Skip to content

Commit 1962322

Browse files
anthonyharrisonanthonyharrison
committed
feat: Add support for TLP marking in metadata (fixes CycloneDX#595)
Signed-off-by: anthonyharrison <[email protected]>
1 parent a0a6f8f commit 1962322

8 files changed

+133
-0
lines changed

‎schema/bom-1.7.proto

+15
Original file line numberDiff line numberDiff line change
@@ -514,6 +514,8 @@ message Metadata {
514514
repeated Lifecycles lifecycles = 9;
515515
// The organization that created the BOM. Manufacturer is common in BOMs created through automated processes. BOMs created through manual means may have '.authors' instead.
516516
optional OrganizationalEntity manufacturer = 10;
517+
// The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the component that the BOM describes.
518+
optional Tlp distribution = 11;
517519
}
518520

519521
message Lifecycles {
@@ -675,6 +677,19 @@ message Swid {
675677
optional string url = 7;
676678
}
677679

680+
enum Tlp {
681+
// Default
682+
CLEAR = 0;
683+
// Limited distribution but can be shared within a community.
684+
GREEN = 1;
685+
// Limited distribution but can be shared within an organization and with clients
686+
AMBER = 2;
687+
// Limited distribution but can be shared within an organization.
688+
AMBER+STRICT = 3;
689+
// Restricted distribution to individual recipients and must not be shared.
690+
RED = 4;
691+
}
692+
678693
// Specifies a tool (manual or automated).
679694
message Tool {
680695
// DEPRECATED - DO NOT USE - The vendor of the tool used to create the BOM.

‎schema/bom-1.7.schema.json

+24
Original file line numberDiff line numberDiff line change
@@ -712,9 +712,33 @@
712712
"title": "Properties",
713713
"description": "Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.",
714714
"items": {"$ref": "#/definitions/property"}
715+
},
716+
"distribution": {
717+
"title": "Distribution",
718+
"description": "The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the component that the BOM describes.",
719+
"$ref": "#/definitions/tlpClassification"
715720
}
716721
}
717722
},
723+
"tlpClassification": {
724+
"type" : "string",
725+
"title": "Traffic Light Protocol (TLP) Classification",
726+
"description": "The Traffic Light Protocol (TLP) classification for the component that the BOM describes. TLP is a classification system for identifying the potential risk associated with artefact, including whether it is subject to certain types of legal, financial, or technical threats. Refer to [https://www.first.org/tlp/](https://www.first.org/tlp/) for further information. The default classification is CLEAR",
727+
"enum": [
728+
"AMBER",
729+
"AMBER+STRICT",
730+
"GREEN",
731+
"RED",
732+
"CLEAR"
733+
],
734+
"meta:enum": {
735+
"AMBER": "The BOM is subject to limited disclosure, and recipients can only share the BOM on a need-to-know basis within their organization and with clients.",
736+
"AMBER+STRICT": "The BOM is subject to limited disclosure, and recipients can only share the BOM on a need-to-know basis within their organization.",
737+
"GREEN": "The BOM is subject to limited disclosure, and recipients can share the BOM within their community but not via publicly accessible channels.",
738+
"RED": "The BOM is subject to restricted distribution to individual recipients only and must not be shared.",
739+
"CLEAR": "The BOM is not subject to any restrictions as regards the sharing of the information within the BOM."
740+
}
741+
},
718742
"tool": {
719743
"type": "object",
720744
"title": "Tool",

‎schema/bom-1.7.xsd

+49
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,12 @@ limitations under the License.
256256
Formal registration is optional.</xs:documentation>
257257
</xs:annotation>
258258
</xs:element>
259+
<xs:element name="distribution" type="bom:tlpType" minOccurs="0" maxOccurs="1">
260+
<xs:annotation>
261+
<xs:documentation>The Traffic Light Protocol (TLP) classification that controls the sharing and distribution
262+
of the component that the BOM describes.</xs:documentation>
263+
</xs:annotation>
264+
</xs:element>
259265
<xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded">
260266
<xs:annotation>
261267
<xs:documentation>
@@ -390,6 +396,49 @@ limitations under the License.
390396
</xs:anyAttribute>
391397
</xs:complexType>
392398

399+
<xs:simpleType name="tlpType">
400+
<xs:restriction base="xs:string">
401+
<xs:enumeration value="CLEAR">
402+
<xs:annotation>
403+
<xs:documentation>
404+
The BOM is not subject to any restrictions as regards the sharing of the information within the BOM.
405+
</xs:documentation>
406+
</xs:annotation>
407+
</xs:enumeration>
408+
<xs:enumeration value="GREEN">
409+
<xs:annotation>
410+
<xs:documentation>
411+
The BOM is subject to limited disclosure, and recipients can share the BOM within their community
412+
but not via publicly accessible channels.
413+
</xs:documentation>
414+
</xs:annotation>
415+
</xs:enumeration>
416+
<xs:enumeration value="AMBER">
417+
<xs:annotation>
418+
<xs:documentation>
419+
The BOM is subject to limited disclosure, and recipients can only share the BOM on a need-to-know
420+
basis within their organization and with clients.
421+
</xs:documentation>
422+
</xs:annotation>
423+
</xs:enumeration>
424+
<xs:enumeration value="AMBER+STRICT">
425+
<xs:annotation>
426+
<xs:documentation>
427+
The BOM is subject to limited disclosure, and recipients can only share the BOM on a need-to-know
428+
basis within their organization.
429+
</xs:documentation>
430+
</xs:annotation>
431+
</xs:enumeration>
432+
<xs:enumeration value="RED">
433+
<xs:annotation>
434+
<xs:documentation>
435+
The BOM is subject to restricted distribution to individual recipients only and must not be shared.
436+
</xs:documentation>
437+
</xs:annotation>
438+
</xs:enumeration>
439+
</xs:restriction>
440+
</xs:simpleType>
441+
393442
<xs:complexType name="toolType">
394443
<xs:annotation>
395444
<xs:documentation>Information about the automated or manual tool used</xs:documentation>

‎tools/src/test/resources/1.7/invalid-metadata-distribution-1.7.json

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.7",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"metadata": {
8+
"distribution": "Unrestricted"
9+
},
10+
"components": []
11+
}

‎tools/src/test/resources/1.7/invalid-metadata-distribution-1.7.xml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0"?>
2+
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.7">
3+
<metadata>
4+
<distribution>Unrestricted</distribution>
5+
</metadata>
6+
<components />
7+
</bom>

‎tools/src/test/resources/1.7/valid-metadata-distribution-1.7.json

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{
2+
"$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
3+
"bomFormat": "CycloneDX",
4+
"specVersion": "1.7",
5+
"serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
6+
"version": 1,
7+
"metadata": {
8+
"distribution": "CLEAR"
9+
},
10+
"components": []
11+
}

‎tools/src/test/resources/1.7/valid-metadata-distribution-1.7.textproto

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# proto-file: schema/bom-1.7.proto
2+
# proto-message: Bom
3+
4+
spec_version: "1.7"
5+
version: 1
6+
serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
7+
metadata {
8+
distribution: CLEAR
9+
}

‎tools/src/test/resources/1.7/valid-metadata-distribution-1.7.xml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<?xml version="1.0"?>
2+
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.7">
3+
<metadata>
4+
<distribution>CLEAR</distribution>
5+
</metadata>
6+
<components />
7+
</bom>

0 commit comments

Comments
 (0)