Add CycloneDX spec version 1.6 and 1.7 support - #872
Open
Saturate wants to merge 6 commits into
Open
Conversation
Wire up SpecVersion V1_6 and V1_7 with parse/output methods for JSON and XML. Create v1_6 and v1_7 spec modules mirroring v1_5 structure. Extend versioned annotations in common spec files to generate the new module variants. Includes JSON schemas, test fixtures, and updated CLI help text. Resolves: CycloneDX#769 Signed-off-by: Allan Kimmer Jensen <hi@akj.io>
Component gains manufacturer, authors (replaces deprecated author), omniborId, and swhid in 1.6. In 1.7 it adds isExternal and versionRange. Metadata gains manufacturer in 1.6. All fields are optional and wire through the versioned spec serialization for both JSON and XML. Signed-off-by: Allan Kimmer Jensen <hi@akj.io>
BOM gains declarations, definitions (1.6) and citations (1.7) as pass-through JSON values for complex nested types. Component gains cryptoProperties (1.6) and patentAssertions (1.7) as pass-through JSON values. Metadata gains distributionConstraints (1.7) with a typed TLP classification enum (CLEAR, GREEN, AMBER, AMBER+STRICT, RED). Signed-off-by: Allan Kimmer Jensen <hi@akj.io>
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 2835 |
| Duplication | 408 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Saturate
marked this pull request as ready for review
June 26, 2026 06:19
Add XML read/write for new 1.6/1.7 component fields (manufacturer, authors, omniborId, swhid) and metadata manufacturer. JSON-only pass-through fields (cryptoProperties, declarations, etc.) remain XML-unsupported since they lack a defined XML representation in the current codebase. Fix field ordering in the From<Component> impl where version_range was split by crypto_properties. Add Unknown(String) variant to TlpClassification so future TLP values round-trip instead of being silently dropped. Signed-off-by: Allan Kimmer Jensen <hi@akj.io>
Avoids unused-import warning in v1_3/v1_4/v1_5 generated modules since the type is only used in 1.6+ fields. Signed-off-by: Allan Kimmer Jensen <hi@akj.io>
Add generic Value-to-XML bridge (write_value_as_xml, read_xml_as_value) for bidirectional XML serialization of complex pass-through types. All new fields now round-trip through both JSON and XML: - BOM: declarations, definitions (1.6), citations (1.7) - Component: manufacturer, authors, omniborId, swhid, cryptoProperties (1.6), isExternal, versionRange, patentAssertions (1.7) - Metadata: manufacturer (1.6), distributionConstraints (1.7) Signed-off-by: Allan Kimmer Jensen <hi@akj.io>
This was referenced Jul 21, 2026
16 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds support for CycloneDX specification versions 1.6 (ECMA-424 1st Edition) and 1.7 (ECMA-424 2nd Edition) to both the
cyclonedx-bomlibrary and thecargo-cyclonedxCLI.The diff is large but mostly mechanical: v1_6 and v1_7 spec modules mirror the v1_5 structure, and the
#[versioned]annotations in common spec files are extended to generate the new module variants.Changes
SpecVersion::V1_6andV1_7enum variants with full JSON/XML parse and output methods#[versioned]annotations extended across 10 common spec filesNew spec fields (1.6)
manufacturer,authors(replaces deprecatedauthor),omniborId,swhid,cryptoPropertiesmanufacturerdeclarations,definitionsNew spec fields (1.7)
isExternal,versionRange,patentAssertionsdistributionConstraints(with typed TLP classification)citationsXML/JSON parity
All new fields round-trip through both JSON and XML. Simple fields (manufacturer, authors, omniborId, swhid, isExternal, versionRange) use typed structs with explicit
ToXml/FromXmlimplementations. Complex deeply-nested types (declarations, definitions, cryptoProperties, patentAssertions, citations, distributionConstraints) useserde_json::Valuewith a generic Value-to-XML bridge (write_value_as_xml/read_xml_as_valueinxml.rs) to avoid thousands of lines of struct definitions while maintaining correct serialization in both formats.Design note on
serde_json::ValuePrevious versions (1.3-1.5) used fully typed structs for every field. For 1.6/1.7, several new types have deeply nested schemas (e.g.
declarations.targetsrecurses into the full component/service type hierarchy, ~570 fields). I opted forserde_json::Valuepass-through for these, which gives correct round-trip behavior in ~90 lines of bridge code. The tradeoff is that consumers accessing these fields work withserde_json::Valuerather than typed Rust structs.A follow-up PR could add typed structs for individual complex types as needed, or I could do it here, but it's really uo to you. Let me know if you think I should add it, or this is fine.
Resolves #769