CBOM: add custom fingerprints#903
Open
bhess wants to merge 1 commit into
Open
Conversation
Signed-off-by: Basil Hess <bhe@zurich.ibm.com>
Mehrn0ush
approved these changes
Apr 8, 2026
stevespringett
added
request for comment
RFC notice sent
Member
|
RFC notice sent on May 04, 2026
Public RFC period ends June 01, 2026 |
jkowalleck
requested review from
DarthHater,
coderpatros,
jkowalleck,
mrutkows and
stevespringett
jkowalleck
requested changes
May 12, 2026
| "additionalProperties": false, | ||
| "properties": { | ||
| "alg": { | ||
| "$ref": "cyclonedx-common-2.0.schema.json#/$defs/hashAlgorithm" |
Member
There was a problem hiding this comment.
please add a title and description
Suggested change
| "$ref": "cyclonedx-common-2.0.schema.json#/$defs/hashAlgorithm" | |
| "$ref": "cyclonedx-common-2.0.schema.json#/$defs/hashAlgorithm", | |
| "title": "Standard, well-known Fingerprint Algorithm", | |
| "description": "The standard, well-known algorithm used to compute the fingerprint." |
| "$ref": "cyclonedx-common-2.0.schema.json#/$defs/hashAlgorithm" | ||
| }, | ||
| "content": { | ||
| "$ref": "cyclonedx-common-2.0.schema.json#/$defs/hashValue" |
Member
There was a problem hiding this comment.
please add a title and description
Suggested change
| "$ref": "cyclonedx-common-2.0.schema.json#/$defs/hashValue" | |
| "$ref": "cyclonedx-common-2.0.schema.json#/$defs/hashValue", | |
| "title": "Standard, well-known Fingerprint Content", | |
| "description": "The value of the fingerprint computed using the standard, well-known algorithm." |
jkowalleck
reviewed
May 12, 2026
| "title": "Fingerprint", | ||
| "description": "The fingerprint is a cryptographic hash of the asset.", | ||
| "oneOf": [ | ||
| { |
Member
There was a problem hiding this comment.
this data structure looks pretty much like cyclonedx-common-2.0.schema.json#$defs/hash.
To prevent any confusion, we should add narrow titles/descriptions to cyclonedx-common-2.0.schema.json#$defs/hash/properties/alg and cyclonedx-common-2.0.schema.json#$defs/hash/properties/content
something like
{
// cyclonedx-common-2.0.schema.json#$defs
"hash": {
"type": "object",
"title": "Hash",
"required": [
"alg",
"content"
],
"additionalProperties": false,
"properties": {
"alg": {
"$ref": "#/$defs/hashAlgorithm",
"titile": "Hash algorithm",
"description": "Standard, well-known algorithm used to compute the hash"
},
"content": {
"$ref": "#/$defs/hashValue",
"titile": "Hash value",
"description": "The value of the hash computed using the standard, well-known algorithm"
}
}
},
}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extend the
fingerprintdefinition incyclonedx-cryptography-2.0.schema.jsonto support custom fingerprint algorithms alongside standard hash algorithms.Changes
$ref: hashoncertificateProperties.fingerprintandrelatedCryptoMaterialProperties.fingerprintwith a single central$defs/fingerprintdefinition$defs/fingerprintusesoneOfwith two branches:alg+content(refs to existinghashAlgorithm/hashValue); fully backward compatiblecustomAlg+customContentfor non-standard algorithmsBackward Compatibility
Existing documents with
{"alg": "SHA-256", "content": "..."}satisfy the Standard Hash branch unchanged.