]<bom:name>xs:normalizedString</bom:name>[0..1]<bom:version>bom:versionType</bom:version>[0..1]<bom:hashes>[0..1]Start Sequence[0..*]<bom:hash>bom:hashType</bom:hash>[1]End Sequence</bom:hashes><bom:externalReferences>bom:externalReferences</bom:externalReferences>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
An optional identifier which can be used to reference the trigger elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
Allow any attributes from any namespace (lax validation).><bom:uid>xs:string</bom:uid>[1]<bom:name>xs:string</bom:name>[0..1]<bom:description>xs:string</bom:description>[0..1]<bom:resourceReferences>bom:resourceReferencesType</bom:resourceReferences>[0..1]<bom:type>bom:triggerTypeType</bom:type>[1]<bom:event>bom:eventType</bom:event>[0..1]<bom:conditions>[0..1]<bom:condition>[0..*]<bom:description>xs:string</bom:description>[0..1]<bom:expression>xs:string</bom:expression>[0..1]<bom:properties>bom:propertiesType</bom:properties>[0..1]</bom:condition></bom:conditions><bom:timeActivated>xs:dateTime</bom:timeActivated>[0..1]<bom:inputs>[0..1]<bom:input>bom:inputType</bom:input>[0..*]</bom:inputs><bom:outputs>[0..1]<bom:output>bom:outputType</bom:output>[0..*]</bom:outputs><bom:properties>bom:propertiesType</bom:properties>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
<...Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:vulnerability>bom:vulnerabilityType</bom:vulnerability>[1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
An optional identifier which can be used to reference the vulnerability elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
An optional identifier which can be used to reference the workflow elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
<...Allow any attributes from any namespace (lax validation).><bom:workflow>bom:workflowType</bom:workflow>[0..*]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
An optional identifier which can be used to reference the workflow elsewhere in the BOM.
Uniqueness is enforced within all elements and children of the root-level bom element.
Allow any attributes from any namespace (lax validation).>Start Sequence[0..*]<bom:uid>xs:string</bom:uid>[1]<bom:name>xs:string</bom:name>[0..1]<bom:aliases>[0..1]<bom:alias>xs:string</bom:alias>[0..*]</bom:aliases><bom:description>xs:string</bom:description>[0..1]<bom:resourceReferences>bom:resourceReferencesType</bom:resourceReferences>[0..1]<bom:accessMode>bom:accessModeEnum</bom:accessMode>[0..1]<bom:mountPath>xs:string</bom:mountPath>[0..1]<bom:managedDataType>xs:string</bom:managedDataType>[0..1]<bom:volumeRequest>xs:string</bom:volumeRequest>[0..1]<bom:volume>bom:volumeType</bom:volume>[0..1]<bom:properties>bom:propertiesType</bom:properties>[0..1]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]End Sequence</...>
<...Allow any attributes from any namespace (lax validation).><bom:workspace>bom:workspaceType</bom:workspace>[0..*]Allow any elements from a namespace other than this schema's namespace (lax validation). [0..*]</...>
value comes from list: { 'complete'| 'incomplete'| 'incomplete_first_party_only'| 'incomplete_first_party_proprietary_only'| 'incomplete_first_party_opensource_only'| 'incomplete_third_party_only'| 'incomplete_third_party_proprietary_only'| 'incomplete_third_party_opensource_only'| 'unknown'| 'not_specified'}
<xs:simpleTypename="bomLinkDocumentType"><xs:restrictionbase="xs:anyURI"><-- part of the pattern is based on `bom.serialNumber`'s pattern --><xs:patternvalue="urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*"/></xs:restriction></xs:simpleType>
<xs:simpleTypename="bomLinkElementType"><xs:restrictionbase="xs:anyURI"><-- part of the pattern is based on `bom.serialNumber`'s pattern --><xs:patternvalue="urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*#.+"/></xs:restriction></xs:simpleType>
Define the format for acceptable CPE URIs. Supports CPE 2.2 and CPE 2.3 formats. Refer to https://nvd.nist.gov/products/cpe for official specification.
Specifies the flow direction of the data. Valid values are: inbound, outbound, bi-directional, and unknown. Direction is relative to the service. Inbound flow states that data enters the service. Outbound flow states that data leaves the service. Bi-directional states that data flows both ways, and unknown states that the direction is not known.
value comes from list: { 'source-code-analysis'| 'binary-analysis'| 'manifest-analysis'| 'ast-fingerprint'| 'hash-comparison'| 'instrumentation'| 'dynamic-analysis'| 'filename'| 'attestation'| 'other'}
The vulnerability status of a given version or range of versions of a product. The statuses 'affected' and 'unaffected' indicate that the version is affected or unaffected by the vulnerability. The status 'unknown' indicates that it is unknown or unspecified whether the given version is affected. There can be many reasons for an 'unknown' status, including that an investigation has not been undertaken or that a vendor has not disclosed the status.
value comes from list: { 'code_not_present'| 'code_not_reachable'| 'requires_configuration'| 'requires_dependency'| 'requires_environment'| 'protected_by_compiler'| 'protected_at_runtime'| 'protected_at_perimeter'| 'protected_by_mitigating_control'}
Defines a syntax for representing two character language code (ISO-639) followed by an optional two character country code. The language code must be lower case. If the country code is specified, the country code must be upper case. The language code and country code must be separated by a minus sign. Examples: en, en-US, fr, fr-CA
<xs:simpleTypename="refType"><xs:restrictionbase="xs:string"><xs:minLengthvalue="1"/><-- value SHOULD not start with the BOM-Link intro "urn:cdx:" --></xs:restriction></xs:simpleType>
Textual representation of the severity of the vulnerability adopted by the analysis method. If the analysis method uses values other than what is provided, the user is expected to translate appropriately.
A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst Example values: - "vers:cargo/9.0.14" - "vers:npm/1.2.3|>=2.0.0|<5.0.0" - "vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1" - "vers:tomee/>=1.0.0-beta1|<=1.7.5|>=7.0.0-M1|<=7.0.7|>=7.1.0|<=7.1.2|>=8.0.0-M1|<=8.0.1" - "vers:gem/>=2.2.0|!= 2.2.1|<2.3.0"
A single disjunctive version identifier, for a component or service. Example values: - "9.0.14" - "v1.33.7" - "7.0.0-M1" - "2.0pre1" - "1.0.0-beta1" - "0.8.15"
Abstract(Applies to complex type definitions and element declarations). An abstract element or complex type cannot used to validate an element instance. If there is a reference to an abstract element, only element declarations that can substitute the abstract element can be used to validate the instance. For references to abstract type definitions, only derived types can be used.
Collapse Whitespace PolicyReplace tab, line feed, and carriage return characters with space character (Unicode character 32). Then, collapse contiguous sequences of space characters into single space character, and remove leading and trailing space characters.
Disallowed Substitutions(Applies to element declarations). If substitution is specified, then substitution group members cannot be used in place of the given element declaration to validate element instances. If derivation methods, e.g. extension, restriction, are specified, then the given element declaration will not validate element instances that have types derived from the element declaration's type using the specified derivation methods. Normally, element instances can override their declaration's type by specifying an xsi:type attribute.
Nillable(Applies to element declarations). If an element declaration is nillable, instances can use the xsi:nil attribute. The xsi:nil attribute is the boolean attribute, nil, from the http://www.w3.org/2001/XMLSchema-instance namespace. If an element instance has an xsi:nil attribute set to true, it can be left empty, even though its element declaration may have required content.
Prohibited Derivations(Applies to type definitions). Derivation methods that cannot be used to create sub-types from a given type definition.
Prohibited Substitutions(Applies to complex type definitions). Prevents sub-types that have been derived using the specified derivation methods from validating element instances in place of the given type definition.
Replace Whitespace PolicyReplace tab, line feed, and carriage return characters with space character (Unicode character 32).
Substitution GroupElements that are members of a substitution group can be used wherever the head element of the substitution group is referenced.
Substitution Group Exclusions(Applies to element declarations). Prohibits element declarations from nominating themselves as being able to substitute a given element declaration, if they have types that are derived from the original element's type using the specified derivation methods.
Target NamespaceThe target namespace identifies the namespace that components in this schema belongs to. If no target namespace is provided, then the schema components do not belong to any namespace.
Element comment