github.com/anchore/syft@v1.38.2/schema/cyclonedx/cyclonedx.xsd (about) 1 <?xml version="1.0" encoding="UTF-8"?> 2 <!-- 3 CycloneDX Bill of Material (BOM) Specification 4 5 Licensed under the Apache License, Version 2.0 (the "License"); 6 you may not use this file except in compliance with the License. 7 You may obtain a copy of the License at 8 9 http://www.apache.org/licenses/LICENSE-2.0 10 11 Unless required by applicable law or agreed to in writing, software 12 distributed under the License is distributed on an "AS IS" BASIS, 13 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 See the License for the specific language governing permissions and 15 limitations under the License. 16 --> 17 <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" 18 xmlns:vc="http://www.w3.org/2007/XMLSchema-versioning" 19 xmlns:bom="http://cyclonedx.org/schema/bom/1.6" 20 xmlns:spdx="http://cyclonedx.org/schema/spdx" 21 elementFormDefault="qualified" 22 targetNamespace="http://cyclonedx.org/schema/bom/1.6" 23 vc:minVersion="1.0" 24 vc:maxVersion="1.1" 25 version="1.6.0"> 26 27 <xs:import namespace="http://cyclonedx.org/schema/spdx" schemaLocation="./spdx.xsd"/> 28 29 <xs:annotation> 30 <xs:documentation> 31 <name>CycloneDX Bill of Materials Standard</name> 32 <url>https://cyclonedx.org/</url> 33 <license uri="http://www.apache.org/licenses/LICENSE-2.0" 34 version="2.0">Apache License, Version 2.0</license> 35 </xs:documentation> 36 </xs:annotation> 37 38 <xs:simpleType name="refType"> 39 <xs:annotation> 40 <xs:documentation>Identifier for referable and therefore interlink-able elements.</xs:documentation> 41 </xs:annotation> 42 <xs:restriction base="xs:string"> 43 <xs:minLength value="1"/> 44 <!-- value SHOULD not start with the BOM-Link intro "urn:cdx:" --> 45 </xs:restriction> 46 </xs:simpleType> 47 <xs:simpleType name="refLinkType"> 48 <xs:annotation> 49 <xs:documentation xml:lang="en"> 50 Descriptor for an element identified by the attribute "bom-ref" in the same BOM document. 51 In contrast to `bomLinkElementType`. 52 </xs:documentation> 53 </xs:annotation> 54 <xs:restriction base="bom:refType"/> 55 </xs:simpleType> 56 57 <xs:simpleType name="versionType"> 58 <xs:annotation> 59 <xs:documentation xml:lang="en"><![CDATA[ 60 A single disjunctive version identifier, for a component or service. 61 62 Example values: 63 - "9.0.14" 64 - "v1.33.7" 65 - "7.0.0-M1" 66 - "2.0pre1" 67 - "1.0.0-beta1" 68 - "0.8.15" 69 ]]> 70 </xs:documentation> 71 </xs:annotation> 72 <xs:restriction base="xs:normalizedString"> 73 <xs:maxLength value="1024"/> 74 </xs:restriction> 75 </xs:simpleType> 76 <xs:simpleType name="versionRangeType"> 77 <xs:annotation> 78 <xs:documentation xml:lang="en"><![CDATA[ 79 A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst 80 81 Example values: 82 - "vers:cargo/9.0.14" 83 - "vers:npm/1.2.3|>=2.0.0|<5.0.0" 84 - "vers:pypi/0.0.0|0.0.1|0.0.2|0.0.3|1.0|2.0pre1" 85 - "vers:tomee/>=1.0.0-beta1|<=1.7.5|>=7.0.0-M1|<=7.0.7|>=7.1.0|<=7.1.2|>=8.0.0-M1|<=8.0.1" 86 - "vers:gem/>=2.2.0|!= 2.2.1|<2.3.0" 87 ]]> 88 </xs:documentation> 89 </xs:annotation> 90 <xs:restriction base="xs:normalizedString"> 91 <xs:minLength value="1"/> 92 <xs:maxLength value="4096"/> 93 </xs:restriction> 94 </xs:simpleType> 95 96 <xs:simpleType name="bomLinkDocumentType"> 97 <xs:annotation> 98 <xs:documentation xml:lang="en"> 99 Descriptor for another BOM document. 100 See https://cyclonedx.org/capabilities/bomlink/ 101 </xs:documentation> 102 </xs:annotation> 103 <xs:restriction base="xs:anyURI"> 104 <!-- part of the pattern is based on `bom.serialNumber`'s pattern --> 105 <xs:pattern value="urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*"/> 106 </xs:restriction> 107 </xs:simpleType> 108 <xs:simpleType name="bomLinkElementType"> 109 <xs:annotation> 110 <xs:documentation xml:lang="en"> 111 Descriptor for an element in another BOM document. 112 See https://cyclonedx.org/capabilities/bomlink/ 113 </xs:documentation> 114 </xs:annotation> 115 <xs:restriction base="xs:anyURI"> 116 <!-- part of the pattern is based on `bom.serialNumber`'s pattern --> 117 <xs:pattern value="urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*#.+"/> 118 </xs:restriction> 119 </xs:simpleType> 120 <xs:simpleType name="bomLinkType"> 121 <xs:union memberTypes="bom:bomLinkDocumentType bom:bomLinkElementType"/> 122 </xs:simpleType> 123 124 <xs:complexType name="metadata"> 125 <xs:sequence minOccurs="0" maxOccurs="1"> 126 <xs:element name="timestamp" type="xs:dateTime" minOccurs="0"> 127 <xs:annotation> 128 <xs:documentation>The date and time (timestamp) when the BOM was created.</xs:documentation> 129 </xs:annotation> 130 </xs:element> 131 <xs:element name="lifecycles" minOccurs="0" maxOccurs="1"> 132 <xs:annotation> 133 <xs:documentation> 134 Lifecycles communicate the stage(s) in which data in the BOM was captured. Different types of data may be available at various phases of a lifecycle, such as the Software Development Lifecycle (SDLC), IT Asset Management (ITAM), and Software Asset Management (SAM). Thus, a BOM may include data specific to or only obtainable in a given lifecycle. 135 </xs:documentation> 136 </xs:annotation> 137 <xs:complexType> 138 <xs:sequence> 139 <xs:element name="lifecycle" minOccurs="0" maxOccurs="unbounded"> 140 <xs:complexType> 141 <xs:choice> 142 <xs:sequence> 143 <xs:element name="phase" type="bom:lifecyclePhaseType" minOccurs="1" maxOccurs="1"> 144 <xs:annotation> 145 <xs:documentation> 146 A pre-defined phase in the product lifecycle. 147 </xs:documentation> 148 </xs:annotation> 149 </xs:element> 150 </xs:sequence> 151 <xs:sequence> 152 <xs:element name="name" type="xs:normalizedString" minOccurs="1" maxOccurs="1"> 153 <xs:annotation> 154 <xs:documentation> 155 The name of the lifecycle phase 156 </xs:documentation> 157 </xs:annotation> 158 </xs:element> 159 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 160 <xs:annotation> 161 <xs:documentation> 162 The description of the lifecycle phase 163 </xs:documentation> 164 </xs:annotation> 165 </xs:element> 166 </xs:sequence> 167 </xs:choice> 168 </xs:complexType> 169 </xs:element> 170 </xs:sequence> 171 </xs:complexType> 172 </xs:element> 173 <xs:element name="tools" minOccurs="0" maxOccurs="1"> 174 <xs:annotation> 175 <xs:documentation>The tool(s) used in the creation of the BOM.</xs:documentation> 176 </xs:annotation> 177 <xs:complexType> 178 <xs:choice> 179 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 180 <xs:element name="tool" minOccurs="0" type="bom:toolType"> 181 <xs:annotation> 182 <xs:documentation>DEPRECATED. Use tools\components or tools\services instead.</xs:documentation> 183 </xs:annotation> 184 </xs:element> 185 </xs:sequence> 186 <xs:sequence minOccurs="0" maxOccurs="1"> 187 <xs:element name="components" type="bom:componentsType" minOccurs="0" maxOccurs="1"> 188 <xs:annotation> 189 <xs:documentation>A list of software and hardware components used as tools.</xs:documentation> 190 </xs:annotation> 191 </xs:element> 192 <xs:element name="services" type="bom:servicesType" minOccurs="0" maxOccurs="1"> 193 <xs:annotation> 194 <xs:documentation>A list of services used as tools.</xs:documentation> 195 </xs:annotation> 196 </xs:element> 197 </xs:sequence> 198 </xs:choice> 199 </xs:complexType> 200 </xs:element> 201 <xs:element name="authors" minOccurs="0" maxOccurs="1"> 202 <xs:annotation> 203 <xs:documentation> 204 The person(s) who created the BOM. 205 Authors are common in BOMs created through manual processes. BOMs created through automated means may have './manufacturer' instead. 206 </xs:documentation> 207 </xs:annotation> 208 <xs:complexType> 209 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 210 <xs:element name="author" type="bom:organizationalContact"/> 211 </xs:sequence> 212 </xs:complexType> 213 </xs:element> 214 <xs:element name="component" type="bom:component" minOccurs="0"> 215 <xs:annotation> 216 <xs:documentation>The component that the BOM describes.</xs:documentation> 217 </xs:annotation> 218 </xs:element> 219 <xs:element name="manufacturer" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 220 <xs:annotation> 221 <xs:documentation> 222 The organization that created the BOM. 223 Manufacturer is common in BOMs created through automated processes. BOMs created through manual means may have './authors' instead. 224 </xs:documentation> 225 </xs:annotation> 226 </xs:element> 227 <xs:element name="manufacture" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 228 <xs:annotation> 229 <xs:documentation> 230 DEPRECATED - DO NOT USE. This will be removed in a future version. Use the `./component/manufacturer` instead. 231 The organization that manufactured the component that the BOM describes. 232 </xs:documentation> 233 </xs:annotation> 234 </xs:element> 235 <xs:element name="supplier" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 236 <xs:annotation> 237 <xs:documentation>The organization that supplied the component that the BOM describes. The 238 supplier may often be the manufacturer, but may also be a distributor or repackager.</xs:documentation> 239 </xs:annotation> 240 </xs:element> 241 <xs:element name="licenses" type="bom:licenseChoiceType" minOccurs="0" maxOccurs="1"> 242 <xs:annotation> 243 <xs:documentation> 244 The license information for the BOM document. 245 This may be different from the license(s) of the component(s) that the BOM describes. 246 </xs:documentation> 247 </xs:annotation> 248 </xs:element> 249 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 250 <xs:annotation> 251 <xs:documentation>Provides the ability to document properties in a name/value store. 252 This provides flexibility to include data not officially supported in the standard 253 without having to use additional namespaces or create extensions. Property names 254 of interest to the general public are encouraged to be registered in the 255 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 256 Formal registration is OPTIONAL.</xs:documentation> 257 </xs:annotation> 258 </xs:element> 259 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 260 <xs:annotation> 261 <xs:documentation> 262 Allows any undeclared elements as long as the elements are placed in a different namespace. 263 </xs:documentation> 264 </xs:annotation> 265 </xs:any> 266 </xs:sequence> 267 <xs:anyAttribute namespace="##other" processContents="lax"> 268 <xs:annotation> 269 <xs:documentation>User-defined attributes may be used on this element as long as they 270 do not have the same name as an existing attribute used by the schema.</xs:documentation> 271 </xs:annotation> 272 </xs:anyAttribute> 273 </xs:complexType> 274 275 <xs:simpleType name="lifecyclePhaseType"> 276 <xs:restriction base="xs:string"> 277 <xs:enumeration value="design"> 278 <xs:annotation> 279 <xs:documentation> 280 BOM produced early in the development lifecycle containing inventory of components and services 281 that are proposed or planned to be used. The inventory may need to be procured, retrieved, 282 or resourced prior to use. 283 </xs:documentation> 284 </xs:annotation> 285 </xs:enumeration> 286 <xs:enumeration value="pre-build"> 287 <xs:annotation> 288 <xs:documentation> 289 BOM consisting of information obtained prior to a build process and may contain source files 290 and development artifacts and manifests. The inventory may need to be resolved and retrieved 291 prior to use. 292 </xs:documentation> 293 </xs:annotation> 294 </xs:enumeration> 295 <xs:enumeration value="build"> 296 <xs:annotation> 297 <xs:documentation> 298 BOM consisting of information obtained during a build process where component inventory is 299 available for use. The precise versions of resolved components are usually available at this 300 time as well as the provenance of where the components were retrieved from. 301 </xs:documentation> 302 </xs:annotation> 303 </xs:enumeration> 304 <xs:enumeration value="post-build"> 305 <xs:annotation> 306 <xs:documentation> 307 BOM consisting of information obtained after a build process has completed and the resulting 308 components(s) are available for further analysis. Built components may exist as the result of a 309 CI/CD process, may have been installed or deployed to a system or device, and may need to be 310 retrieved or extracted from the system or device. 311 </xs:documentation> 312 </xs:annotation> 313 </xs:enumeration> 314 <xs:enumeration value="operations"> 315 <xs:annotation> 316 <xs:documentation> 317 BOM produced that represents inventory that is running and operational. This may include staging 318 or production environments and will generally encompass multiple SBOMs describing the applications 319 and operating system, along with HBOMs describing the hardware that makes up the system. Operations 320 Bill of Materials (OBOM) can provide full-stack inventory of runtime environments, configurations, 321 and additional dependencies. 322 </xs:documentation> 323 </xs:annotation> 324 </xs:enumeration> 325 <xs:enumeration value="discovery"> 326 <xs:annotation> 327 <xs:documentation> 328 BOM consisting of information observed through network discovery providing point-in-time 329 enumeration of embedded, on-premise, and cloud-native services such as server applications, 330 connected devices, microservices, and serverless functions. 331 </xs:documentation> 332 </xs:annotation> 333 </xs:enumeration> 334 <xs:enumeration value="decommission"> 335 <xs:annotation> 336 <xs:documentation> 337 BOM containing inventory that will be, or has been retired from operations. 338 </xs:documentation> 339 </xs:annotation> 340 </xs:enumeration> 341 </xs:restriction> 342 </xs:simpleType> 343 344 <xs:complexType name="organizationalEntity"> 345 <xs:sequence minOccurs="0" maxOccurs="1"> 346 <xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 347 <xs:annotation> 348 <xs:documentation>The name of the organization</xs:documentation> 349 </xs:annotation> 350 </xs:element> 351 <xs:element name="address" type="bom:postalAddressType" minOccurs="0" maxOccurs="1"> 352 <xs:annotation> 353 <xs:documentation>The physical address (location) of the organization.</xs:documentation> 354 </xs:annotation> 355 </xs:element> 356 <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="unbounded"> 357 <xs:annotation> 358 <xs:documentation>The URL of the organization. Multiple URLs are allowed.</xs:documentation> 359 </xs:annotation> 360 </xs:element> 361 <xs:element name="contact" type="bom:organizationalContact" minOccurs="0" maxOccurs="unbounded"> 362 <xs:annotation> 363 <xs:documentation>A contact person at the organization. Multiple contacts are allowed.</xs:documentation> 364 </xs:annotation> 365 </xs:element> 366 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 367 <xs:annotation> 368 <xs:documentation> 369 Allows any undeclared elements as long as the elements are placed in a different namespace. 370 </xs:documentation> 371 </xs:annotation> 372 </xs:any> 373 </xs:sequence> 374 <xs:attribute name="bom-ref" type="bom:refType"> 375 <xs:annotation> 376 <xs:documentation> 377 An optional identifier which can be used to reference the object elsewhere in the BOM. 378 Uniqueness is enforced within all elements and children of the root-level bom element. 379 </xs:documentation> 380 </xs:annotation> 381 </xs:attribute> 382 <xs:anyAttribute namespace="##other" processContents="lax"> 383 <xs:annotation> 384 <xs:documentation>User-defined attributes may be used on this element as long as they 385 do not have the same name as an existing attribute used by the schema.</xs:documentation> 386 </xs:annotation> 387 </xs:anyAttribute> 388 </xs:complexType> 389 390 <xs:complexType name="toolType"> 391 <xs:annotation> 392 <xs:documentation>Information about the automated or manual tool used</xs:documentation> 393 </xs:annotation> 394 <xs:sequence minOccurs="0" maxOccurs="1"> 395 <xs:element name="vendor" minOccurs="0" maxOccurs="1" type="xs:normalizedString"> 396 <xs:annotation> 397 <xs:documentation>The name of the vendor who created the tool</xs:documentation> 398 </xs:annotation> 399 </xs:element> 400 <xs:element name="name" minOccurs="0" maxOccurs="1" type="xs:normalizedString"> 401 <xs:annotation> 402 <xs:documentation>The name of the tool</xs:documentation> 403 </xs:annotation> 404 </xs:element> 405 <xs:element name="version" minOccurs="0" maxOccurs="1" type="bom:versionType"> 406 <xs:annotation> 407 <xs:documentation>The version of the tool</xs:documentation> 408 </xs:annotation> 409 </xs:element> 410 <xs:element name="hashes" minOccurs="0" maxOccurs="1"> 411 <xs:complexType> 412 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 413 <xs:element name="hash" type="bom:hashType"/> 414 </xs:sequence> 415 </xs:complexType> 416 </xs:element> 417 <xs:element name="externalReferences" type="bom:externalReferences" minOccurs="0" maxOccurs="1"> 418 <xs:annotation> 419 <xs:documentation>Provides the ability to document external references related to the tool.</xs:documentation> 420 </xs:annotation> 421 </xs:element> 422 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 423 <xs:annotation> 424 <xs:documentation> 425 Allows any undeclared elements as long as the elements are placed in a different namespace. 426 </xs:documentation> 427 </xs:annotation> 428 </xs:any> 429 </xs:sequence> 430 <xs:anyAttribute namespace="##other" processContents="lax"> 431 <xs:annotation> 432 <xs:documentation>User-defined attributes may be used on this element as long as they 433 do not have the same name as an existing attribute used by the schema.</xs:documentation> 434 </xs:annotation> 435 </xs:anyAttribute> 436 </xs:complexType> 437 438 <xs:complexType name="organizationalContact"> 439 <xs:sequence minOccurs="0" maxOccurs="1"> 440 <xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 441 <xs:annotation> 442 <xs:documentation>The name of the contact</xs:documentation> 443 </xs:annotation> 444 </xs:element> 445 <xs:element name="email" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 446 <xs:annotation> 447 <xs:documentation>The email address of the contact.</xs:documentation> 448 </xs:annotation> 449 </xs:element> 450 <xs:element name="phone" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 451 <xs:annotation> 452 <xs:documentation>The phone number of the contact.</xs:documentation> 453 </xs:annotation> 454 </xs:element> 455 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 456 <xs:annotation> 457 <xs:documentation> 458 Allows any undeclared elements as long as the elements are placed in a different namespace. 459 </xs:documentation> 460 </xs:annotation> 461 </xs:any> 462 </xs:sequence> 463 <xs:attribute name="bom-ref" type="bom:refType"> 464 <xs:annotation> 465 <xs:documentation> 466 An optional identifier which can be used to reference the object elsewhere in the BOM. 467 Uniqueness is enforced within all elements and children of the root-level bom element. 468 </xs:documentation> 469 </xs:annotation> 470 </xs:attribute> 471 <xs:anyAttribute namespace="##other" processContents="lax"> 472 <xs:annotation> 473 <xs:documentation>User-defined attributes may be used on this element as long as they 474 do not have the same name as an existing attribute used by the schema.</xs:documentation> 475 </xs:annotation> 476 </xs:anyAttribute> 477 </xs:complexType> 478 479 <xs:complexType name="componentsType"> 480 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 481 <xs:element name="component" type="bom:component"/> 482 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 483 <xs:annotation> 484 <xs:documentation> 485 Allows any undeclared elements as long as the elements are placed in a different namespace. 486 </xs:documentation> 487 </xs:annotation> 488 </xs:any> 489 </xs:sequence> 490 <xs:anyAttribute namespace="##any" processContents="lax"> 491 <xs:annotation> 492 <xs:documentation>User-defined attributes may be used on this element as long as they 493 do not have the same name as an existing attribute used by the schema.</xs:documentation> 494 </xs:annotation> 495 </xs:anyAttribute> 496 </xs:complexType> 497 498 <xs:complexType name="component"> 499 <xs:sequence> 500 <xs:element name="supplier" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 501 <xs:annotation> 502 <xs:documentation>The organization that supplied the component. The supplier may often 503 be the manufacturer, but may also be a distributor or repackager.</xs:documentation> 504 </xs:annotation> 505 </xs:element> 506 <xs:element name="manufacturer" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 507 <xs:annotation> 508 <xs:documentation> 509 The organization that created the component. 510 Manufacturer is common in components created through automated processes. Components created through manual means may have './authors' instead. 511 </xs:documentation> 512 </xs:annotation> 513 </xs:element> 514 <xs:element name="authors" minOccurs="0" maxOccurs="1"> 515 <xs:annotation> 516 <xs:documentation> 517 The person(s) who created the component. 518 Authors are common in components created through manual processes. Components created through automated means may have `./manufacturer` instead. 519 </xs:documentation> 520 </xs:annotation> 521 <xs:complexType> 522 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 523 <xs:element name="author" type="bom:organizationalContact"/> 524 </xs:sequence> 525 </xs:complexType> 526 </xs:element> 527 <xs:element name="author" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 528 <xs:annotation> 529 <xs:documentation> 530 DEPRECATED - DO NOT USE. This will be removed in a future version. Use `./authors` or `./manufacturer` instead. 531 The person(s) or organization(s) that authored the component. 532 </xs:documentation> 533 </xs:annotation> 534 </xs:element> 535 <xs:element name="publisher" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 536 <xs:annotation> 537 <xs:documentation>The person(s) or organization(s) that published the component</xs:documentation> 538 </xs:annotation> 539 </xs:element> 540 <xs:element name="group" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 541 <xs:annotation> 542 <xs:documentation>The grouping name or identifier. This will often be a shortened, single 543 name of the company or project that produced the component, or the source package or 544 domain name. Whitespace and special characters should be avoided. Examples include: 545 apache, org.apache.commons, and apache.org.</xs:documentation> 546 </xs:annotation> 547 </xs:element> 548 <xs:element name="name" type="xs:normalizedString" minOccurs="1" maxOccurs="1"> 549 <xs:annotation> 550 <xs:documentation>The name of the component. This will often be a shortened, single name 551 of the component. Examples: commons-lang3 and jquery</xs:documentation> 552 </xs:annotation> 553 </xs:element> 554 <xs:element name="version" type="bom:versionType" minOccurs="0" maxOccurs="1"> 555 <xs:annotation> 556 <xs:documentation>The component version. The version should ideally comply with semantic versioning 557 but is not enforced.</xs:documentation> 558 </xs:annotation> 559 </xs:element> 560 <xs:element name="description" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 561 <xs:annotation> 562 <xs:documentation>Specifies a description for the component</xs:documentation> 563 </xs:annotation> 564 </xs:element> 565 <xs:element name="scope" type="bom:scope" minOccurs="0" maxOccurs="1" default="required"> 566 <xs:annotation> 567 <xs:documentation>Specifies the scope of the component. If scope is not specified, 'required' 568 scope SHOULD be assumed by the consumer of the BOM.</xs:documentation> 569 </xs:annotation> 570 </xs:element> 571 <xs:element name="hashes" minOccurs="0" maxOccurs="1"> 572 <xs:complexType> 573 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 574 <xs:element name="hash" type="bom:hashType"/> 575 </xs:sequence> 576 </xs:complexType> 577 </xs:element> 578 <xs:element name="licenses" type="bom:licenseChoiceType" minOccurs="0" maxOccurs="1"/> 579 <xs:element name="copyright" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 580 <xs:annotation> 581 <xs:documentation>A copyright notice informing users of the underlying claims to 582 copyright ownership in a published work.</xs:documentation> 583 </xs:annotation> 584 </xs:element> 585 <xs:element name="cpe" type="bom:cpe" minOccurs="0" maxOccurs="1"> 586 <xs:annotation> 587 <xs:documentation> 588 Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe 589 </xs:documentation> 590 </xs:annotation> 591 </xs:element> 592 <xs:element name="purl" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 593 <xs:annotation> 594 <xs:documentation> 595 Specifies the package-url (purl). The purl, if specified, MUST be valid and conform 596 to the specification defined at: https://github.com/package-url/purl-spec 597 </xs:documentation> 598 </xs:annotation> 599 </xs:element> 600 <xs:element name="omniborId" type="xs:string" minOccurs="0" maxOccurs="unbounded"> 601 <xs:annotation> 602 <xs:documentation> 603 Specifies the OmniBOR Artifact ID. The OmniBOR, if specified, MUST be valid and conform 604 to the specification defined at: https://www.iana.org/assignments/uri-schemes/prov/gitoid 605 </xs:documentation> 606 </xs:annotation> 607 </xs:element> 608 <xs:element name="swhid" type="xs:string" minOccurs="0" maxOccurs="unbounded"> 609 <xs:annotation> 610 <xs:documentation> 611 Specifies the Software Heritage persistent identifier (SWHID). The SWHID, if specified, MUST 612 be valid and conform to the specification defined at: 613 https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html 614 </xs:documentation> 615 </xs:annotation> 616 </xs:element> 617 <xs:element name="swid" type="bom:swidType" minOccurs="0" maxOccurs="1"> 618 <xs:annotation> 619 <xs:documentation> 620 Specifies metadata and content for ISO-IEC 19770-2 Software Identification (SWID) Tags. 621 </xs:documentation> 622 </xs:annotation> 623 </xs:element> 624 <xs:element name="modified" type="xs:boolean" minOccurs="0" maxOccurs="1"> 625 <xs:annotation> 626 <xs:documentation> 627 DEPRECATED - DO NOT USE. This will be removed in a future version. Use the pedigree 628 element instead to supply information on exactly how the component was modified. 629 A boolean value indicating if the component has been modified from the original. 630 A value of true indicates the component is a derivative of the original. 631 A value of false indicates the component has not been modified from the original. 632 </xs:documentation> 633 </xs:annotation> 634 </xs:element> 635 <xs:element name="pedigree" type="bom:pedigreeType" minOccurs="0" maxOccurs="1"> 636 <xs:annotation> 637 <xs:documentation> 638 Component pedigree is a way to document complex supply chain scenarios where components are 639 created, distributed, modified, redistributed, combined with other components, etc. 640 </xs:documentation> 641 </xs:annotation> 642 </xs:element> 643 <xs:element name="externalReferences" type="bom:externalReferences" minOccurs="0" maxOccurs="1"> 644 <xs:annotation> 645 <xs:documentation>Provides the ability to document external references related to the 646 component or to the project the component describes.</xs:documentation> 647 </xs:annotation> 648 </xs:element> 649 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 650 <xs:annotation> 651 <xs:documentation>Provides the ability to document properties in a name/value store. 652 This provides flexibility to include data not officially supported in the standard 653 without having to use additional namespaces or create extensions. Property names 654 of interest to the general public are encouraged to be registered in the 655 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 656 Formal registration is OPTIONAL.</xs:documentation> 657 </xs:annotation> 658 </xs:element> 659 <xs:element name="components" minOccurs="0" maxOccurs="1"> 660 <xs:annotation> 661 <xs:documentation> 662 A list of software and hardware components included in the parent component. This is not a 663 dependency tree. It provides a way to specify a hierarchical representation of component 664 assemblies, similar to system -> subsystem -> parts assembly in physical supply chains. 665 </xs:documentation> 666 </xs:annotation> 667 <xs:complexType> 668 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 669 <xs:element name="component" type="bom:component"/> 670 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 671 <xs:annotation> 672 <xs:documentation> 673 Allows any undeclared elements as long as the elements are placed in a different namespace. 674 </xs:documentation> 675 </xs:annotation> 676 </xs:any> 677 </xs:sequence> 678 </xs:complexType> 679 </xs:element> 680 <xs:element name="evidence" type="bom:componentEvidenceType" minOccurs="0" maxOccurs="1"> 681 <xs:annotation> 682 <xs:documentation>Provides the ability to document evidence collected through various forms of extraction or analysis.</xs:documentation> 683 </xs:annotation> 684 </xs:element> 685 <xs:element name="releaseNotes" type="bom:releaseNotesType" minOccurs="0" maxOccurs="1"> 686 <xs:annotation> 687 <xs:documentation>Specifies optional release notes.</xs:documentation> 688 </xs:annotation> 689 </xs:element> 690 <xs:element name="modelCard" type="bom:modelCardType" minOccurs="0" maxOccurs="1"> 691 <xs:annotation> 692 <xs:documentation>A model card describes the intended uses of a machine learning model and potential 693 limitations, including biases and ethical considerations. Model cards typically contain the 694 training parameters, which datasets were used to train the model, performance metrics, and other 695 relevant data useful for ML transparency. This object SHOULD be specified for any component of 696 type `machine-learning-model` and MUST NOT be specified for other component types.</xs:documentation> 697 </xs:annotation> 698 </xs:element> 699 <xs:element name="data" type="bom:componentDataType" minOccurs="0" maxOccurs="1"> 700 <xs:annotation> 701 <xs:documentation>This object SHOULD be specified for any component of type `data` and MUST NOT be 702 specified for other component types.</xs:documentation> 703 </xs:annotation> 704 </xs:element> 705 <xs:element name="cryptoProperties" type="bom:cryptoPropertiesType" minOccurs="0" maxOccurs="1"> 706 <xs:annotation> 707 <xs:documentation> 708 Cryptographic assets have properties that uniquely define them and that make them actionable 709 for further reasoning. As an example, it makes a difference if one knows the algorithm family 710 (e.g. AES) or the specific variant or instantiation (e.g. AES-128-GCM). This is because the 711 security level and the algorithm primitive (authenticated encryption) is only defined by the 712 definition of the algorithm variant. The presence of a weak cryptographic algorithm like SHA1 713 vs. HMAC-SHA1 also makes a difference. 714 </xs:documentation> 715 </xs:annotation> 716 </xs:element> 717 <xs:element name="tags" type="bom:tagsType" minOccurs="0" maxOccurs="1" /> 718 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 719 <xs:annotation> 720 <xs:documentation> 721 Allows any undeclared elements as long as the elements are placed in a different namespace. 722 </xs:documentation> 723 </xs:annotation> 724 </xs:any> 725 </xs:sequence> 726 <xs:attribute name="type" type="bom:classification" use="required"> 727 <xs:annotation> 728 <xs:documentation> 729 Specifies the type of component. For software components, classify as application if no more 730 specific appropriate classification is available or cannot be determined for the component. 731 </xs:documentation> 732 </xs:annotation> 733 </xs:attribute> 734 <xs:attribute name="mime-type" type="bom:mimeType"> 735 <xs:annotation> 736 <xs:documentation> 737 The OPTIONAL mime-type of the component. When used on file components, the mime-type 738 can provide additional context about the kind of file being represented such as an image, 739 font, or executable. Some library or framework components may also have an associated mime-type. 740 </xs:documentation> 741 </xs:annotation> 742 </xs:attribute> 743 <xs:attribute name="bom-ref" type="bom:refType"> 744 <xs:annotation> 745 <xs:documentation> 746 An optional identifier which can be used to reference the component elsewhere in the BOM. 747 Uniqueness is enforced within all elements and children of the root-level bom element. 748 </xs:documentation> 749 </xs:annotation> 750 </xs:attribute> 751 <xs:anyAttribute namespace="##any" processContents="lax"> 752 <xs:annotation> 753 <xs:documentation>User-defined attributes may be used on this element as long as they 754 do not have the same name as an existing attribute used by the schema.</xs:documentation> 755 </xs:annotation> 756 </xs:anyAttribute> 757 </xs:complexType> 758 759 <xs:complexType name="licenseType"> 760 <xs:sequence> 761 <xs:choice> 762 <xs:element name="id" type="spdx:licenseId" minOccurs="0" maxOccurs="1"> 763 <xs:annotation> 764 <xs:documentation>A valid SPDX license ID</xs:documentation> 765 </xs:annotation> 766 </xs:element> 767 <xs:element name="name" type="xs:normalizedString" minOccurs="1" maxOccurs="1"> 768 <xs:annotation> 769 <xs:documentation>If SPDX does not define the license used, this field may be used to provide the license name</xs:documentation> 770 </xs:annotation> 771 </xs:element> 772 </xs:choice> 773 <xs:element name="text" type="bom:attachedTextType" minOccurs="0" maxOccurs="1"> 774 <xs:annotation> 775 <xs:documentation>Specifies the optional full text of the attachment</xs:documentation> 776 </xs:annotation> 777 </xs:element> 778 <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 779 <xs:annotation> 780 <xs:documentation>The URL to the attachment file. If the attachment is a license or BOM, 781 an externalReference should also be specified for completeness.</xs:documentation> 782 </xs:annotation> 783 </xs:element> 784 <xs:element name="licensing" minOccurs="0" maxOccurs="1"> 785 <xs:annotation> 786 <xs:documentation>Licensing details describing the licensor/licensee, license type, renewal and 787 expiration dates, and other important metadata</xs:documentation> 788 </xs:annotation> 789 <xs:complexType> 790 <xs:sequence> 791 <xs:element name="altIds" minOccurs="0" maxOccurs="1"> 792 <xs:annotation> 793 <xs:documentation>License identifiers that may be used to manage licenses and 794 their lifecycle</xs:documentation> 795 </xs:annotation> 796 <xs:complexType> 797 <xs:sequence> 798 <xs:element name="altId" type="xs:normalizedString" minOccurs="0" maxOccurs="unbounded"/> 799 </xs:sequence> 800 </xs:complexType> 801 </xs:element> 802 <xs:element name="licensor" minOccurs="0" maxOccurs="1"> 803 <xs:annotation> 804 <xs:documentation>The individual or organization that grants a license to another 805 individual or organization</xs:documentation> 806 </xs:annotation> 807 <xs:complexType> 808 <xs:sequence> 809 <xs:choice> 810 <xs:element name="organization" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 811 <xs:annotation> 812 <xs:documentation>The organization that granted the license</xs:documentation> 813 </xs:annotation> 814 </xs:element> 815 <xs:element name="individual" type="bom:organizationalContact" minOccurs="0" maxOccurs="1"> 816 <xs:annotation> 817 <xs:documentation>The individual, not associated with an organization, 818 that granted the license</xs:documentation> 819 </xs:annotation> 820 </xs:element> 821 </xs:choice> 822 </xs:sequence> 823 </xs:complexType> 824 </xs:element> 825 <xs:element name="licensee" minOccurs="0" maxOccurs="1"> 826 <xs:annotation> 827 <xs:documentation>The individual or organization for which a license was granted to</xs:documentation> 828 </xs:annotation> 829 <xs:complexType> 830 <xs:sequence> 831 <xs:choice> 832 <xs:element name="organization" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 833 <xs:annotation> 834 <xs:documentation>The organization that was granted the license</xs:documentation> 835 </xs:annotation> 836 </xs:element> 837 <xs:element name="individual" type="bom:organizationalContact" minOccurs="0" maxOccurs="1"> 838 <xs:annotation> 839 <xs:documentation>The individual, not associated with an organization, 840 that was granted the license</xs:documentation> 841 </xs:annotation> 842 </xs:element> 843 </xs:choice> 844 </xs:sequence> 845 </xs:complexType> 846 </xs:element> 847 <xs:element name="purchaser" minOccurs="0" maxOccurs="1"> 848 <xs:annotation> 849 <xs:documentation>The individual or organization that purchased the license</xs:documentation> 850 </xs:annotation> 851 <xs:complexType> 852 <xs:sequence> 853 <xs:choice> 854 <xs:element name="organization" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 855 <xs:annotation> 856 <xs:documentation>The organization that purchased the license</xs:documentation> 857 </xs:annotation> 858 </xs:element> 859 <xs:element name="individual" type="bom:organizationalContact" minOccurs="0" maxOccurs="1"> 860 <xs:annotation> 861 <xs:documentation>The individual, not associated with an organization, 862 that purchased the license</xs:documentation> 863 </xs:annotation> 864 </xs:element> 865 </xs:choice> 866 </xs:sequence> 867 </xs:complexType> 868 </xs:element> 869 <xs:element name="purchaseOrder" type="xs:string" minOccurs="0" maxOccurs="1"> 870 <xs:annotation> 871 <xs:documentation>The purchase order identifier the purchaser sent to a supplier or 872 vendor to authorize a purchase</xs:documentation> 873 </xs:annotation> 874 </xs:element> 875 <xs:element name="licenseTypes" minOccurs="0" maxOccurs="1"> 876 <xs:annotation> 877 <xs:documentation>The type of license(s) that was granted to the licensee</xs:documentation> 878 </xs:annotation> 879 <xs:complexType> 880 <xs:sequence> 881 <xs:element name="licenseType" type="bom:licenseTypeEnum" minOccurs="0" maxOccurs="unbounded"/> 882 </xs:sequence> 883 </xs:complexType> 884 </xs:element> 885 <xs:element name="lastRenewal" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 886 <xs:annotation> 887 <xs:documentation xml:lang="en">The timestamp indicating when the license was last 888 renewed. For new purchases, this is often the purchase or acquisition date. 889 For non-perpetual licenses or subscriptions, this is the timestamp of when the 890 license was last renewed.</xs:documentation> 891 </xs:annotation> 892 </xs:element> 893 <xs:element name="expiration" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 894 <xs:annotation> 895 <xs:documentation xml:lang="en">The timestamp indicating when the current license 896 expires (if applicable).</xs:documentation> 897 </xs:annotation> 898 </xs:element> 899 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 900 <xs:annotation> 901 <xs:documentation> 902 Allows any undeclared elements as long as the elements are placed in a different namespace. 903 </xs:documentation> 904 </xs:annotation> 905 </xs:any> 906 </xs:sequence> 907 </xs:complexType> 908 </xs:element> 909 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 910 <xs:annotation> 911 <xs:documentation>Provides the ability to document properties in a name/value store. 912 This provides flexibility to include data not officially supported in the standard 913 without having to use additional namespaces or create extensions. Property names 914 of interest to the general public are encouraged to be registered in the 915 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 916 Formal registration is OPTIONAL.</xs:documentation> 917 </xs:annotation> 918 </xs:element> 919 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 920 <xs:annotation> 921 <xs:documentation> 922 Allows any undeclared elements as long as the elements are placed in a different namespace. 923 </xs:documentation> 924 </xs:annotation> 925 </xs:any> 926 </xs:sequence> 927 <xs:attribute name="bom-ref" type="bom:refType"> 928 <xs:annotation> 929 <xs:documentation> 930 An optional identifier which can be used to reference the license elsewhere in the BOM. 931 Uniqueness is enforced within all elements and children of the root-level bom element. 932 </xs:documentation> 933 </xs:annotation> 934 </xs:attribute> 935 <xs:attribute name="acknowledgement" type="bom:licenseAcknowledgementEnumerationType"> 936 <xs:annotation> 937 <xs:documentation> 938 Declared licenses and concluded licenses represent two different stages in the 939 licensing process within software development. Declared licenses refer to the 940 initial intention of the software authors regarding the licensing terms under 941 which their code is released. On the other hand, concluded licenses are the 942 result of a comprehensive analysis of the project's codebase to identify and 943 confirm the actual licenses of the components used, which may differ from the 944 initially declared licenses. While declared licenses provide an upfront indication 945 of the licensing intentions, concluded licenses offer a more thorough understanding 946 of the actual licensing within a project, facilitating proper compliance and risk 947 management. Observed licenses are defined in `evidence.licenses`. Observed licenses 948 form the evidence necessary to substantiate a concluded license. 949 </xs:documentation> 950 </xs:annotation> 951 </xs:attribute> 952 </xs:complexType> 953 954 <xs:complexType name="attachedTextType"> 955 <xs:simpleContent> 956 <xs:extension base="xs:string"> 957 <xs:annotation> 958 <xs:documentation>The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.</xs:documentation> 959 </xs:annotation> 960 <xs:attribute name="content-type" type="xs:normalizedString" default="text/plain"> 961 <xs:annotation> 962 <xs:documentation>Specifies the content type of the text. Defaults to text/plain 963 if not specified.</xs:documentation> 964 </xs:annotation> 965 </xs:attribute> 966 <xs:attribute name="encoding" type="bom:encoding"> 967 <xs:annotation> 968 <xs:documentation> 969 Specifies the optional encoding the text is represented in 970 </xs:documentation> 971 </xs:annotation> 972 </xs:attribute> 973 </xs:extension> 974 </xs:simpleContent> 975 </xs:complexType> 976 977 <xs:complexType name="hashType"> 978 <xs:annotation> 979 <xs:documentation>Specifies the file hash of the component</xs:documentation> 980 </xs:annotation> 981 <xs:simpleContent> 982 <xs:extension base="bom:hashValue"> 983 <xs:attribute name="alg" type="bom:hashAlg" use="required"> 984 <xs:annotation> 985 <xs:documentation>Specifies the algorithm used to create the hash</xs:documentation> 986 </xs:annotation> 987 </xs:attribute> 988 </xs:extension> 989 </xs:simpleContent> 990 </xs:complexType> 991 992 <xs:simpleType name="scope"> 993 <xs:restriction base="xs:string"> 994 <xs:enumeration value="required"> 995 <xs:annotation> 996 <xs:documentation>The component is required for runtime</xs:documentation> 997 </xs:annotation> 998 </xs:enumeration> 999 <xs:enumeration value="optional"> 1000 <xs:annotation> 1001 <xs:documentation>The component is optional at runtime. Optional components are components that 1002 are not capable of being called due to them not be installed or otherwise accessible by any means. 1003 Components that are installed but due to configuration or other restrictions are prohibited from 1004 being called must be scoped as 'required'.</xs:documentation> 1005 </xs:annotation> 1006 </xs:enumeration> 1007 <xs:enumeration value="excluded"> 1008 <xs:annotation> 1009 <xs:documentation>Components that are excluded provide the ability to document component usage 1010 for test and other non-runtime purposes. Excluded components are not reachable within a call 1011 graph at runtime.</xs:documentation> 1012 </xs:annotation> 1013 </xs:enumeration> 1014 </xs:restriction> 1015 </xs:simpleType> 1016 1017 <xs:simpleType name="classification"> 1018 <xs:restriction base="xs:string"> 1019 <xs:enumeration value="application"> 1020 <xs:annotation> 1021 <xs:documentation>A software application. Refer to https://en.wikipedia.org/wiki/Application_software 1022 for information about applications.</xs:documentation> 1023 </xs:annotation> 1024 </xs:enumeration> 1025 <xs:enumeration value="framework"> 1026 <xs:annotation> 1027 <xs:documentation>A software framework. Refer to https://en.wikipedia.org/wiki/Software_framework 1028 for information on how frameworks vary slightly from libraries.</xs:documentation> 1029 </xs:annotation> 1030 </xs:enumeration> 1031 <xs:enumeration value="library"> 1032 <xs:annotation> 1033 <xs:documentation>A software library. Refer to https://en.wikipedia.org/wiki/Library_(computing) 1034 for information about libraries. All third-party and open source reusable components will likely 1035 be a library. If the library also has key features of a framework, then it should be classified 1036 as a framework. If not, or is unknown, then specifying library is recommended.</xs:documentation> 1037 </xs:annotation> 1038 </xs:enumeration> 1039 <xs:enumeration value="container"> 1040 <xs:annotation> 1041 <xs:documentation>A packaging and/or runtime format, not specific to any particular technology, 1042 which isolates software inside the container from software outside of a container through 1043 virtualization technology. Refer to https://en.wikipedia.org/wiki/OS-level_virtualization</xs:documentation> 1044 </xs:annotation> 1045 </xs:enumeration> 1046 <xs:enumeration value="platform"> 1047 <xs:annotation> 1048 <xs:documentation>A runtime environment which interprets or executes software. This may include 1049 runtimes such as those that execute bytecode or low-code/no-code application platforms.</xs:documentation> 1050 </xs:annotation> 1051 </xs:enumeration> 1052 <xs:enumeration value="operating-system"> 1053 <xs:annotation> 1054 <xs:documentation>A software operating system without regard to deployment model 1055 (i.e. installed on physical hardware, virtual machine, image, etc) Refer to 1056 https://en.wikipedia.org/wiki/Operating_system</xs:documentation> 1057 </xs:annotation> 1058 </xs:enumeration> 1059 <xs:enumeration value="device"> 1060 <xs:annotation> 1061 <xs:documentation>A hardware device such as a processor, or chip-set. A hardware device 1062 containing firmware SHOULD include a component for the physical hardware itself, and another 1063 component of type 'firmware' or 'operating-system' (whichever is relevant), describing 1064 information about the software running on the device. 1065 See also the list of known device properties: https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx/device.md 1066 </xs:documentation> 1067 </xs:annotation> 1068 </xs:enumeration> 1069 <xs:enumeration value="device-driver"> 1070 <xs:annotation> 1071 <xs:documentation>A special type of software that operates or controls a particular type of device. 1072 Refer to https://en.wikipedia.org/wiki/Device_driver</xs:documentation> 1073 </xs:annotation> 1074 </xs:enumeration> 1075 <xs:enumeration value="firmware"> 1076 <xs:annotation> 1077 <xs:documentation>A special type of software that provides low-level control over a devices 1078 hardware. Refer to https://en.wikipedia.org/wiki/Firmware</xs:documentation> 1079 </xs:annotation> 1080 </xs:enumeration> 1081 <xs:enumeration value="file"> 1082 <xs:annotation> 1083 <xs:documentation>A computer file. Refer to https://en.wikipedia.org/wiki/Computer_file 1084 for information about files.</xs:documentation> 1085 </xs:annotation> 1086 </xs:enumeration> 1087 <xs:enumeration value="machine-learning-model"> 1088 <xs:annotation> 1089 <xs:documentation>A model based on training data that can make predictions or decisions without 1090 being explicitly programmed to do so.</xs:documentation> 1091 </xs:annotation> 1092 </xs:enumeration> 1093 <xs:enumeration value="data"> 1094 <xs:annotation> 1095 <xs:documentation>A collection of discrete values that convey information.</xs:documentation> 1096 </xs:annotation> 1097 </xs:enumeration> 1098 <xs:enumeration value="cryptographic-asset"> 1099 <xs:annotation> 1100 <xs:documentation>A cryptographic asset including algorithms, protocols, certificates, keys, tokens, and secrets.</xs:documentation> 1101 </xs:annotation> 1102 </xs:enumeration> 1103 </xs:restriction> 1104 </xs:simpleType> 1105 1106 <xs:simpleType name="hashAlg"> 1107 <xs:restriction base="xs:string"> 1108 <xs:enumeration value="MD5"/> 1109 <xs:enumeration value="SHA-1"/> 1110 <xs:enumeration value="SHA-256"/> 1111 <xs:enumeration value="SHA-384"/> 1112 <xs:enumeration value="SHA-512"/> 1113 <xs:enumeration value="SHA3-256"/> 1114 <xs:enumeration value="SHA3-384"/> 1115 <xs:enumeration value="SHA3-512"/> 1116 <xs:enumeration value="BLAKE2b-256"/> 1117 <xs:enumeration value="BLAKE2b-384"/> 1118 <xs:enumeration value="BLAKE2b-512"/> 1119 <xs:enumeration value="BLAKE3"/> 1120 </xs:restriction> 1121 </xs:simpleType> 1122 1123 <xs:simpleType name="licenseTypeEnum"> 1124 <xs:restriction base="xs:string"> 1125 <xs:enumeration value="academic"> 1126 <xs:annotation> 1127 <xs:documentation>A license that grants use of software solely for the purpose 1128 of education or research.</xs:documentation> 1129 </xs:annotation> 1130 </xs:enumeration> 1131 <xs:enumeration value="appliance"> 1132 <xs:annotation> 1133 <xs:documentation>A license covering use of software embedded in a specific 1134 piece of hardware.</xs:documentation> 1135 </xs:annotation> 1136 </xs:enumeration> 1137 <xs:enumeration value="client-access"> 1138 <xs:annotation> 1139 <xs:documentation>A Client Access License (CAL) allows client computers to access 1140 services provided by server software.</xs:documentation> 1141 </xs:annotation> 1142 </xs:enumeration> 1143 <xs:enumeration value="concurrent-user"> 1144 <xs:annotation> 1145 <xs:documentation>A Concurrent User license (aka floating license) limits the 1146 number of licenses for a software application and licenses are shared among 1147 a larger number of users.</xs:documentation> 1148 </xs:annotation> 1149 </xs:enumeration> 1150 <xs:enumeration value="core-points"> 1151 <xs:annotation> 1152 <xs:documentation>A license where the core of a computer's processor is assigned 1153 a specific number of points.</xs:documentation> 1154 </xs:annotation> 1155 </xs:enumeration> 1156 <xs:enumeration value="custom-metric"> 1157 <xs:annotation> 1158 <xs:documentation>A license for which consumption is measured by non-standard 1159 metrics.</xs:documentation> 1160 </xs:annotation> 1161 </xs:enumeration> 1162 <xs:enumeration value="device"> 1163 <xs:annotation> 1164 <xs:documentation>A license that covers a defined number of installations on 1165 computers and other types of devices.</xs:documentation> 1166 </xs:annotation> 1167 </xs:enumeration> 1168 <xs:enumeration value="evaluation"> 1169 <xs:annotation> 1170 <xs:documentation>A license that grants permission to install and use software 1171 for trial purposes.</xs:documentation> 1172 </xs:annotation> 1173 </xs:enumeration> 1174 <xs:enumeration value="named-user"> 1175 <xs:annotation> 1176 <xs:documentation>A license that grants access to the software to one or more 1177 pre-defined users.</xs:documentation> 1178 </xs:annotation> 1179 </xs:enumeration> 1180 <xs:enumeration value="node-locked"> 1181 <xs:annotation> 1182 <xs:documentation>A license that grants access to the software on one or more 1183 pre-defined computers or devices.</xs:documentation> 1184 </xs:annotation> 1185 </xs:enumeration> 1186 <xs:enumeration value="oem"> 1187 <xs:annotation> 1188 <xs:documentation>An Original Equipment Manufacturer license that is delivered 1189 with hardware, cannot be transferred to other hardware, and is valid for the 1190 life of the hardware.</xs:documentation> 1191 </xs:annotation> 1192 </xs:enumeration> 1193 <xs:enumeration value="perpetual"> 1194 <xs:annotation> 1195 <xs:documentation>A license where the software is sold on a one-time basis and 1196 the licensee can use a copy of the software indefinitely.</xs:documentation> 1197 </xs:annotation> 1198 </xs:enumeration> 1199 <xs:enumeration value="processor-points"> 1200 <xs:annotation> 1201 <xs:documentation>A license where each installation consumes points per 1202 processor.</xs:documentation> 1203 </xs:annotation> 1204 </xs:enumeration> 1205 <xs:enumeration value="subscription"> 1206 <xs:annotation> 1207 <xs:documentation>A license where the licensee pays a fee to use the software 1208 or service.</xs:documentation> 1209 </xs:annotation> 1210 </xs:enumeration> 1211 <xs:enumeration value="user"> 1212 <xs:annotation> 1213 <xs:documentation>A license that grants access to the software or service by a 1214 specified number of users.</xs:documentation> 1215 </xs:annotation> 1216 </xs:enumeration> 1217 <xs:enumeration value="other"> 1218 <xs:annotation> 1219 <xs:documentation>Another license type.</xs:documentation> 1220 </xs:annotation> 1221 </xs:enumeration> 1222 </xs:restriction> 1223 </xs:simpleType> 1224 1225 <xs:simpleType name="hashValue"> 1226 <xs:restriction base="xs:token"> 1227 <xs:pattern value="([a-fA-F0-9]{32})|([a-fA-F0-9]{40})|([a-fA-F0-9]{64})|([a-fA-F0-9]{96})|([a-fA-F0-9]{128})"/> 1228 </xs:restriction> 1229 </xs:simpleType> 1230 1231 <xs:simpleType name="mimeType"> 1232 <xs:restriction base="xs:token"> 1233 <xs:pattern value="[-+a-z0-9.]+/[-+a-z0-9.]+"/> 1234 </xs:restriction> 1235 </xs:simpleType> 1236 1237 <xs:simpleType name="encoding"> 1238 <xs:restriction base="xs:string"> 1239 <xs:enumeration value="base64"/> 1240 </xs:restriction> 1241 </xs:simpleType> 1242 1243 <xs:simpleType name="cpe"> 1244 <xs:annotation> 1245 <xs:documentation xml:lang="en"> 1246 Define the format for acceptable CPE URIs. Supports CPE 2.2 and CPE 2.3 formats. 1247 Refer to https://nvd.nist.gov/products/cpe for official specification. 1248 </xs:documentation> 1249 </xs:annotation> 1250 <xs:restriction base="xs:string"> 1251 <xs:pattern value="([c][pP][eE]:/[AHOaho]?(:[A-Za-z0-9\._\-~%]*){0,6})|(cpe:2\.3:[aho\*\-](:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!"#$$%&'\(\)\+,/:;<=>@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\*\-]))(:(((\?*|\*?)([a-zA-Z0-9\-\._]|(\\[\\\*\?!"#$$%&'\(\)\+,/:;<=>@\[\]\^`\{\|}~]))+(\?*|\*?))|[\*\-])){4})"/> 1252 </xs:restriction> 1253 </xs:simpleType> 1254 1255 <xs:complexType name="swidType"> 1256 <xs:sequence> 1257 <xs:element name="text" type="bom:attachedTextType" minOccurs="0" maxOccurs="1"> 1258 <xs:annotation> 1259 <xs:documentation>Specifies the full content of the SWID tag.</xs:documentation> 1260 </xs:annotation> 1261 </xs:element> 1262 <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 1263 <xs:annotation> 1264 <xs:documentation>The URL to the SWID file.</xs:documentation> 1265 </xs:annotation> 1266 </xs:element> 1267 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1268 <xs:annotation> 1269 <xs:documentation> 1270 Allows any undeclared elements as long as the elements are placed in a different namespace. 1271 </xs:documentation> 1272 </xs:annotation> 1273 </xs:any> 1274 </xs:sequence> 1275 <xs:attribute name="tagId" type="xs:string" use="required"> 1276 <xs:annotation> 1277 <xs:documentation>Maps to the tagId of a SoftwareIdentity.</xs:documentation> 1278 </xs:annotation> 1279 </xs:attribute> 1280 <xs:attribute name="name" type="xs:string" use="required"> 1281 <xs:annotation> 1282 <xs:documentation>Maps to the name of a SoftwareIdentity.</xs:documentation> 1283 </xs:annotation> 1284 </xs:attribute> 1285 <xs:attribute name="version" type="xs:string" use="optional" default="0.0"> 1286 <xs:annotation> 1287 <xs:documentation>Maps to the version of a SoftwareIdentity.</xs:documentation> 1288 </xs:annotation> 1289 </xs:attribute> 1290 <xs:attribute name="tagVersion" type="xs:integer" use="optional" default="0"> 1291 <xs:annotation> 1292 <xs:documentation>Maps to the tagVersion of a SoftwareIdentity.</xs:documentation> 1293 </xs:annotation> 1294 </xs:attribute> 1295 <xs:attribute name="patch" type="xs:boolean" use="optional" default="false"> 1296 <xs:annotation> 1297 <xs:documentation>Maps to the patch of a SoftwareIdentity.</xs:documentation> 1298 </xs:annotation> 1299 </xs:attribute> 1300 </xs:complexType> 1301 1302 <xs:simpleType name="urnUuid"> 1303 <xs:annotation> 1304 <xs:documentation xml:lang="en"> 1305 Defines a string representation of a UUID conforming to RFC 4122. 1306 </xs:documentation> 1307 </xs:annotation> 1308 <xs:restriction base="xs:string"> 1309 <xs:pattern value="urn:uuid:([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})|(\{[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\})"/> 1310 </xs:restriction> 1311 </xs:simpleType> 1312 1313 <xs:simpleType name="externalReferenceType"> 1314 <xs:restriction base="xs:string"> 1315 <xs:enumeration value="vcs"> 1316 <xs:annotation> 1317 <xs:documentation>Version Control System</xs:documentation> 1318 </xs:annotation> 1319 </xs:enumeration> 1320 <xs:enumeration value="issue-tracker"> 1321 <xs:annotation> 1322 <xs:documentation>Issue or defect tracking system, or an Application Lifecycle Management (ALM) system</xs:documentation> 1323 </xs:annotation> 1324 </xs:enumeration> 1325 <xs:enumeration value="website"> 1326 <xs:annotation> 1327 <xs:documentation>Website</xs:documentation> 1328 </xs:annotation> 1329 </xs:enumeration> 1330 <xs:enumeration value="advisories"> 1331 <xs:annotation> 1332 <xs:documentation>Security advisories</xs:documentation> 1333 </xs:annotation> 1334 </xs:enumeration> 1335 <xs:enumeration value="bom"> 1336 <xs:annotation> 1337 <xs:documentation>Bill-of-materials (SBOM, OBOM, HBOM, SaaSBOM, etc)</xs:documentation> 1338 </xs:annotation> 1339 </xs:enumeration> 1340 <xs:enumeration value="mailing-list"> 1341 <xs:annotation> 1342 <xs:documentation>Mailing list or discussion group</xs:documentation> 1343 </xs:annotation> 1344 </xs:enumeration> 1345 <xs:enumeration value="social"> 1346 <xs:annotation> 1347 <xs:documentation>Social media account</xs:documentation> 1348 </xs:annotation> 1349 </xs:enumeration> 1350 <xs:enumeration value="chat"> 1351 <xs:annotation> 1352 <xs:documentation>Real-time chat platform</xs:documentation> 1353 </xs:annotation> 1354 </xs:enumeration> 1355 <xs:enumeration value="documentation"> 1356 <xs:annotation> 1357 <xs:documentation>Documentation, guides, or how-to instructions</xs:documentation> 1358 </xs:annotation> 1359 </xs:enumeration> 1360 <xs:enumeration value="support"> 1361 <xs:annotation> 1362 <xs:documentation>Community or commercial support</xs:documentation> 1363 </xs:annotation> 1364 </xs:enumeration> 1365 <xs:enumeration value="source-distribution"> 1366 <xs:annotation> 1367 <xs:documentation>The location where the source code distributable can be obtained. This is often an archive format such as zip or tgz. The source-distribution type complements use of the version control (vcs) type.</xs:documentation> 1368 </xs:annotation> 1369 </xs:enumeration> 1370 <xs:enumeration value="distribution"> 1371 <xs:annotation> 1372 <xs:documentation>Direct or repository download location</xs:documentation> 1373 </xs:annotation> 1374 </xs:enumeration> 1375 <xs:enumeration value="distribution-intake"> 1376 <xs:annotation> 1377 <xs:documentation>The location where a component was published to. This is often the same as "distribution" but may also include specialized publishing processes that act as an intermediary</xs:documentation> 1378 </xs:annotation> 1379 </xs:enumeration> 1380 <xs:enumeration value="license"> 1381 <xs:annotation> 1382 <xs:documentation>The URL to the license file. If a license URL has been defined in the license 1383 node, it should also be defined as an external reference for completeness</xs:documentation> 1384 </xs:annotation> 1385 </xs:enumeration> 1386 <xs:enumeration value="build-meta"> 1387 <xs:annotation> 1388 <xs:documentation>Build-system specific meta file (i.e. pom.xml, package.json, .nuspec, etc)</xs:documentation> 1389 </xs:annotation> 1390 </xs:enumeration> 1391 <xs:enumeration value="build-system"> 1392 <xs:annotation> 1393 <xs:documentation>URL to an automated build system</xs:documentation> 1394 </xs:annotation> 1395 </xs:enumeration> 1396 <xs:enumeration value="release-notes"> 1397 <xs:annotation> 1398 <xs:documentation>URL to release notes</xs:documentation> 1399 </xs:annotation> 1400 </xs:enumeration> 1401 <xs:enumeration value="security-contact"> 1402 <xs:annotation> 1403 <xs:documentation>Specifies a way to contact the maintainer, supplier, or provider in the event of a security incident. Common URIs include links to a disclosure procedure, a mailto (RFC-2368) that specifies an email address, a tel (RFC-3966) that specifies a phone number, or dns (RFC-4501) that specifies the records containing DNS Security TXT.</xs:documentation> 1404 </xs:annotation> 1405 </xs:enumeration> 1406 <xs:enumeration value="model-card"> 1407 <xs:annotation> 1408 <xs:documentation>A model card describes the intended uses of a machine learning model, potential 1409 limitations, biases, ethical considerations, training parameters, datasets used to train the 1410 model, performance metrics, and other relevant data useful for ML transparency.</xs:documentation> 1411 </xs:annotation> 1412 </xs:enumeration> 1413 <xs:enumeration value="log"> 1414 <xs:annotation> 1415 <xs:documentation>A record of events that occurred in a computer system or application, such as problems, errors, or information on current operations.</xs:documentation> 1416 </xs:annotation> 1417 </xs:enumeration> 1418 <xs:enumeration value="configuration"> 1419 <xs:annotation> 1420 <xs:documentation>Parameters or settings that may be used by other components or services.</xs:documentation> 1421 </xs:annotation> 1422 </xs:enumeration> 1423 <xs:enumeration value="evidence"> 1424 <xs:annotation> 1425 <xs:documentation>Information used to substantiate a claim.</xs:documentation> 1426 </xs:annotation> 1427 </xs:enumeration> 1428 <xs:enumeration value="formulation"> 1429 <xs:annotation> 1430 <xs:documentation>Describes how a component or service was manufactured or deployed.</xs:documentation> 1431 </xs:annotation> 1432 </xs:enumeration> 1433 <xs:enumeration value="attestation"> 1434 <xs:annotation> 1435 <xs:documentation>Human or machine-readable statements containing facts, evidence, or testimony</xs:documentation> 1436 </xs:annotation> 1437 </xs:enumeration> 1438 <xs:enumeration value="threat-model"> 1439 <xs:annotation> 1440 <xs:documentation>An enumeration of identified weaknesses, threats, and countermeasures, dataflow diagram (DFD), attack tree, and other supporting documentation in human-readable or machine-readable format</xs:documentation> 1441 </xs:annotation> 1442 </xs:enumeration> 1443 <xs:enumeration value="adversary-model"> 1444 <xs:annotation> 1445 <xs:documentation>The defined assumptions, goals, and capabilities of an adversary.</xs:documentation> 1446 </xs:annotation> 1447 </xs:enumeration> 1448 <xs:enumeration value="risk-assessment"> 1449 <xs:annotation> 1450 <xs:documentation>Identifies and analyzes the potential of future events that may negatively impact individuals, assets, and/or the environment. Risk assessments may also include judgments on the tolerability of each risk.</xs:documentation> 1451 </xs:annotation> 1452 </xs:enumeration> 1453 <xs:enumeration value="vulnerability-assertion"> 1454 <xs:annotation> 1455 <xs:documentation>A Vulnerability Disclosure Report (VDR) which asserts the known and previously unknown vulnerabilities that affect a component, service, or product including the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on a component, service, or product.</xs:documentation> 1456 </xs:annotation> 1457 </xs:enumeration> 1458 <xs:enumeration value="exploitability-statement"> 1459 <xs:annotation> 1460 <xs:documentation>A Vulnerability Exploitability eXchange (VEX) which asserts the known vulnerabilities that do not affect a product, product family, or organization, and optionally the ones that do. The VEX should include the analysis and findings describing the impact (or lack of impact) that the reported vulnerability has on the product, product family, or organization.</xs:documentation> 1461 </xs:annotation> 1462 </xs:enumeration> 1463 <xs:enumeration value="pentest-report"> 1464 <xs:annotation> 1465 <xs:documentation>Results from an authorized simulated cyberattack on a component or service, otherwise known as a penetration test</xs:documentation> 1466 </xs:annotation> 1467 </xs:enumeration> 1468 <xs:enumeration value="static-analysis-report"> 1469 <xs:annotation> 1470 <xs:documentation>SARIF or proprietary machine or human-readable report for which static analysis has identified code quality, security, and other potential issues with the source code</xs:documentation> 1471 </xs:annotation> 1472 </xs:enumeration> 1473 <xs:enumeration value="dynamic-analysis-report"> 1474 <xs:annotation> 1475 <xs:documentation>Dynamic analysis report that has identified issues such as vulnerabilities and misconfigurations</xs:documentation> 1476 </xs:annotation> 1477 </xs:enumeration> 1478 <xs:enumeration value="runtime-analysis-report"> 1479 <xs:annotation> 1480 <xs:documentation>Report generated by analyzing the call stack of a running application</xs:documentation> 1481 </xs:annotation> 1482 </xs:enumeration> 1483 <xs:enumeration value="component-analysis-report"> 1484 <xs:annotation> 1485 <xs:documentation>Report generated by Software Composition Analysis (SCA), container analysis, or other forms of component analysis</xs:documentation> 1486 </xs:annotation> 1487 </xs:enumeration> 1488 <xs:enumeration value="maturity-report"> 1489 <xs:annotation> 1490 <xs:documentation>Report containing a formal assessment of an organization, business unit, or team against a maturity model</xs:documentation> 1491 </xs:annotation> 1492 </xs:enumeration> 1493 <xs:enumeration value="certification-report"> 1494 <xs:annotation> 1495 <xs:documentation>Industry, regulatory, or other certification from an accredited (if applicable) certification body</xs:documentation> 1496 </xs:annotation> 1497 </xs:enumeration> 1498 <xs:enumeration value="quality-metrics"> 1499 <xs:annotation> 1500 <xs:documentation>Report or system in which quality metrics can be obtained</xs:documentation> 1501 </xs:annotation> 1502 </xs:enumeration> 1503 <xs:enumeration value="codified-infrastructure"> 1504 <xs:annotation> 1505 <xs:documentation>Code or configuration that defines and provisions virtualized infrastructure, commonly referred to as Infrastructure as Code (IaC)</xs:documentation> 1506 </xs:annotation> 1507 </xs:enumeration> 1508 <xs:enumeration value="poam"> 1509 <xs:annotation> 1510 <xs:documentation>Plans of Action and Milestones (POAM) complement an "attestation" external reference. POAM is defined by NIST as a "document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks and scheduled completion dates for the milestones".</xs:documentation> 1511 </xs:annotation> 1512 </xs:enumeration> 1513 <xs:enumeration value="electronic-signature"> 1514 <xs:annotation> 1515 <xs:documentation>An e-signature is commonly a scanned representation of a written signature or a stylized script of the persons name.</xs:documentation> 1516 </xs:annotation> 1517 </xs:enumeration> 1518 <xs:enumeration value="digital-signature"> 1519 <xs:annotation> 1520 <xs:documentation>A signature that leverages cryptography, typically public/private key pairs, which provides strong authenticity verification.</xs:documentation> 1521 </xs:annotation> 1522 </xs:enumeration> 1523 <xs:enumeration value="rfc-9116"> 1524 <xs:annotation> 1525 <xs:documentation>Document that complies with RFC-9116 (A File Format to Aid in Security Vulnerability Disclosure)</xs:documentation> 1526 </xs:annotation> 1527 </xs:enumeration> 1528 <xs:enumeration value="other"> 1529 <xs:annotation> 1530 <xs:documentation>Use this if no other types accurately describe the purpose of the external reference</xs:documentation> 1531 </xs:annotation> 1532 </xs:enumeration> 1533 </xs:restriction> 1534 </xs:simpleType> 1535 1536 <xs:complexType name="externalReferences"> 1537 <xs:annotation> 1538 <xs:documentation xml:lang="en"> 1539 External references provide a way to document systems, sites, and information that may be 1540 relevant, but are not included with the BOM. They may also establish specific relationships 1541 within or external to the BOM. 1542 </xs:documentation> 1543 </xs:annotation> 1544 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 1545 <xs:element name="reference" type="bom:externalReference"> 1546 <xs:annotation> 1547 <xs:documentation xml:lang="en">Zero or more external references can be defined</xs:documentation> 1548 </xs:annotation> 1549 </xs:element> 1550 </xs:sequence> 1551 </xs:complexType> 1552 1553 <xs:complexType name="externalReference"> 1554 <xs:sequence> 1555 <xs:element name="url" minOccurs="1" maxOccurs="1"> 1556 <xs:annotation> 1557 <xs:documentation xml:lang="en">The URI (URL or URN) to the external reference. External references 1558 are URIs and therefore can accept any URL scheme including https, mailto, tel, and dns. 1559 External references may also include formally registered URNs such as CycloneDX BOM-Link to 1560 reference CycloneDX BOMs or any object within a BOM. BOM-Link transforms applicable external 1561 references into relationships that can be expressed in a BOM or across BOMs. Refer to: 1562 https://cyclonedx.org/capabilities/bomlink/</xs:documentation> 1563 </xs:annotation> 1564 <xs:simpleType> 1565 <xs:union memberTypes="xs:anyURI bom:bomLinkType"/> 1566 </xs:simpleType> 1567 </xs:element> 1568 <xs:element name="comment" type="xs:string" minOccurs="0" maxOccurs="1"> 1569 <xs:annotation> 1570 <xs:documentation xml:lang="en">An optional comment describing the external reference</xs:documentation> 1571 </xs:annotation> 1572 </xs:element> 1573 <xs:element name="hashes" minOccurs="0" maxOccurs="1"> 1574 <xs:complexType> 1575 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 1576 <xs:element name="hash" type="bom:hashType"/> 1577 </xs:sequence> 1578 </xs:complexType> 1579 </xs:element> 1580 </xs:sequence> 1581 <xs:attribute name="type" type="bom:externalReferenceType" use="required"> 1582 <xs:annotation> 1583 <xs:documentation>Specifies the type of external reference. There are built-in types to describe common 1584 references. If a type does not exist for the reference being referred to, use the "other" type. 1585 </xs:documentation> 1586 </xs:annotation> 1587 </xs:attribute> 1588 <xs:anyAttribute namespace="##any" processContents="lax"> 1589 <xs:annotation> 1590 <xs:documentation>User-defined attributes may be used on this element as long as they 1591 do not have the same name as an existing attribute used by the schema.</xs:documentation> 1592 </xs:annotation> 1593 </xs:anyAttribute> 1594 </xs:complexType> 1595 1596 <xs:complexType name="commitsType"> 1597 <xs:annotation> 1598 <xs:documentation xml:lang="en">Zero or more commits can be specified.</xs:documentation> 1599 </xs:annotation> 1600 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 1601 <xs:element name="commit" type="bom:commitType"> 1602 <xs:annotation> 1603 <xs:documentation xml:lang="en">Specifies an individual commit.</xs:documentation> 1604 </xs:annotation> 1605 </xs:element> 1606 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1607 <xs:annotation> 1608 <xs:documentation> 1609 Allows any undeclared elements as long as the elements are placed in a different namespace. 1610 </xs:documentation> 1611 </xs:annotation> 1612 </xs:any> 1613 </xs:sequence> 1614 </xs:complexType> 1615 1616 <xs:complexType name="commitType"> 1617 <xs:sequence> 1618 <xs:element name="uid" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 1619 <xs:annotation> 1620 <xs:documentation xml:lang="en">A unique identifier of the commit. This may be version control 1621 specific. For example, Subversion uses revision numbers whereas git uses commit hashes. 1622 </xs:documentation> 1623 </xs:annotation> 1624 </xs:element> 1625 <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 1626 <xs:annotation> 1627 <xs:documentation xml:lang="en">The URL to the commit. This URL will typically point to a commit 1628 in a version control system. 1629 </xs:documentation> 1630 </xs:annotation> 1631 </xs:element> 1632 <xs:element name="author" type="bom:identifiableActionType" minOccurs="0" maxOccurs="1"> 1633 <xs:annotation> 1634 <xs:documentation xml:lang="en">The author who created the changes in the commit</xs:documentation> 1635 </xs:annotation> 1636 </xs:element> 1637 <xs:element name="committer" type="bom:identifiableActionType" minOccurs="0" maxOccurs="1"> 1638 <xs:annotation> 1639 <xs:documentation xml:lang="en">The person who committed or pushed the commit</xs:documentation> 1640 </xs:annotation> 1641 </xs:element> 1642 <xs:element name="message" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 1643 <xs:annotation> 1644 <xs:documentation xml:lang="en">The text description of the contents of the commit</xs:documentation> 1645 </xs:annotation> 1646 </xs:element> 1647 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1648 <xs:annotation> 1649 <xs:documentation> 1650 Allows any undeclared elements as long as the elements are placed in a different namespace. 1651 </xs:documentation> 1652 </xs:annotation> 1653 </xs:any> 1654 </xs:sequence> 1655 </xs:complexType> 1656 1657 <xs:complexType name="patchesType"> 1658 <xs:annotation> 1659 <xs:documentation xml:lang="en">Zero or more patches can be specified.</xs:documentation> 1660 </xs:annotation> 1661 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 1662 <xs:element name="patch" type="bom:patchType"> 1663 <xs:annotation> 1664 <xs:documentation xml:lang="en">Specifies an individual patch.</xs:documentation> 1665 </xs:annotation> 1666 </xs:element> 1667 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1668 <xs:annotation> 1669 <xs:documentation> 1670 Allows any undeclared elements as long as the elements are placed in a different namespace. 1671 </xs:documentation> 1672 </xs:annotation> 1673 </xs:any> 1674 </xs:sequence> 1675 </xs:complexType> 1676 1677 <xs:complexType name="patchType"> 1678 <xs:sequence> 1679 <xs:element name="diff" type="bom:diffType" minOccurs="0" maxOccurs="1"> 1680 <xs:annotation> 1681 <xs:documentation xml:lang="en">The patch file (or diff) that show changes. 1682 Refer to https://en.wikipedia.org/wiki/Diff</xs:documentation> 1683 </xs:annotation> 1684 </xs:element> 1685 <xs:element name="resolves" minOccurs="0" maxOccurs="1"> 1686 <xs:complexType> 1687 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 1688 <xs:element name="issue" type="bom:issueType"/> 1689 </xs:sequence> 1690 </xs:complexType> 1691 </xs:element> 1692 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1693 <xs:annotation> 1694 <xs:documentation> 1695 Allows any undeclared elements as long as the elements are placed in a different namespace. 1696 </xs:documentation> 1697 </xs:annotation> 1698 </xs:any> 1699 </xs:sequence> 1700 <xs:attribute name="type" type="bom:patchClassification" use="required"> 1701 <xs:annotation> 1702 <xs:documentation>Specifies the purpose for the patch including the resolution of defects, 1703 security issues, or new behavior or functionality</xs:documentation> 1704 </xs:annotation> 1705 </xs:attribute> 1706 </xs:complexType> 1707 1708 <xs:simpleType name="patchClassification"> 1709 <xs:restriction base="xs:string"> 1710 <xs:enumeration value="unofficial"> 1711 <xs:annotation> 1712 <xs:documentation>A patch which is not developed by the creators or maintainers of the software 1713 being patched. Refer to https://en.wikipedia.org/wiki/Unofficial_patch</xs:documentation> 1714 </xs:annotation> 1715 </xs:enumeration> 1716 <xs:enumeration value="monkey"> 1717 <xs:annotation> 1718 <xs:documentation>A patch which dynamically modifies runtime behavior. 1719 Refer to https://en.wikipedia.org/wiki/Monkey_patch</xs:documentation> 1720 </xs:annotation> 1721 </xs:enumeration> 1722 <xs:enumeration value="backport"> 1723 <xs:annotation> 1724 <xs:documentation>A patch which takes code from a newer version of software and applies 1725 it to older versions of the same software. Refer to https://en.wikipedia.org/wiki/Backporting</xs:documentation> 1726 </xs:annotation> 1727 </xs:enumeration> 1728 <xs:enumeration value="cherry-pick"> 1729 <xs:annotation> 1730 <xs:documentation>A patch created by selectively applying commits from other versions or 1731 branches of the same software.</xs:documentation> 1732 </xs:annotation> 1733 </xs:enumeration> 1734 </xs:restriction> 1735 </xs:simpleType> 1736 1737 <xs:simpleType name="issueClassification"> 1738 <xs:restriction base="xs:string"> 1739 <xs:enumeration value="defect"> 1740 <xs:annotation> 1741 <xs:documentation>A fault, flaw, or bug in software</xs:documentation> 1742 </xs:annotation> 1743 </xs:enumeration> 1744 <xs:enumeration value="enhancement"> 1745 <xs:annotation> 1746 <xs:documentation>A new feature or behavior in software</xs:documentation> 1747 </xs:annotation> 1748 </xs:enumeration> 1749 <xs:enumeration value="security"> 1750 <xs:annotation> 1751 <xs:documentation>A special type of defect which impacts security</xs:documentation> 1752 </xs:annotation> 1753 </xs:enumeration> 1754 </xs:restriction> 1755 </xs:simpleType> 1756 1757 <xs:complexType name="diffType"> 1758 <xs:sequence> 1759 <xs:element name="text" type="bom:attachedTextType" minOccurs="0" maxOccurs="1"> 1760 <xs:annotation> 1761 <xs:documentation xml:lang="en">Specifies the optional text of the diff</xs:documentation> 1762 </xs:annotation> 1763 </xs:element> 1764 <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 1765 <xs:annotation> 1766 <xs:documentation xml:lang="en">Specifies the URL to the diff</xs:documentation> 1767 </xs:annotation> 1768 </xs:element> 1769 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1770 <xs:annotation> 1771 <xs:documentation> 1772 Allows any undeclared elements as long as the elements are placed in a different namespace. 1773 </xs:documentation> 1774 </xs:annotation> 1775 </xs:any> 1776 </xs:sequence> 1777 </xs:complexType> 1778 1779 <xs:complexType name="issueType"> 1780 <xs:annotation> 1781 <xs:documentation> 1782 An individual issue that has been resolved. 1783 </xs:documentation> 1784 </xs:annotation> 1785 <xs:sequence> 1786 <xs:element name="id" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 1787 <xs:annotation> 1788 <xs:documentation xml:lang="en">The identifier of the issue assigned by the source of the issue</xs:documentation> 1789 </xs:annotation> 1790 </xs:element> 1791 <xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 1792 <xs:annotation> 1793 <xs:documentation xml:lang="en">The name of the issue</xs:documentation> 1794 </xs:annotation> 1795 </xs:element> 1796 <xs:element name="description" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 1797 <xs:annotation> 1798 <xs:documentation xml:lang="en">A description of the issue</xs:documentation> 1799 </xs:annotation> 1800 </xs:element> 1801 <xs:element name="source" minOccurs="0" maxOccurs="1"> 1802 <xs:complexType> 1803 <xs:annotation> 1804 <xs:documentation xml:lang="en"> 1805 The source of the issue where it is documented. 1806 </xs:documentation> 1807 </xs:annotation> 1808 <xs:sequence> 1809 <xs:element name="name" minOccurs="0" type="xs:normalizedString" maxOccurs="1"> 1810 <xs:annotation> 1811 <xs:documentation xml:lang="en"> 1812 The name of the source. For example "National Vulnerability Database", 1813 "NVD", and "Apache" 1814 </xs:documentation> 1815 </xs:annotation> 1816 </xs:element> 1817 <xs:element name="url" minOccurs="0" type="xs:anyURI" maxOccurs="1"> 1818 <xs:annotation> 1819 <xs:documentation xml:lang="en"> 1820 The url of the issue documentation as provided by the source 1821 </xs:documentation> 1822 </xs:annotation> 1823 </xs:element> 1824 </xs:sequence> 1825 </xs:complexType> 1826 </xs:element> 1827 <xs:element name="references" minOccurs="0" maxOccurs="1"> 1828 <xs:complexType> 1829 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 1830 <xs:element name="url" type="xs:anyURI"/> 1831 </xs:sequence> 1832 </xs:complexType> 1833 </xs:element> 1834 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1835 <xs:annotation> 1836 <xs:documentation> 1837 Allows any undeclared elements as long as the elements are placed in a different namespace. 1838 </xs:documentation> 1839 </xs:annotation> 1840 </xs:any> 1841 </xs:sequence> 1842 <xs:attribute name="type" type="bom:issueClassification" use="required"> 1843 <xs:annotation> 1844 <xs:documentation>Specifies the type of issue</xs:documentation> 1845 </xs:annotation> 1846 </xs:attribute> 1847 </xs:complexType> 1848 1849 <xs:complexType name="identifiableActionType"> 1850 <xs:sequence> 1851 <xs:element name="timestamp" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 1852 <xs:annotation> 1853 <xs:documentation xml:lang="en">The timestamp in which the action occurred</xs:documentation> 1854 </xs:annotation> 1855 </xs:element> 1856 <xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 1857 <xs:annotation> 1858 <xs:documentation xml:lang="en">The name of the individual who performed the action</xs:documentation> 1859 </xs:annotation> 1860 </xs:element> 1861 <xs:element name="email" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 1862 <xs:annotation> 1863 <xs:documentation xml:lang="en">The email address of the individual who performed the action</xs:documentation> 1864 </xs:annotation> 1865 </xs:element> 1866 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1867 <xs:annotation> 1868 <xs:documentation> 1869 Allows any undeclared elements as long as the elements are placed in a different namespace. 1870 </xs:documentation> 1871 </xs:annotation> 1872 </xs:any> 1873 </xs:sequence> 1874 </xs:complexType> 1875 1876 <xs:complexType name="pedigreeType"> 1877 <xs:annotation> 1878 <xs:documentation xml:lang="en"> 1879 Component pedigree is a way to document complex supply chain scenarios where components are created, 1880 distributed, modified, redistributed, combined with other components, etc. Pedigree supports viewing 1881 this complex chain from the beginning, the end, or anywhere in the middle. It also provides a way to 1882 document variants where the exact relation may not be known. 1883 </xs:documentation> 1884 </xs:annotation> 1885 <xs:sequence> 1886 <xs:element name="ancestors" type="bom:componentsType" minOccurs="0" maxOccurs="1"> 1887 <xs:annotation> 1888 <xs:documentation xml:lang="en">Describes zero or more components in which a component is derived 1889 from. This is commonly used to describe forks from existing projects where the forked version 1890 contains a ancestor node containing the original component it was forked from. For example, 1891 Component A is the original component. Component B is the component being used and documented 1892 in the BOM. However, Component B contains a pedigree node with a single ancestor documenting 1893 Component A - the original component from which Component B is derived from. 1894 </xs:documentation> 1895 </xs:annotation> 1896 </xs:element> 1897 <xs:element name="descendants" type="bom:componentsType" minOccurs="0" maxOccurs="1"> 1898 <xs:annotation> 1899 <xs:documentation xml:lang="en">Descendants are the exact opposite of ancestors. This provides a 1900 way to document all forks (and their forks) of an original or root component. 1901 </xs:documentation> 1902 </xs:annotation> 1903 </xs:element> 1904 <xs:element name="variants" type="bom:componentsType" minOccurs="0" maxOccurs="1"> 1905 <xs:annotation> 1906 <xs:documentation xml:lang="en">Variants describe relations where the relationship between the 1907 components are not known. For example, if Component A contains nearly identical code to 1908 Component B. They are both related, but it is unclear if one is derived from the other, 1909 or if they share a common ancestor. 1910 </xs:documentation> 1911 </xs:annotation> 1912 </xs:element> 1913 <xs:element name="commits" type="bom:commitsType" minOccurs="0" maxOccurs="1"> 1914 <xs:annotation> 1915 <xs:documentation xml:lang="en">A list of zero or more commits which provide a trail describing 1916 how the component deviates from an ancestor, descendant, or variant.</xs:documentation> 1917 </xs:annotation> 1918 </xs:element> 1919 <xs:element name="patches" type="bom:patchesType" minOccurs="0" maxOccurs="1"> 1920 <xs:annotation> 1921 <xs:documentation xml:lang="en">A list of zero or more patches describing how the component 1922 deviates from an ancestor, descendant, or variant. Patches may be complementary to commits 1923 or may be used in place of commits.</xs:documentation> 1924 </xs:annotation> 1925 </xs:element> 1926 <xs:element name="notes" type="xs:string" minOccurs="0" maxOccurs="1"> 1927 <xs:annotation> 1928 <xs:documentation xml:lang="en">Notes, observations, and other non-structured commentary 1929 describing the components pedigree. 1930 </xs:documentation> 1931 </xs:annotation> 1932 </xs:element> 1933 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1934 <xs:annotation> 1935 <xs:documentation> 1936 Allows any undeclared elements as long as the elements are placed in a different namespace. 1937 </xs:documentation> 1938 </xs:annotation> 1939 </xs:any> 1940 </xs:sequence> 1941 </xs:complexType> 1942 1943 <xs:complexType name="dependencyType"> 1944 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 1945 <xs:element name="dependency" type="bom:dependencyType" minOccurs="0"> 1946 <xs:annotation> 1947 <xs:documentation>The component or service that is a dependency of this dependency object.</xs:documentation> 1948 </xs:annotation> 1949 </xs:element> 1950 <xs:element name="provides" minOccurs="0"> 1951 <xs:annotation> 1952 <xs:documentation> 1953 The component or service that define a given specification or standard, which is provided or implemented by this dependency object. 1954 For example, a cryptographic library which implements a cryptographic algorithm. A component which implements another component does not imply that the implementation is in use. 1955 </xs:documentation> 1956 </xs:annotation> 1957 <xs:complexType> 1958 <xs:attribute name="ref" type="bom:refLinkType" use="required"> 1959 <xs:annotation> 1960 <xs:documentation>References a component or service by its bom-ref attribute</xs:documentation> 1961 </xs:annotation> 1962 </xs:attribute> 1963 </xs:complexType> 1964 </xs:element> 1965 </xs:sequence> 1966 <xs:attribute name="ref" type="bom:refLinkType" use="required"> 1967 <xs:annotation> 1968 <xs:documentation>References a component or service by its bom-ref attribute</xs:documentation> 1969 </xs:annotation> 1970 </xs:attribute> 1971 <xs:anyAttribute namespace="##other" processContents="lax"> 1972 <xs:annotation> 1973 <xs:documentation>User-defined attributes may be used on this element as long as they 1974 do not have the same name as an existing attribute used by the schema.</xs:documentation> 1975 </xs:annotation> 1976 </xs:anyAttribute> 1977 </xs:complexType> 1978 1979 <xs:complexType name="dependenciesType"> 1980 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 1981 <xs:element name="dependency" type="bom:dependencyType"> 1982 <xs:annotation> 1983 <xs:documentation>Defines the direct dependencies of a component or service. Components or services 1984 that do not have their own dependencies MUST be declared as empty elements within the graph. 1985 Components or services that are not represented in the dependency graph MAY have unknown 1986 dependencies. It is RECOMMENDED that implementations assume this to be opaque and not an 1987 indicator of a object being dependency-free. It is RECOMMENDED to leverage compositions to 1988 indicate unknown dependency graphs.</xs:documentation> 1989 </xs:annotation> 1990 </xs:element> 1991 </xs:sequence> 1992 </xs:complexType> 1993 1994 <xs:complexType name="servicesType"> 1995 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 1996 <xs:element name="service" type="bom:service"/> 1997 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 1998 <xs:annotation> 1999 <xs:documentation> 2000 Allows any undeclared elements as long as the elements are placed in a different namespace. 2001 </xs:documentation> 2002 </xs:annotation> 2003 </xs:any> 2004 </xs:sequence> 2005 <xs:anyAttribute namespace="##any" processContents="lax"> 2006 <xs:annotation> 2007 <xs:documentation>User-defined attributes may be used on this element as long as they 2008 do not have the same name as an existing attribute used by the schema.</xs:documentation> 2009 </xs:annotation> 2010 </xs:anyAttribute> 2011 </xs:complexType> 2012 2013 <xs:complexType name="service"> 2014 <xs:sequence> 2015 <xs:element name="provider" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 2016 <xs:annotation> 2017 <xs:documentation>The organization that provides the service.</xs:documentation> 2018 </xs:annotation> 2019 </xs:element> 2020 <xs:element name="group" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 2021 <xs:annotation> 2022 <xs:documentation>The grouping name, namespace, or identifier. This will often be a shortened, 2023 single name of the company or project that produced the service or domain name. 2024 Whitespace and special characters should be avoided.</xs:documentation> 2025 </xs:annotation> 2026 </xs:element> 2027 <xs:element name="name" type="xs:normalizedString" minOccurs="1" maxOccurs="1"> 2028 <xs:annotation> 2029 <xs:documentation>The name of the service. This will often be a shortened, single name 2030 of the service.</xs:documentation> 2031 </xs:annotation> 2032 </xs:element> 2033 <xs:element name="version" type="bom:versionType" minOccurs="0" maxOccurs="1"> 2034 <xs:annotation> 2035 <xs:documentation>The service version.</xs:documentation> 2036 </xs:annotation> 2037 </xs:element> 2038 <xs:element name="description" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 2039 <xs:annotation> 2040 <xs:documentation>Specifies a description for the service.</xs:documentation> 2041 </xs:annotation> 2042 </xs:element> 2043 <xs:element name="endpoints" minOccurs="0" maxOccurs="1"> 2044 <xs:complexType> 2045 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2046 <xs:element name="endpoint" type="xs:anyURI" minOccurs="1"> 2047 <xs:annotation> 2048 <xs:documentation>A service endpoint URI.</xs:documentation> 2049 </xs:annotation> 2050 </xs:element> 2051 </xs:sequence> 2052 </xs:complexType> 2053 </xs:element> 2054 <xs:element name="authenticated" type="xs:boolean" minOccurs="0" maxOccurs="1"> 2055 <xs:annotation> 2056 <xs:documentation>A boolean value indicating if the service requires authentication. 2057 A value of true indicates the service requires authentication prior to use. 2058 A value of false indicates the service does not require authentication.</xs:documentation> 2059 </xs:annotation> 2060 </xs:element> 2061 <xs:element name="x-trust-boundary" type="xs:boolean" minOccurs="0" maxOccurs="1"> 2062 <xs:annotation> 2063 <xs:documentation>A boolean value indicating if use of the service crosses a trust zone or boundary. 2064 A value of true indicates that by using the service, a trust boundary is crossed. 2065 A value of false indicates that by using the service, a trust boundary is not crossed.</xs:documentation> 2066 </xs:annotation> 2067 </xs:element> 2068 <xs:element name="trustZone" type="xs:string" minOccurs="0" maxOccurs="1"> 2069 <xs:annotation> 2070 <xs:documentation>The name of the trust zone the service resides in.</xs:documentation> 2071 </xs:annotation> 2072 </xs:element> 2073 <xs:element name="data" minOccurs="0" maxOccurs="1"> 2074 <xs:complexType> 2075 <xs:choice> 2076 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2077 <xs:element name="classification" type="bom:dataClassificationType"> 2078 <xs:annotation> 2079 <xs:documentation>DEPRECATED: Specifies the data classification. THIS FIELD IS DEPRECATED AS OF v1.5. Use dataflow\classification instead</xs:documentation> 2080 </xs:annotation> 2081 </xs:element> 2082 </xs:sequence> 2083 <xs:element name="dataflow" minOccurs="0" maxOccurs="unbounded"> 2084 <xs:annotation> 2085 <xs:documentation>Specifies the data classification.</xs:documentation> 2086 </xs:annotation> 2087 <xs:complexType> 2088 <xs:sequence> 2089 <xs:element name="classification" type="bom:dataClassificationType" minOccurs="0" maxOccurs="1"> 2090 <xs:annotation> 2091 <xs:documentation>Specifies the data classification.</xs:documentation> 2092 </xs:annotation> 2093 </xs:element> 2094 <xs:element name="governance" type="bom:dataGovernance" minOccurs="0" maxOccurs="1" /> 2095 <xs:element name="source" minOccurs="0" maxOccurs="1"> 2096 <xs:annotation> 2097 <xs:documentation>The URI, URL, or BOM-Link of the components or services the data came in from.</xs:documentation> 2098 </xs:annotation> 2099 <xs:complexType> 2100 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2101 <xs:element name="url"> 2102 <xs:simpleType> 2103 <xs:union memberTypes="xs:anyURI bom:bomLinkElementType"/> 2104 </xs:simpleType> 2105 </xs:element> 2106 </xs:sequence> 2107 </xs:complexType> 2108 </xs:element> 2109 <xs:element name="destination" minOccurs="0" maxOccurs="1"> 2110 <xs:annotation> 2111 <xs:documentation>The URI, URL, or BOM-Link of the components or services the data is sent to.</xs:documentation> 2112 </xs:annotation> 2113 <xs:complexType> 2114 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2115 <xs:element name="url"> 2116 <xs:simpleType> 2117 <xs:union memberTypes="xs:anyURI bom:bomLinkElementType"/> 2118 </xs:simpleType> 2119 </xs:element> 2120 </xs:sequence> 2121 </xs:complexType> 2122 </xs:element> 2123 </xs:sequence> 2124 <xs:attribute name="name" type="xs:string" use="optional"> 2125 <xs:annotation> 2126 <xs:documentation> 2127 Name for the defined data. 2128 </xs:documentation> 2129 </xs:annotation> 2130 </xs:attribute> 2131 <xs:attribute name="description" type="xs:string" use="optional"> 2132 <xs:annotation> 2133 <xs:documentation> 2134 Short description of the data content and usage. 2135 </xs:documentation> 2136 </xs:annotation> 2137 </xs:attribute> 2138 <xs:anyAttribute namespace="##any" processContents="lax"> 2139 <xs:annotation> 2140 <xs:documentation>User-defined attributes may be used on this element as long as they 2141 do not have the same name as an existing attribute used by the schema.</xs:documentation> 2142 </xs:annotation> 2143 </xs:anyAttribute> 2144 </xs:complexType> 2145 </xs:element> 2146 </xs:choice> 2147 </xs:complexType> 2148 </xs:element> 2149 <xs:element name="licenses" type="bom:licenseChoiceType" minOccurs="0" maxOccurs="1"/> 2150 <xs:element name="externalReferences" type="bom:externalReferences" minOccurs="0" maxOccurs="1"> 2151 <xs:annotation> 2152 <xs:documentation>Provides the ability to document external references related to the service.</xs:documentation> 2153 </xs:annotation> 2154 </xs:element> 2155 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 2156 <xs:annotation> 2157 <xs:documentation>Provides the ability to document properties in a name/value store. 2158 This provides flexibility to include data not officially supported in the standard 2159 without having to use additional namespaces or create extensions. Property names 2160 of interest to the general public are encouraged to be registered in the 2161 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 2162 Formal registration is OPTIONAL.</xs:documentation> 2163 </xs:annotation> 2164 </xs:element> 2165 <xs:element name="services" minOccurs="0" maxOccurs="1"> 2166 <xs:annotation> 2167 <xs:documentation> 2168 A list of services included or deployed behind the parent service. This is not a dependency 2169 tree. It provides a way to specify a hierarchical representation of service assemblies. 2170 </xs:documentation> 2171 </xs:annotation> 2172 <xs:complexType> 2173 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2174 <xs:element name="service" type="bom:service"/> 2175 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 2176 <xs:annotation> 2177 <xs:documentation> 2178 Allows any undeclared elements as long as the elements are placed in a different namespace. 2179 </xs:documentation> 2180 </xs:annotation> 2181 </xs:any> 2182 </xs:sequence> 2183 </xs:complexType> 2184 </xs:element> 2185 <xs:element name="releaseNotes" type="bom:releaseNotesType" minOccurs="0" maxOccurs="1"> 2186 <xs:annotation> 2187 <xs:documentation>Specifies optional release notes.</xs:documentation> 2188 </xs:annotation> 2189 </xs:element> 2190 <xs:element name="tags" type="bom:tagsType" minOccurs="0" maxOccurs="1" /> 2191 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 2192 <xs:annotation> 2193 <xs:documentation> 2194 Allows any undeclared elements as long as the elements are placed in a different namespace. 2195 </xs:documentation> 2196 </xs:annotation> 2197 </xs:any> 2198 </xs:sequence> 2199 <xs:attribute name="bom-ref" type="bom:refType"> 2200 <xs:annotation> 2201 <xs:documentation> 2202 An optional identifier which can be used to reference the service elsewhere in the BOM. 2203 Uniqueness is enforced within all elements and children of the root-level bom element. 2204 </xs:documentation> 2205 </xs:annotation> 2206 </xs:attribute> 2207 <xs:anyAttribute namespace="##any" processContents="lax"> 2208 <xs:annotation> 2209 <xs:documentation>User-defined attributes may be used on this element as long as they 2210 do not have the same name as an existing attribute used by the schema.</xs:documentation> 2211 </xs:annotation> 2212 </xs:anyAttribute> 2213 </xs:complexType> 2214 2215 <xs:complexType name="dataClassificationType"> 2216 <xs:annotation> 2217 <xs:documentation>Specifies the data classification.</xs:documentation> 2218 </xs:annotation> 2219 <xs:simpleContent> 2220 <xs:extension base="xs:normalizedString"> 2221 <xs:attribute name="flow" type="bom:dataFlowType" use="required"> 2222 <xs:annotation> 2223 <xs:documentation>Specifies the flow direction of the data.</xs:documentation> 2224 </xs:annotation> 2225 </xs:attribute> 2226 </xs:extension> 2227 </xs:simpleContent> 2228 </xs:complexType> 2229 2230 <xs:simpleType name="dataFlowType"> 2231 <xs:annotation> 2232 <xs:documentation>Specifies the flow direction of the data. Valid values are: 2233 inbound, outbound, bi-directional, and unknown. Direction is relative to the service. 2234 Inbound flow states that data enters the service. Outbound flow states that data 2235 leaves the service. Bi-directional states that data flows both ways, and unknown 2236 states that the direction is not known.</xs:documentation> 2237 </xs:annotation> 2238 <xs:restriction base="xs:string"> 2239 <xs:enumeration value="inbound"/> 2240 <xs:enumeration value="outbound"/> 2241 <xs:enumeration value="bi-directional"/> 2242 <xs:enumeration value="unknown"/> 2243 </xs:restriction> 2244 </xs:simpleType> 2245 2246 <xs:complexType name="licenseChoiceType"> 2247 <xs:choice> 2248 <xs:element name="license" type="bom:licenseType" minOccurs="0" maxOccurs="unbounded"/> 2249 <xs:element name="expression" minOccurs="0" maxOccurs="1"> 2250 <xs:annotation> 2251 <xs:documentation>A valid SPDX license expression. 2252 Refer to https://spdx.org/specifications for syntax requirements 2253 2254 Example values: 2255 - Apache-2.0 AND (MIT OR GPL-2.0-only) 2256 - GPL-3.0-only WITH Classpath-exception-2.0 2257 </xs:documentation> 2258 </xs:annotation> 2259 <xs:complexType> 2260 <xs:simpleContent> 2261 <xs:extension base="xs:normalizedString"> 2262 <xs:attribute name="bom-ref" type="bom:refType"> 2263 <xs:annotation> 2264 <xs:documentation> 2265 An optional identifier which can be used to reference the license elsewhere in the BOM. 2266 Uniqueness is enforced within all elements and children of the root-level bom element. 2267 </xs:documentation> 2268 </xs:annotation> 2269 </xs:attribute> 2270 <xs:attribute name="acknowledgement" type="bom:licenseAcknowledgementEnumerationType"> 2271 <xs:annotation> 2272 <xs:documentation> 2273 Declared licenses and concluded licenses represent two different stages in the 2274 licensing process within software development. Declared licenses refer to the 2275 initial intention of the software authors regarding the licensing terms under 2276 which their code is released. On the other hand, concluded licenses are the 2277 result of a comprehensive analysis of the project's codebase to identify and 2278 confirm the actual licenses of the components used, which may differ from the 2279 initially declared licenses. While declared licenses provide an upfront indication 2280 of the licensing intentions, concluded licenses offer a more thorough understanding 2281 of the actual licensing within a project, facilitating proper compliance and risk 2282 management. Observed licenses are defined in `evidence.licenses`. Observed licenses 2283 form the evidence necessary to substantiate a concluded license. 2284 </xs:documentation> 2285 </xs:annotation> 2286 </xs:attribute> 2287 </xs:extension> 2288 </xs:simpleContent> 2289 </xs:complexType> 2290 </xs:element> 2291 </xs:choice> 2292 </xs:complexType> 2293 2294 <xs:simpleType name="licenseAcknowledgementEnumerationType"> 2295 <xs:restriction base="xs:string"> 2296 <xs:enumeration value="declared"> 2297 <xs:annotation> 2298 <xs:documentation> 2299 Declared licenses represent the initial intentions of authors regarding 2300 the licensing terms of their code. 2301 </xs:documentation> 2302 </xs:annotation> 2303 </xs:enumeration> 2304 <xs:enumeration value="concluded"> 2305 <xs:annotation> 2306 <xs:documentation> 2307 Concluded licenses are verified and confirmed. 2308 </xs:documentation> 2309 </xs:annotation> 2310 </xs:enumeration> 2311 </xs:restriction> 2312 </xs:simpleType> 2313 2314 <xs:complexType name="copyrightsType"> 2315 <xs:sequence> 2316 <xs:element name="text" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> 2317 </xs:sequence> 2318 </xs:complexType> 2319 2320 <xs:simpleType name="identityFieldType"> 2321 <xs:restriction base="xs:string"> 2322 <xs:enumeration value="group"/> 2323 <xs:enumeration value="name"/> 2324 <xs:enumeration value="version"/> 2325 <xs:enumeration value="purl"/> 2326 <xs:enumeration value="cpe"/> 2327 <xs:enumeration value="omniborId"/> 2328 <xs:enumeration value="swhid"/> 2329 <xs:enumeration value="swid"/> 2330 <xs:enumeration value="hash"/> 2331 </xs:restriction> 2332 </xs:simpleType> 2333 2334 <xs:simpleType name="decimalPercentType"> 2335 <xs:restriction base="xs:decimal"> 2336 <xs:minInclusive value="0"/> 2337 <xs:maxInclusive value="1"/> 2338 </xs:restriction> 2339 </xs:simpleType> 2340 2341 <xs:simpleType name="evidenceTechnique"> 2342 <xs:restriction base="xs:string"> 2343 <xs:enumeration value="source-code-analysis"> 2344 <xs:annotation> 2345 <xs:documentation> 2346 Examines the source code without executing it. 2347 </xs:documentation> 2348 </xs:annotation> 2349 </xs:enumeration> 2350 <xs:enumeration value="binary-analysis"> 2351 <xs:annotation> 2352 <xs:documentation> 2353 Examines a compiled binary through reverse engineering, typically via disassembly or bytecode reversal. 2354 </xs:documentation> 2355 </xs:annotation> 2356 </xs:enumeration> 2357 <xs:enumeration value="manifest-analysis"> 2358 <xs:annotation> 2359 <xs:documentation> 2360 Examines a package management system such as those used for building software or installing software. 2361 </xs:documentation> 2362 </xs:annotation> 2363 </xs:enumeration> 2364 <xs:enumeration value="ast-fingerprint"> 2365 <xs:annotation> 2366 <xs:documentation> 2367 Examines the Abstract Syntax Tree (AST) of source code or a compiled binary. 2368 </xs:documentation> 2369 </xs:annotation> 2370 </xs:enumeration> 2371 <xs:enumeration value="hash-comparison"> 2372 <xs:annotation> 2373 <xs:documentation> 2374 Evaluates the cryptographic hash of a component against a set of pre-computed hashes of identified software. 2375 </xs:documentation> 2376 </xs:annotation> 2377 </xs:enumeration> 2378 <xs:enumeration value="instrumentation"> 2379 <xs:annotation> 2380 <xs:documentation> 2381 Examines the call stack of running applications by intercepting and monitoring application logic without the need to modify the application. 2382 </xs:documentation> 2383 </xs:annotation> 2384 </xs:enumeration> 2385 <xs:enumeration value="dynamic-analysis"> 2386 <xs:annotation> 2387 <xs:documentation> 2388 Evaluates a running application. 2389 </xs:documentation> 2390 </xs:annotation> 2391 </xs:enumeration> 2392 <xs:enumeration value="filename"> 2393 <xs:annotation> 2394 <xs:documentation> 2395 Evaluates file name of a component against a set of known file names of identified software. 2396 </xs:documentation> 2397 </xs:annotation> 2398 </xs:enumeration> 2399 <xs:enumeration value="attestation"> 2400 <xs:annotation> 2401 <xs:documentation> 2402 A testimony to the accuracy of the identify of a component made by an individual or entity. 2403 </xs:documentation> 2404 </xs:annotation> 2405 </xs:enumeration> 2406 <xs:enumeration value="other"> 2407 <xs:annotation> 2408 <xs:documentation> 2409 Any other technique. 2410 </xs:documentation> 2411 </xs:annotation> 2412 </xs:enumeration> 2413 </xs:restriction> 2414 </xs:simpleType> 2415 2416 <xs:complexType name="componentEvidenceType"> 2417 <xs:sequence> 2418 <xs:element name="identity" minOccurs="0" maxOccurs="unbounded"> 2419 <xs:annotation> 2420 <xs:documentation>Evidence that substantiates the identity of a component. The identify may be an 2421 object or an array of identity objects. Support for specifying identity as a single object was 2422 introduced in CycloneDX v1.5. "unbounded" was introduced in v1.6. It is RECOMMENDED that all 2423 implementations are aware of "unbounded".</xs:documentation> 2424 </xs:annotation> 2425 <xs:complexType> 2426 <xs:sequence> 2427 <xs:element name="field" type="bom:identityFieldType" minOccurs="1" maxOccurs="1"> 2428 <xs:annotation> 2429 <xs:documentation>The identity field of the component which the evidence describes.</xs:documentation> 2430 </xs:annotation> 2431 </xs:element> 2432 <xs:element name="confidence" type="bom:decimalPercentType" minOccurs="0" maxOccurs="1"> 2433 <xs:annotation> 2434 <xs:documentation>The overall confidence of the evidence from 0 - 1, where 1 is 100% confidence.</xs:documentation> 2435 </xs:annotation> 2436 </xs:element> 2437 <xs:element name="concludedValue" type="xs:string" minOccurs="0" maxOccurs="1"> 2438 <xs:annotation> 2439 <xs:documentation>The value of the field (cpe, purl, etc) that has been concluded based on the aggregate of all methods (if available).</xs:documentation> 2440 </xs:annotation> 2441 </xs:element> 2442 <xs:element name="methods" minOccurs="0" maxOccurs="1"> 2443 <xs:annotation> 2444 <xs:documentation>The methods used to extract and/or analyze the evidence.</xs:documentation> 2445 </xs:annotation> 2446 <xs:complexType> 2447 <xs:sequence> 2448 <xs:element name="method" minOccurs="0" maxOccurs="unbounded"> 2449 <xs:complexType> 2450 <xs:sequence> 2451 <xs:element name="technique" type="bom:evidenceTechnique" minOccurs="1" maxOccurs="1"> 2452 <xs:annotation> 2453 <xs:documentation>The technique used in this method of analysis.</xs:documentation> 2454 </xs:annotation> 2455 </xs:element> 2456 <xs:element name="confidence" type="bom:decimalPercentType" minOccurs="1" maxOccurs="1"> 2457 <xs:annotation> 2458 <xs:documentation>The confidence of the evidence from 0 - 1, where 1 is 100% confidence. Confidence is specific to the technique used. Each technique of analysis can have independent confidence.</xs:documentation> 2459 </xs:annotation> 2460 </xs:element> 2461 <xs:element name="value" type="xs:string" minOccurs="0" maxOccurs="1"> 2462 <xs:annotation> 2463 <xs:documentation>The value or contents of the evidence.</xs:documentation> 2464 </xs:annotation> 2465 </xs:element> 2466 </xs:sequence> 2467 </xs:complexType> 2468 </xs:element> 2469 </xs:sequence> 2470 </xs:complexType> 2471 </xs:element> 2472 <xs:element name="tools" minOccurs="0" maxOccurs="1"> 2473 <xs:annotation> 2474 <xs:documentation> 2475 The object in the BOM identified by its bom-ref. This is often a component or service, 2476 but may be any object type supporting bom-refs. Tools used for analysis should already 2477 be defined in the BOM, either in the metadata/tools, components, or formulation. 2478 </xs:documentation> 2479 </xs:annotation> 2480 <xs:complexType> 2481 <xs:sequence> 2482 <xs:element name="tool" type="bom:bomReferenceType" minOccurs="0" maxOccurs="unbounded"/> 2483 </xs:sequence> 2484 </xs:complexType> 2485 </xs:element> 2486 </xs:sequence> 2487 </xs:complexType> 2488 </xs:element> 2489 <xs:element name="occurrences" minOccurs="0" maxOccurs="1"> 2490 <xs:annotation> 2491 <xs:documentation>Evidence of individual instances of a component spread across multiple locations.</xs:documentation> 2492 </xs:annotation> 2493 <xs:complexType> 2494 <xs:sequence> 2495 <xs:element name="occurrence" minOccurs="0" maxOccurs="unbounded"> 2496 <xs:complexType> 2497 <xs:sequence> 2498 <xs:element name="location" type="xs:string" minOccurs="1" maxOccurs="1"> 2499 <xs:annotation> 2500 <xs:documentation>The location or path to where the component was found.</xs:documentation> 2501 </xs:annotation> 2502 </xs:element> 2503 <xs:element name="line" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1"> 2504 <xs:annotation> 2505 <xs:documentation>The line number where the component was found.</xs:documentation> 2506 </xs:annotation> 2507 </xs:element> 2508 <xs:element name="offset" type="xs:nonNegativeInteger" minOccurs="0" maxOccurs="1"> 2509 <xs:annotation> 2510 <xs:documentation>The offset where the component was found.</xs:documentation> 2511 </xs:annotation> 2512 </xs:element> 2513 <xs:element name="symbol" type="xs:string" minOccurs="0" maxOccurs="1"> 2514 <xs:annotation> 2515 <xs:documentation>The symbol name that was found associated with the component.</xs:documentation> 2516 </xs:annotation> 2517 </xs:element> 2518 <xs:element name="additionalContext" type="xs:string" minOccurs="0" maxOccurs="1"> 2519 <xs:annotation> 2520 <xs:documentation>Any additional context of the detected component (e.g. a code snippet).</xs:documentation> 2521 </xs:annotation> 2522 </xs:element> 2523 2524 </xs:sequence> 2525 <xs:attribute name="bom-ref" type="bom:refType"> 2526 <xs:annotation> 2527 <xs:documentation> 2528 An optional identifier which can be used to reference the occurrence elsewhere 2529 in the BOM. Every bom-ref MUST be unique within the BOM. 2530 </xs:documentation> 2531 </xs:annotation> 2532 </xs:attribute> 2533 </xs:complexType> 2534 </xs:element> 2535 </xs:sequence> 2536 </xs:complexType> 2537 </xs:element> 2538 <xs:element name="callstack" minOccurs="0" maxOccurs="1"> 2539 <xs:annotation> 2540 <xs:documentation>Evidence of the components use through the callstack.</xs:documentation> 2541 </xs:annotation> 2542 <xs:complexType> 2543 <xs:sequence> 2544 <xs:element name="frames" minOccurs="0" maxOccurs="1"> 2545 <xs:complexType> 2546 <xs:sequence> 2547 <xs:element name="frame" minOccurs="0" maxOccurs="unbounded"> 2548 <xs:complexType> 2549 <xs:sequence> 2550 <xs:element name="package" type="xs:string" minOccurs="0" maxOccurs="1"> 2551 <xs:annotation> 2552 <xs:documentation>A package organizes modules into namespaces, providing a unique namespace for each type it contains.</xs:documentation> 2553 </xs:annotation> 2554 </xs:element> 2555 <xs:element name="module" type="xs:string" minOccurs="1" maxOccurs="1"> 2556 <xs:annotation> 2557 <xs:documentation>A module or class that encloses functions/methods and other code.</xs:documentation> 2558 </xs:annotation> 2559 </xs:element> 2560 <xs:element name="function" type="xs:string" minOccurs="0" maxOccurs="1"> 2561 <xs:annotation> 2562 <xs:documentation>A block of code designed to perform a particular task.</xs:documentation> 2563 </xs:annotation> 2564 </xs:element> 2565 <xs:element name="parameters" minOccurs="0" maxOccurs="1"> 2566 <xs:annotation> 2567 <xs:documentation>Optional arguments that are passed to the module or function.</xs:documentation> 2568 </xs:annotation> 2569 <xs:complexType> 2570 <xs:sequence> 2571 <xs:element name="parameter" type="xs:string" minOccurs="0" maxOccurs="unbounded"/> 2572 </xs:sequence> 2573 </xs:complexType> 2574 </xs:element> 2575 <xs:element name="line" type="xs:integer" minOccurs="0" maxOccurs="1"> 2576 <xs:annotation> 2577 <xs:documentation>The line number the code that is called resides on.</xs:documentation> 2578 </xs:annotation> 2579 </xs:element> 2580 <xs:element name="column" type="xs:integer" minOccurs="0" maxOccurs="1"> 2581 <xs:annotation> 2582 <xs:documentation>The column the code that is called resides.</xs:documentation> 2583 </xs:annotation> 2584 </xs:element> 2585 <xs:element name="fullFilename" type="xs:string" minOccurs="0" maxOccurs="1"> 2586 <xs:annotation> 2587 <xs:documentation>The full path and filename of the module.</xs:documentation> 2588 </xs:annotation> 2589 </xs:element> 2590 </xs:sequence> 2591 </xs:complexType> 2592 </xs:element> 2593 </xs:sequence> 2594 </xs:complexType> 2595 </xs:element> 2596 <xs:element name="tools" minOccurs="0" maxOccurs="1"> 2597 <xs:annotation> 2598 <xs:documentation> 2599 The object in the BOM identified by its bom-ref. This is often a component or service, 2600 but may be any object type supporting bom-refs. Tools used for analysis should already 2601 be defined in the BOM, either in the metadata/tools, components, or formulation. 2602 </xs:documentation> 2603 </xs:annotation> 2604 <xs:complexType> 2605 <xs:sequence> 2606 <xs:element name="tool" type="bom:bomReferenceType" minOccurs="0" maxOccurs="unbounded"/> 2607 </xs:sequence> 2608 </xs:complexType> 2609 </xs:element> 2610 </xs:sequence> 2611 </xs:complexType> 2612 </xs:element> 2613 <xs:element name="licenses" type="bom:licenseChoiceType" minOccurs="0" maxOccurs="1"/> 2614 <xs:element name="copyright" type="bom:copyrightsType" minOccurs="0" maxOccurs="1"/> 2615 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 2616 <xs:annotation> 2617 <xs:documentation> 2618 Allows any undeclared elements as long as the elements are placed in a different namespace. 2619 </xs:documentation> 2620 </xs:annotation> 2621 </xs:any> 2622 </xs:sequence> 2623 <xs:anyAttribute namespace="##any" processContents="lax"> 2624 <xs:annotation> 2625 <xs:documentation>User-defined attributes may be used on this element as long as they 2626 do not have the same name as an existing attribute used by the schema.</xs:documentation> 2627 </xs:annotation> 2628 </xs:anyAttribute> 2629 </xs:complexType> 2630 2631 <xs:complexType name="compositionsType"> 2632 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2633 <xs:element name="composition" type="bom:compositionType"/> 2634 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 2635 <xs:annotation> 2636 <xs:documentation> 2637 Allows any undeclared elements as long as the elements are placed in a different namespace. 2638 </xs:documentation> 2639 </xs:annotation> 2640 </xs:any> 2641 </xs:sequence> 2642 <xs:anyAttribute namespace="##any" processContents="lax"> 2643 <xs:annotation> 2644 <xs:documentation>User-defined attributes may be used on this element as long as they 2645 do not have the same name as an existing attribute used by the schema.</xs:documentation> 2646 </xs:annotation> 2647 </xs:anyAttribute> 2648 </xs:complexType> 2649 2650 <xs:complexType name="compositionType"> 2651 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2652 <xs:element name="aggregate" type="bom:aggregateType" default="not_specified"> 2653 <xs:annotation> 2654 <xs:documentation>Specifies an aggregate type that describe how complete a relationship is.</xs:documentation> 2655 </xs:annotation> 2656 </xs:element> 2657 <xs:element name="assemblies" minOccurs="0" maxOccurs="1"> 2658 <xs:annotation> 2659 <xs:documentation> 2660 The bom-ref identifiers of the components or services being described. Assemblies refer to 2661 nested relationships whereby a constituent part may include other constituent parts. References 2662 do not cascade to child parts. References are explicit for the specified constituent part only. 2663 </xs:documentation> 2664 </xs:annotation> 2665 <xs:complexType> 2666 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2667 <xs:element name="assembly" type="bom:bomReferenceType"/> 2668 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 2669 <xs:annotation> 2670 <xs:documentation> 2671 Allows any undeclared elements as long as the elements are placed in a different namespace. 2672 </xs:documentation> 2673 </xs:annotation> 2674 </xs:any> 2675 </xs:sequence> 2676 </xs:complexType> 2677 </xs:element> 2678 <xs:element name="dependencies" minOccurs="0" maxOccurs="1"> 2679 <xs:annotation> 2680 <xs:documentation> 2681 The bom-ref identifiers of the components or services being described. Dependencies refer to a 2682 relationship whereby an independent constituent part requires another independent constituent 2683 part. References do not cascade to transitive dependencies. References are explicit for the 2684 specified dependency only. 2685 </xs:documentation> 2686 </xs:annotation> 2687 <xs:complexType> 2688 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2689 <xs:element name="dependency" type="bom:bomReferenceType"/> 2690 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 2691 <xs:annotation> 2692 <xs:documentation> 2693 Allows any undeclared elements as long as the elements are placed in a different namespace. 2694 </xs:documentation> 2695 </xs:annotation> 2696 </xs:any> 2697 </xs:sequence> 2698 </xs:complexType> 2699 </xs:element> 2700 <xs:element name="vulnerabilities" minOccurs="0" maxOccurs="1"> 2701 <xs:annotation> 2702 <xs:documentation> 2703 The bom-ref identifiers of the vulnerabilities being described. 2704 </xs:documentation> 2705 </xs:annotation> 2706 <xs:complexType> 2707 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2708 <xs:element name="vulnerability" type="bom:bomReferenceType"/> 2709 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 2710 <xs:annotation> 2711 <xs:documentation> 2712 Allows any undeclared elements as long as the elements are placed in a different namespace. 2713 </xs:documentation> 2714 </xs:annotation> 2715 </xs:any> 2716 </xs:sequence> 2717 </xs:complexType> 2718 </xs:element> 2719 </xs:sequence> 2720 <xs:attribute name="bom-ref" type="bom:refType"> 2721 <xs:annotation> 2722 <xs:documentation> 2723 An optional identifier which can be used to reference the composition elsewhere in the BOM. 2724 Uniqueness is enforced within all elements and children of the root-level bom element. 2725 </xs:documentation> 2726 </xs:annotation> 2727 </xs:attribute> 2728 </xs:complexType> 2729 2730 <xs:simpleType name="aggregateType"> 2731 <xs:restriction base="xs:string"> 2732 <xs:enumeration value="complete"> 2733 <xs:annotation> 2734 <xs:documentation>The relationship is complete. No further relationships including constituent components, services, or dependencies are known to exist.</xs:documentation> 2735 </xs:annotation> 2736 </xs:enumeration> 2737 <xs:enumeration value="incomplete"> 2738 <xs:annotation> 2739 <xs:documentation>The relationship is incomplete. Additional relationships exist and may include constituent components, services, or dependencies.</xs:documentation> 2740 </xs:annotation> 2741 </xs:enumeration> 2742 <xs:enumeration value="incomplete_first_party_only"> 2743 <xs:annotation> 2744 <xs:documentation>The relationship is incomplete. Only relationships for first-party components, services, or their dependencies are represented.</xs:documentation> 2745 </xs:annotation> 2746 </xs:enumeration> 2747 <xs:enumeration value="incomplete_first_party_proprietary_only"> 2748 <xs:annotation> 2749 <xs:documentation>The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are proprietary.</xs:documentation> 2750 </xs:annotation> 2751 </xs:enumeration> 2752 <xs:enumeration value="incomplete_first_party_opensource_only"> 2753 <xs:annotation> 2754 <xs:documentation>The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are opensource.</xs:documentation> 2755 </xs:annotation> 2756 </xs:enumeration> 2757 <xs:enumeration value="incomplete_third_party_only"> 2758 <xs:annotation> 2759 <xs:documentation>The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented.</xs:documentation> 2760 </xs:annotation> 2761 </xs:enumeration> 2762 <xs:enumeration value="incomplete_third_party_proprietary_only"> 2763 <xs:annotation> 2764 <xs:documentation>The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are proprietary.</xs:documentation> 2765 </xs:annotation> 2766 </xs:enumeration> 2767 <xs:enumeration value="incomplete_third_party_opensource_only"> 2768 <xs:annotation> 2769 <xs:documentation>The relationship is incomplete. Only relationships for third-party components, services, or their dependencies are represented, limited specifically to those that are opensource.</xs:documentation> 2770 </xs:annotation> 2771 </xs:enumeration> 2772 <xs:enumeration value="unknown"> 2773 <xs:annotation> 2774 <xs:documentation>The relationship may be complete or incomplete. This usually signifies a 'best-effort' to obtain constituent components, services, or dependencies but the completeness is inconclusive.</xs:documentation> 2775 </xs:annotation> 2776 </xs:enumeration> 2777 <xs:enumeration value="not_specified"> 2778 <xs:annotation> 2779 <xs:documentation>The relationship completeness is not specified.</xs:documentation> 2780 </xs:annotation> 2781 </xs:enumeration> 2782 </xs:restriction> 2783 </xs:simpleType> 2784 2785 <xs:simpleType name="localeType"> 2786 <xs:annotation> 2787 <xs:documentation xml:lang="en"> 2788 Defines a syntax for representing two character language code (ISO-639) followed by an optional two 2789 character country code. The language code MUST be lower case. If the country code is specified, the 2790 country code MUST be upper case. The language code and country code MUST be separated by a minus sign. 2791 Examples: en, en-US, fr, fr-CA 2792 </xs:documentation> 2793 </xs:annotation> 2794 <xs:restriction base="xs:string"> 2795 <xs:pattern value="([a-z]{2})(-[A-Z]{2})?"/> 2796 </xs:restriction> 2797 </xs:simpleType> 2798 2799 <xs:complexType name="releaseNotesType"> 2800 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2801 <xs:element name="type" type="xs:normalizedString" minOccurs="1" maxOccurs="1"> 2802 <xs:annotation> 2803 <xs:documentation>The software versioning type. It is RECOMMENDED that the release type use one 2804 of 'major', 'minor', 'patch', 'pre-release', or 'internal'. Representing all possible software 2805 release types is not practical, so standardizing on the recommended values, whenever possible, 2806 is strongly encouraged. 2807 * major = A major release may contain significant changes or may introduce breaking changes. 2808 * minor = A minor release, also known as an update, may contain a smaller number of changes than major releases. 2809 * patch = Patch releases are typically unplanned and may resolve defects or important security issues. 2810 * pre-release = A pre-release may include alpha, beta, or release candidates and typically have 2811 limited support. They provide the ability to preview a release prior to its general availability. 2812 * internal = Internal releases are not for public consumption and are intended to be used exclusively 2813 by the project or manufacturer that produced it. 2814 </xs:documentation> 2815 </xs:annotation> 2816 </xs:element> 2817 <xs:element name="title" type="xs:string" minOccurs="0" maxOccurs="1"> 2818 <xs:annotation> 2819 <xs:documentation>The title of the release.</xs:documentation> 2820 </xs:annotation> 2821 </xs:element> 2822 <xs:element name="featuredImage" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 2823 <xs:annotation> 2824 <xs:documentation>The URL to an image that may be prominently displayed with the release note.</xs:documentation> 2825 </xs:annotation> 2826 </xs:element> 2827 <xs:element name="socialImage" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 2828 <xs:annotation> 2829 <xs:documentation>The URL to an image that may be used in messaging on social media platforms.</xs:documentation> 2830 </xs:annotation> 2831 </xs:element> 2832 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 2833 <xs:annotation> 2834 <xs:documentation>A short description of the release.</xs:documentation> 2835 </xs:annotation> 2836 </xs:element> 2837 <xs:element name="timestamp" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 2838 <xs:annotation> 2839 <xs:documentation>The date and time (timestamp) when the release note was created.</xs:documentation> 2840 </xs:annotation> 2841 </xs:element> 2842 <xs:element name="aliases" minOccurs="0" maxOccurs="1"> 2843 <xs:complexType> 2844 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2845 <xs:element name="alias" type="xs:normalizedString"> 2846 <xs:annotation> 2847 <xs:documentation>One or more alternate names the release may be referred to. This may 2848 include unofficial terms used by development and marketing teams (e.g. code names).</xs:documentation> 2849 </xs:annotation> 2850 </xs:element> 2851 </xs:sequence> 2852 </xs:complexType> 2853 </xs:element> 2854 <xs:element name="tags" type="bom:tagsType" minOccurs="0" maxOccurs="1" /> 2855 <xs:element name="resolves" minOccurs="0" maxOccurs="1"> 2856 <xs:annotation> 2857 <xs:documentation>A collection of issues that have been resolved.</xs:documentation> 2858 </xs:annotation> 2859 <xs:complexType> 2860 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2861 <xs:element name="issue" type="bom:issueType"/> 2862 </xs:sequence> 2863 </xs:complexType> 2864 </xs:element> 2865 <xs:element name="notes" minOccurs="0" maxOccurs="1"> 2866 <xs:complexType> 2867 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2868 <xs:element name="note"> 2869 <xs:annotation> 2870 <xs:documentation>Zero or more release notes containing the locale and content. Multiple 2871 note elements may be specified to support release notes in a wide variety of languages.</xs:documentation> 2872 </xs:annotation> 2873 <xs:complexType> 2874 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 2875 <xs:element name="locale" type="bom:localeType" minOccurs="0" maxOccurs="1"> 2876 <xs:annotation> 2877 <xs:documentation>The ISO-639 (or higher) language code and optional ISO-3166 2878 (or higher) country code. Examples include: "en", "en-US", "fr" and "fr-CA".</xs:documentation> 2879 </xs:annotation> 2880 </xs:element> 2881 <xs:element name="text" type="bom:attachedTextType" minOccurs="1" maxOccurs="1"> 2882 <xs:annotation> 2883 <xs:documentation>Specifies the full content of the release note.</xs:documentation> 2884 </xs:annotation> 2885 </xs:element> 2886 </xs:sequence> 2887 </xs:complexType> 2888 </xs:element> 2889 </xs:sequence> 2890 </xs:complexType> 2891 </xs:element> 2892 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 2893 <xs:annotation> 2894 <xs:documentation>Provides the ability to document properties in a name/value store. 2895 This provides flexibility to include data not officially supported in the standard 2896 without having to use additional namespaces or create extensions. Property names 2897 of interest to the general public are encouraged to be registered in the 2898 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 2899 Formal registration is OPTIONAL.</xs:documentation> 2900 </xs:annotation> 2901 </xs:element> 2902 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 2903 <xs:annotation> 2904 <xs:documentation> 2905 Allows any undeclared elements as long as the elements are placed in a different namespace. 2906 </xs:documentation> 2907 </xs:annotation> 2908 </xs:any> 2909 </xs:sequence> 2910 <xs:anyAttribute namespace="##any" processContents="lax"> 2911 <xs:annotation> 2912 <xs:documentation>User-defined attributes may be used on this element as long as they 2913 do not have the same name as an existing attribute used by the schema.</xs:documentation> 2914 </xs:annotation> 2915 </xs:anyAttribute> 2916 </xs:complexType> 2917 2918 <!-- 2919 Model card support in CycloneDX is derived from TensorFlow Model Card Toolkit released under the Apache 2.0 license and 2920 available from https://github.com/tensorflow/model-card-toolkit/blob/main/model_card_toolkit/schema/v0.0.2/model_card.schema.json. 2921 In addition, CycloneDX model card support includes portions of VerifyML, also released under the Apache 2.0 license and 2922 available from https://github.com/cylynx/verifyml/blob/main/verifyml/model_card_toolkit/schema/v0.0.4/model_card.schema.json. 2923 --> 2924 <xs:complexType name="modelCardType"> 2925 <xs:annotation> 2926 <xs:documentation> 2927 A model card describes the intended uses of a machine learning model and potential limitations, including 2928 biases and ethical considerations. Model cards typically contain the training parameters, which datasets 2929 were used to train the model, performance metrics, and other relevant data useful for ML transparency. 2930 This object SHOULD be specified for any component of type `machine-learning-model` and MUST NOT be specified 2931 for other component types. 2932 </xs:documentation> 2933 </xs:annotation> 2934 <xs:sequence> 2935 <xs:element name="modelParameters" minOccurs="0" maxOccurs="1"> 2936 <xs:annotation> 2937 <xs:documentation> 2938 Hyper-parameters for construction of the model. 2939 </xs:documentation> 2940 </xs:annotation> 2941 <xs:complexType> 2942 <xs:sequence> 2943 <xs:element name="approach" minOccurs="0" maxOccurs="1"> 2944 <xs:annotation> 2945 <xs:documentation> 2946 The overall approach to learning used by the model for problem solving. 2947 </xs:documentation> 2948 </xs:annotation> 2949 <xs:complexType> 2950 <xs:sequence> 2951 <xs:element name="type" type="bom:machineLearningApproachType" minOccurs="0" maxOccurs="1"> 2952 <xs:annotation> 2953 <xs:documentation> 2954 Learning types describing the learning problem or hybrid learning problem. 2955 </xs:documentation> 2956 </xs:annotation> 2957 </xs:element> 2958 </xs:sequence> 2959 </xs:complexType> 2960 </xs:element> 2961 <xs:element name="task" type="xs:string" minOccurs="0" maxOccurs="1"> 2962 <xs:annotation> 2963 <xs:documentation> 2964 Directly influences the input and/or output. Examples include classification, 2965 regression, clustering, etc. 2966 </xs:documentation> 2967 </xs:annotation> 2968 </xs:element> 2969 <xs:element name="architectureFamily" type="xs:string" minOccurs="0" maxOccurs="1"> 2970 <xs:annotation> 2971 <xs:documentation> 2972 The model architecture family such as transformer network, convolutional neural 2973 network, residual neural network, LSTM neural network, etc. 2974 </xs:documentation> 2975 </xs:annotation> 2976 </xs:element> 2977 <xs:element name="modelArchitecture" type="xs:string" minOccurs="0" maxOccurs="1"> 2978 <xs:annotation> 2979 <xs:documentation> 2980 The specific architecture of the model such as GPT-1, ResNet-50, YOLOv3, etc. 2981 </xs:documentation> 2982 </xs:annotation> 2983 </xs:element> 2984 <xs:element name="datasets" minOccurs="0" maxOccurs="1"> 2985 <xs:annotation> 2986 <xs:documentation> 2987 The datasets used to train and evaluate the model. 2988 </xs:documentation> 2989 </xs:annotation> 2990 <xs:complexType> 2991 <xs:choice minOccurs="0" maxOccurs="unbounded"> 2992 <xs:element name="ref" minOccurs="0" maxOccurs="1"> 2993 <xs:annotation> 2994 <xs:documentation>References a data component by the components bom-ref attribute</xs:documentation> 2995 </xs:annotation> 2996 <xs:simpleType> 2997 <xs:union memberTypes="bom:refLinkType bom:bomLinkElementType"/> 2998 </xs:simpleType> 2999 </xs:element> 3000 <xs:element name="dataset" type="bom:componentDataType" minOccurs="0" maxOccurs="1" /> 3001 </xs:choice> 3002 </xs:complexType> 3003 </xs:element> 3004 <xs:element name="inputs" minOccurs="0" maxOccurs="1"> 3005 <xs:annotation> 3006 <xs:documentation> 3007 The input format(s) of the model 3008 </xs:documentation> 3009 </xs:annotation> 3010 <xs:complexType> 3011 <xs:sequence> 3012 <xs:element name="input" minOccurs="0" maxOccurs="unbounded"> 3013 <xs:complexType> 3014 <xs:sequence> 3015 <xs:element name="format" type="xs:string" minOccurs="1" maxOccurs="1"> 3016 <xs:annotation> 3017 <xs:documentation> 3018 The data format for input to the model. Example formats include string, image, time-series 3019 </xs:documentation> 3020 </xs:annotation> 3021 </xs:element> 3022 </xs:sequence> 3023 </xs:complexType> 3024 </xs:element> 3025 </xs:sequence> 3026 </xs:complexType> 3027 </xs:element> 3028 <xs:element name="outputs" minOccurs="0" maxOccurs="1"> 3029 <xs:annotation> 3030 <xs:documentation> 3031 The output format(s) from the model 3032 </xs:documentation> 3033 </xs:annotation> 3034 <xs:complexType> 3035 <xs:sequence> 3036 <xs:element name="output" minOccurs="0" maxOccurs="unbounded"> 3037 <xs:complexType> 3038 <xs:sequence> 3039 <xs:element name="format" type="xs:string" minOccurs="1" maxOccurs="1"> 3040 <xs:annotation> 3041 <xs:documentation> 3042 The data format for output from the model. Example formats include string, image, time-series 3043 </xs:documentation> 3044 </xs:annotation> 3045 </xs:element> 3046 </xs:sequence> 3047 </xs:complexType> 3048 </xs:element> 3049 </xs:sequence> 3050 </xs:complexType> 3051 </xs:element> 3052 </xs:sequence> 3053 </xs:complexType> 3054 </xs:element> 3055 <xs:element name="quantitativeAnalysis" minOccurs="0" maxOccurs="1"> 3056 <xs:annotation> 3057 <xs:documentation> 3058 A quantitative analysis of the model 3059 </xs:documentation> 3060 </xs:annotation> 3061 <xs:complexType> 3062 <xs:sequence> 3063 <xs:element name="performanceMetrics" minOccurs="0" maxOccurs="1"> 3064 <xs:complexType> 3065 <xs:sequence> 3066 <xs:element name="performanceMetric" minOccurs="0" maxOccurs="unbounded"> 3067 <xs:complexType> 3068 <xs:sequence> 3069 <xs:element name="type" type="xs:string" minOccurs="0" maxOccurs="1"> 3070 <xs:annotation> 3071 <xs:documentation> 3072 The type of performance metric. 3073 </xs:documentation> 3074 </xs:annotation> 3075 </xs:element> 3076 <xs:element name="value" type="xs:string" minOccurs="0" maxOccurs="1"> 3077 <xs:annotation> 3078 <xs:documentation> 3079 The value of the performance metric. 3080 </xs:documentation> 3081 </xs:annotation> 3082 </xs:element> 3083 <xs:element name="slice" type="xs:string" minOccurs="0" maxOccurs="1"> 3084 <xs:annotation> 3085 <xs:documentation> 3086 The name of the slice this metric was computed on. By default, assume 3087 this metric is not sliced. 3088 </xs:documentation> 3089 </xs:annotation> 3090 </xs:element> 3091 <xs:element name="confidenceInterval" minOccurs="0" maxOccurs="1"> 3092 <xs:annotation> 3093 <xs:documentation> 3094 The confidence interval of the metric. 3095 </xs:documentation> 3096 </xs:annotation> 3097 <xs:complexType> 3098 <xs:sequence> 3099 <xs:element name="lowerBound" type="xs:string" minOccurs="0" maxOccurs="1"> 3100 <xs:annotation> 3101 <xs:documentation> 3102 The lower bound of the confidence interval. 3103 </xs:documentation> 3104 </xs:annotation> 3105 </xs:element> 3106 <xs:element name="upperBound" type="xs:string" minOccurs="0" maxOccurs="1"> 3107 <xs:annotation> 3108 <xs:documentation> 3109 The upper bound of the confidence interval. 3110 </xs:documentation> 3111 </xs:annotation> 3112 </xs:element> 3113 </xs:sequence> 3114 </xs:complexType> 3115 </xs:element> 3116 </xs:sequence> 3117 </xs:complexType> 3118 </xs:element> 3119 </xs:sequence> 3120 </xs:complexType> 3121 </xs:element> 3122 <xs:element name="graphics" minOccurs="0" maxOccurs="1"> 3123 <xs:annotation> 3124 <xs:documentation> 3125 A collection of graphics that represent various measurements 3126 </xs:documentation> 3127 </xs:annotation> 3128 <xs:complexType> 3129 <xs:sequence> 3130 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 3131 <xs:annotation> 3132 <xs:documentation> 3133 A description of this collection of graphics. 3134 </xs:documentation> 3135 </xs:annotation> 3136 </xs:element> 3137 <xs:element name="collection" minOccurs="0" maxOccurs="1"> 3138 <xs:annotation> 3139 <xs:documentation> 3140 A collection of graphics. 3141 </xs:documentation> 3142 </xs:annotation> 3143 <xs:complexType> 3144 <xs:sequence> 3145 <xs:element name="graphic" minOccurs="0" maxOccurs="unbounded"> 3146 <xs:complexType> 3147 <xs:sequence> 3148 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 3149 <xs:annotation> 3150 <xs:documentation> 3151 The name of the graphic. 3152 </xs:documentation> 3153 </xs:annotation> 3154 </xs:element> 3155 <xs:element name="image" type="bom:attachedTextType" minOccurs="0" maxOccurs="1"> 3156 <xs:annotation> 3157 <xs:documentation> 3158 The graphic (vector or raster). Base64 encoding MUST be specified for binary images. 3159 </xs:documentation> 3160 </xs:annotation> 3161 </xs:element> 3162 </xs:sequence> 3163 </xs:complexType> 3164 </xs:element> 3165 </xs:sequence> 3166 </xs:complexType> 3167 </xs:element> 3168 </xs:sequence> 3169 </xs:complexType> 3170 </xs:element> 3171 </xs:sequence> 3172 </xs:complexType> 3173 </xs:element> 3174 <xs:element name="considerations" minOccurs="0" maxOccurs="1"> 3175 <xs:annotation> 3176 <xs:documentation> 3177 What considerations should be taken into account regarding the model's construction, training, 3178 and application? 3179 </xs:documentation> 3180 </xs:annotation> 3181 <xs:complexType> 3182 <xs:sequence> 3183 <xs:element name="users" minOccurs="0" maxOccurs="1"> 3184 <xs:annotation> 3185 <xs:documentation> 3186 Who are the intended users of the model? 3187 </xs:documentation> 3188 </xs:annotation> 3189 <xs:complexType> 3190 <xs:sequence> 3191 <xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="1" /> 3192 </xs:sequence> 3193 </xs:complexType> 3194 </xs:element> 3195 <xs:element name="useCases" minOccurs="0" maxOccurs="1"> 3196 <xs:annotation> 3197 <xs:documentation> 3198 What are the intended use cases of the model? 3199 </xs:documentation> 3200 </xs:annotation> 3201 <xs:complexType> 3202 <xs:sequence> 3203 <xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="1" /> 3204 </xs:sequence> 3205 </xs:complexType> 3206 </xs:element> 3207 <xs:element name="technicalLimitations" minOccurs="0" maxOccurs="1"> 3208 <xs:annotation> 3209 <xs:documentation> 3210 What are the known technical limitations of the model? E.g. What kind(s) of data 3211 should the model be expected not to perform well on? What are the factors that might 3212 degrade model performance? 3213 </xs:documentation> 3214 </xs:annotation> 3215 <xs:complexType> 3216 <xs:sequence> 3217 <xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="1" /> 3218 </xs:sequence> 3219 </xs:complexType> 3220 </xs:element> 3221 <xs:element name="performanceTradeoffs" minOccurs="0" maxOccurs="1"> 3222 <xs:annotation> 3223 <xs:documentation> 3224 What are the known tradeoffs in accuracy/performance of the model? 3225 </xs:documentation> 3226 </xs:annotation> 3227 <xs:complexType> 3228 <xs:sequence> 3229 <xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="1" /> 3230 </xs:sequence> 3231 </xs:complexType> 3232 </xs:element> 3233 <xs:element name="ethicalConsiderations" minOccurs="0" maxOccurs="1"> 3234 <xs:annotation> 3235 <xs:documentation> 3236 What are the ethical risks involved in the application of this model? 3237 </xs:documentation> 3238 </xs:annotation> 3239 <xs:complexType> 3240 <xs:sequence> 3241 <xs:element name="ethicalConsideration" minOccurs="0" maxOccurs="unbounded"> 3242 <xs:complexType> 3243 <xs:sequence> 3244 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 3245 <xs:annotation> 3246 <xs:documentation> 3247 The name of the risk 3248 </xs:documentation> 3249 </xs:annotation> 3250 </xs:element> 3251 <xs:element name="mitigationStrategy" type="xs:string" minOccurs="0" maxOccurs="1"> 3252 <xs:annotation> 3253 <xs:documentation> 3254 Strategy used to address this risk 3255 </xs:documentation> 3256 </xs:annotation> 3257 </xs:element> 3258 </xs:sequence> 3259 </xs:complexType> 3260 </xs:element> 3261 </xs:sequence> 3262 </xs:complexType> 3263 </xs:element> 3264 <xs:element name="environmentalConsiderations" type="bom:environmentalConsiderationsType" minOccurs="0" maxOccurs="1"> 3265 <xs:annotation> 3266 <xs:documentation> 3267 What are the various environmental impacts the corresponding machine learning model has exhibited across its lifecycle? 3268 </xs:documentation> 3269 </xs:annotation> 3270 </xs:element> 3271 <xs:element name="fairnessAssessments" minOccurs="0" maxOccurs="1"> 3272 <xs:annotation> 3273 <xs:documentation> 3274 How does the model affect groups at risk of being systematically disadvantaged? 3275 What are the harms and benefits to the various affected groups? 3276 </xs:documentation> 3277 </xs:annotation> 3278 <xs:complexType> 3279 <xs:sequence> 3280 <xs:element name="fairnessAssessment" minOccurs="0" maxOccurs="unbounded"> 3281 <xs:complexType> 3282 <xs:sequence> 3283 <xs:element name="groupAtRisk" type="xs:string" minOccurs="0" maxOccurs="1"> 3284 <xs:annotation> 3285 <xs:documentation> 3286 The groups or individuals at risk of being systematically disadvantaged by the model. 3287 </xs:documentation> 3288 </xs:annotation> 3289 </xs:element> 3290 <xs:element name="benefits" type="xs:string" minOccurs="0" maxOccurs="1"> 3291 <xs:annotation> 3292 <xs:documentation> 3293 Expected benefits to the identified groups. 3294 </xs:documentation> 3295 </xs:annotation> 3296 </xs:element> 3297 <xs:element name="harms" type="xs:string" minOccurs="0" maxOccurs="1"> 3298 <xs:annotation> 3299 <xs:documentation> 3300 Expected harms to the identified groups. 3301 </xs:documentation> 3302 </xs:annotation> 3303 </xs:element> 3304 <xs:element name="mitigationStrategy" type="xs:string" minOccurs="0" maxOccurs="1"> 3305 <xs:annotation> 3306 <xs:documentation> 3307 With respect to the benefits and harms outlined, please 3308 describe any mitigation strategy implemented. 3309 </xs:documentation> 3310 </xs:annotation> 3311 </xs:element> 3312 </xs:sequence> 3313 </xs:complexType> 3314 </xs:element> 3315 </xs:sequence> 3316 </xs:complexType> 3317 </xs:element> 3318 </xs:sequence> 3319 </xs:complexType> 3320 </xs:element> 3321 </xs:sequence> 3322 <xs:attribute name="bom-ref" type="bom:refType"> 3323 <xs:annotation> 3324 <xs:documentation> 3325 An optional identifier which can be used to reference the model card elsewhere in the BOM. 3326 Every bom-ref MUST be unique within the BOM. 3327 </xs:documentation> 3328 </xs:annotation> 3329 </xs:attribute> 3330 </xs:complexType> 3331 3332 <xs:complexType name="environmentalConsiderationsType"> 3333 <xs:annotation> 3334 <xs:documentation> 3335 Describes various environmental impact metrics. 3336 </xs:documentation> 3337 </xs:annotation> 3338 <xs:sequence> 3339 <xs:element name="energyConsumptions" type="bom:energyConsumptionsType" minOccurs="0" maxOccurs="unbounded"> 3340 <xs:annotation> 3341 <xs:documentation> 3342 Describes energy consumption information incurred for one or more component lifecycle activities. 3343 </xs:documentation> 3344 </xs:annotation> 3345 </xs:element> 3346 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 3347 <xs:annotation> 3348 <xs:documentation>Provides the ability to document properties in a name/value store. 3349 This provides flexibility to include data not officially supported in the standard 3350 without having to use additional namespaces or create extensions. Property names 3351 of interest to the general public are encouraged to be registered in the 3352 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 3353 Formal registration is OPTIONAL. 3354 </xs:documentation> 3355 </xs:annotation> 3356 </xs:element> 3357 </xs:sequence> 3358 </xs:complexType> 3359 3360 <xs:complexType name="energyConsumptionsType"> 3361 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 3362 <xs:element name="energyConsumption" type="bom:energyConsumptionType"/> 3363 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 3364 <xs:annotation> 3365 <xs:documentation> 3366 Allows any undeclared elements as long as the elements are placed in a different namespace. 3367 </xs:documentation> 3368 </xs:annotation> 3369 </xs:any> 3370 </xs:sequence> 3371 <xs:anyAttribute namespace="##any" processContents="lax"> 3372 <xs:annotation> 3373 <xs:documentation>User-defined attributes may be used on this element as long as they 3374 do not have the same name as an existing attribute used by the schema.</xs:documentation> 3375 </xs:annotation> 3376 </xs:anyAttribute> 3377 </xs:complexType> 3378 3379 <xs:complexType name="energyConsumptionType"> 3380 <xs:annotation> 3381 <xs:documentation> 3382 Describes energy consumption information incurred for the specified lifecycle activity. 3383 </xs:documentation> 3384 </xs:annotation> 3385 <xs:sequence> 3386 <xs:element name="activity" minOccurs="1" maxOccurs="1"> 3387 <xs:annotation> 3388 <xs:documentation> 3389 The type of activity that is part of a machine learning model development or operational lifecycle. 3390 </xs:documentation> 3391 </xs:annotation> 3392 <xs:simpleType> 3393 <xs:restriction base="xs:string"> 3394 <xs:enumeration value="design"> 3395 <xs:annotation> 3396 <xs:documentation> 3397 model design including problem framing, goal definition and algorithm selection. 3398 </xs:documentation> 3399 </xs:annotation> 3400 </xs:enumeration> 3401 <xs:enumeration value="data-collection"> 3402 <xs:annotation> 3403 <xs:documentation> 3404 model data acquisition including search, selection and transfer. 3405 </xs:documentation> 3406 </xs:annotation> 3407 </xs:enumeration> 3408 <xs:enumeration value="data-preparation"> 3409 <xs:annotation> 3410 <xs:documentation> 3411 model data preparation including data cleaning, labeling and conversion. 3412 </xs:documentation> 3413 </xs:annotation> 3414 </xs:enumeration> 3415 <xs:enumeration value="training"> 3416 <xs:annotation> 3417 <xs:documentation> 3418 model building, training and generalized tuning. 3419 </xs:documentation> 3420 </xs:annotation> 3421 </xs:enumeration> 3422 <xs:enumeration value="fine-tuning"> 3423 <xs:annotation> 3424 <xs:documentation> 3425 refining a trained model to produce desired outputs for a given problem space. 3426 </xs:documentation> 3427 </xs:annotation> 3428 </xs:enumeration> 3429 <xs:enumeration value="validation"> 3430 <xs:annotation> 3431 <xs:documentation> 3432 model validation including model output evaluation and testing. 3433 </xs:documentation> 3434 </xs:annotation> 3435 </xs:enumeration> 3436 <xs:enumeration value="deployment"> 3437 <xs:annotation> 3438 <xs:documentation> 3439 explicit model deployment to a target hosting infrastructure. 3440 </xs:documentation> 3441 </xs:annotation> 3442 </xs:enumeration> 3443 <xs:enumeration value="inference"> 3444 <xs:annotation> 3445 <xs:documentation> 3446 generating an output response from a hosted model from a set of inputs. 3447 </xs:documentation> 3448 </xs:annotation> 3449 </xs:enumeration> 3450 <xs:enumeration value="other"> 3451 <xs:annotation> 3452 <xs:documentation> 3453 a lifecycle activity type whose description does not match currently defined values. 3454 </xs:documentation> 3455 </xs:annotation> 3456 </xs:enumeration> 3457 </xs:restriction> 3458 </xs:simpleType> 3459 </xs:element> 3460 <xs:element name="energyProviders" type="bom:energyProviderType" minOccurs="1" maxOccurs="unbounded"> 3461 <xs:annotation> 3462 <xs:documentation> 3463 The provider(s) of the energy consumed by the associated model development lifecycle activity. 3464 </xs:documentation> 3465 </xs:annotation> 3466 </xs:element> 3467 <xs:element name="activityEnergyCost" type="bom:energyMeasureType" minOccurs="1" maxOccurs="1"> 3468 <xs:annotation> 3469 <xs:documentation> 3470 The total energy cost associated with the model lifecycle activity. 3471 </xs:documentation> 3472 </xs:annotation> 3473 </xs:element> 3474 <xs:element name="co2CostEquivalent" type="bom:co2MeasureType" minOccurs="0" maxOccurs="1"> 3475 <xs:annotation> 3476 <xs:documentation> 3477 The CO2 cost (debit) equivalent to the total energy cost. 3478 </xs:documentation> 3479 </xs:annotation> 3480 </xs:element> 3481 <xs:element name="co2CostOffset" type="bom:co2MeasureType" minOccurs="0" maxOccurs="1"> 3482 <xs:annotation> 3483 <xs:documentation> 3484 The CO2 offset (credit) for the CO2 equivalent cost. 3485 </xs:documentation> 3486 </xs:annotation> 3487 </xs:element> 3488 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 3489 <xs:annotation> 3490 <xs:documentation>Provides the ability to document properties in a name/value store. 3491 This provides flexibility to include data not officially supported in the standard 3492 without having to use additional namespaces or create extensions. Property names 3493 of interest to the general public are encouraged to be registered in the 3494 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 3495 Formal registration is OPTIONAL. 3496 </xs:documentation> 3497 </xs:annotation> 3498 </xs:element> 3499 </xs:sequence> 3500 </xs:complexType> 3501 3502 <xs:complexType name="energyMeasureType"> 3503 <xs:annotation> 3504 <xs:documentation> 3505 A measure of energy. 3506 </xs:documentation> 3507 </xs:annotation> 3508 <xs:sequence> 3509 <xs:element name="value" type="xs:decimal" minOccurs="1" maxOccurs="1"> 3510 <xs:annotation> 3511 <xs:documentation> 3512 Quantity of energy. 3513 </xs:documentation> 3514 </xs:annotation> 3515 </xs:element> 3516 <xs:element name="unit" minOccurs="1" maxOccurs="1"> 3517 <xs:annotation> 3518 <xs:documentation> 3519 Unit of energy. 3520 </xs:documentation> 3521 </xs:annotation> 3522 <xs:simpleType> 3523 <xs:restriction base="xs:string"> 3524 <xs:enumeration value="kWh"> 3525 <xs:annotation> 3526 <xs:documentation> 3527 kilowatt-hour (kWh) is the energy delivered by one kilowatt (kW) of power for one hour (h). 3528 </xs:documentation> 3529 </xs:annotation> 3530 </xs:enumeration> 3531 </xs:restriction> 3532 </xs:simpleType> 3533 </xs:element> 3534 </xs:sequence> 3535 </xs:complexType> 3536 3537 <xs:complexType name="co2MeasureType"> 3538 <xs:annotation> 3539 <xs:documentation> 3540 A measure of carbon dioxide (CO2). 3541 </xs:documentation> 3542 </xs:annotation> 3543 <xs:sequence> 3544 <xs:element name="value" type="xs:decimal" minOccurs="1" maxOccurs="1"> 3545 <xs:annotation> 3546 <xs:documentation> 3547 Quantity of carbon dioxide (CO2). 3548 </xs:documentation> 3549 </xs:annotation> 3550 </xs:element> 3551 <xs:element name="unit" minOccurs="1" maxOccurs="1"> 3552 <xs:annotation> 3553 <xs:documentation> 3554 Unit of carbon dioxide (CO2). 3555 </xs:documentation> 3556 </xs:annotation> 3557 <xs:simpleType> 3558 <xs:restriction base="xs:string"> 3559 <xs:enumeration value="tCO2eq"> 3560 <xs:annotation> 3561 <xs:documentation> 3562 Tonnes (t) of carbon dioxide (CO2) equivalent (eq). 3563 </xs:documentation> 3564 </xs:annotation> 3565 </xs:enumeration> 3566 </xs:restriction> 3567 </xs:simpleType> 3568 </xs:element> 3569 </xs:sequence> 3570 </xs:complexType> 3571 3572 <xs:complexType name="energyProviderType"> 3573 <xs:annotation> 3574 <xs:documentation> 3575 Describes the physical provider of energy used for model development or operations. 3576 </xs:documentation> 3577 </xs:annotation> 3578 <xs:sequence> 3579 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 3580 <xs:annotation> 3581 <xs:documentation> 3582 A description of the energy provider. 3583 </xs:documentation> 3584 </xs:annotation> 3585 </xs:element> 3586 <xs:element name="organization" type="bom:organizationalEntity" minOccurs="1" maxOccurs="1"> 3587 <xs:annotation> 3588 <xs:documentation> 3589 The organization of the energy provider. 3590 </xs:documentation> 3591 </xs:annotation> 3592 </xs:element> 3593 <xs:element name="energySource" minOccurs="1" maxOccurs="1"> 3594 <xs:annotation> 3595 <xs:documentation> 3596 The energy source for the energy provider. 3597 </xs:documentation> 3598 </xs:annotation> 3599 <xs:simpleType> 3600 <xs:restriction base="xs:string"> 3601 <xs:enumeration value="coal"> 3602 <xs:annotation> 3603 <xs:documentation> 3604 Energy produced by types of coal. 3605 </xs:documentation> 3606 </xs:annotation> 3607 </xs:enumeration> 3608 <xs:enumeration value="oil"> 3609 <xs:annotation> 3610 <xs:documentation> 3611 Petroleum products (primarily crude oil and its derivative fuel oils). 3612 </xs:documentation> 3613 </xs:annotation> 3614 </xs:enumeration> 3615 <xs:enumeration value="natural-gas"> 3616 <xs:annotation> 3617 <xs:documentation> 3618 Hydrocarbon gas liquids (HGL) that occur as gases at atmospheric pressure and as liquids under higher pressures including Natural gas (C5H12 and heavier), Ethane (C2H6), Propane (C3H8), etc. 3619 </xs:documentation> 3620 </xs:annotation> 3621 </xs:enumeration> 3622 <xs:enumeration value="nuclear"> 3623 <xs:annotation> 3624 <xs:documentation> 3625 Energy produced from the cores of atoms (i.e., through nuclear fission or fusion). 3626 </xs:documentation> 3627 </xs:annotation> 3628 </xs:enumeration> 3629 <xs:enumeration value="wind"> 3630 <xs:annotation> 3631 <xs:documentation> 3632 Energy produced from moving air. 3633 </xs:documentation> 3634 </xs:annotation> 3635 </xs:enumeration> 3636 <xs:enumeration value="solar"> 3637 <xs:annotation> 3638 <xs:documentation> 3639 Energy produced from the sun (i.e., solar radiation). 3640 </xs:documentation> 3641 </xs:annotation> 3642 </xs:enumeration> 3643 <xs:enumeration value="geothermal"> 3644 <xs:annotation> 3645 <xs:documentation> 3646 Energy produced from heat within the earth. 3647 </xs:documentation> 3648 </xs:annotation> 3649 </xs:enumeration> 3650 <xs:enumeration value="hydropower"> 3651 <xs:annotation> 3652 <xs:documentation> 3653 Energy produced from flowing water. 3654 </xs:documentation> 3655 </xs:annotation> 3656 </xs:enumeration> 3657 <xs:enumeration value="biofuel"> 3658 <xs:annotation> 3659 <xs:documentation> 3660 Liquid fuels produced from biomass feedstocks (i.e., organic materials such as plants or animals). 3661 </xs:documentation> 3662 </xs:annotation> 3663 </xs:enumeration> 3664 <xs:enumeration value="unknown"> 3665 <xs:annotation> 3666 <xs:documentation> 3667 The energy source is unknown. 3668 </xs:documentation> 3669 </xs:annotation> 3670 </xs:enumeration> 3671 <xs:enumeration value="other"> 3672 <xs:annotation> 3673 <xs:documentation> 3674 An energy source that is not listed. 3675 </xs:documentation> 3676 </xs:annotation> 3677 </xs:enumeration> 3678 </xs:restriction> 3679 </xs:simpleType> 3680 </xs:element> 3681 <xs:element name="energyProvided" type="bom:energyMeasureType" minOccurs="1" maxOccurs="1"> 3682 <xs:annotation> 3683 <xs:documentation> 3684 The energy provided by the energy source for an associated activity. 3685 </xs:documentation> 3686 </xs:annotation> 3687 </xs:element> 3688 <xs:element name="externalReferences" type="bom:externalReferences" minOccurs="0" maxOccurs="1"> 3689 <xs:annotation> 3690 <xs:documentation>External references provide a way to document systems, sites, and information that may be relevant but are not included with the BOM. They may also establish specific relationships within or external to the BOM.</xs:documentation> 3691 </xs:annotation> 3692 </xs:element> 3693 </xs:sequence> 3694 <xs:attribute name="bom-ref" type="bom:refType"> 3695 <xs:annotation> 3696 <xs:documentation> 3697 An optional identifier which can be used to reference the energy provider elsewhere in the BOM. 3698 Uniqueness is enforced within all elements and children of the root-level bom element. 3699 </xs:documentation> 3700 </xs:annotation> 3701 </xs:attribute> 3702 </xs:complexType> 3703 3704 <xs:complexType name="postalAddressType"> 3705 <xs:annotation> 3706 <xs:documentation> 3707 An address used to identify a contactable location. 3708 </xs:documentation> 3709 </xs:annotation> 3710 <xs:sequence> 3711 <xs:element name="country" type="xs:string" minOccurs="0" maxOccurs="1"> 3712 <xs:annotation> 3713 <xs:documentation> 3714 The country name or the two-letter ISO 3166-1 country code. 3715 </xs:documentation> 3716 </xs:annotation> 3717 </xs:element> 3718 <xs:element name="region" type="xs:string" minOccurs="0" maxOccurs="1"> 3719 <xs:annotation> 3720 <xs:documentation> 3721 The region or state in the country. For example, Texas. 3722 </xs:documentation> 3723 </xs:annotation> 3724 </xs:element> 3725 <xs:element name="locality" type="xs:string" minOccurs="0" maxOccurs="1"> 3726 <xs:annotation> 3727 <xs:documentation> 3728 The locality or city within the country. For example, Austin. 3729 </xs:documentation> 3730 </xs:annotation> 3731 </xs:element> 3732 <xs:element name="postOfficeBoxNumber" type="xs:string" minOccurs="0" maxOccurs="1"> 3733 <xs:annotation> 3734 <xs:documentation> 3735 The post office box number. For example, 901. 3736 </xs:documentation> 3737 </xs:annotation> 3738 </xs:element> 3739 <xs:element name="postalCode" type="xs:string" minOccurs="0" maxOccurs="1"> 3740 <xs:annotation> 3741 <xs:documentation> 3742 The postal code. For example, 78758. 3743 </xs:documentation> 3744 </xs:annotation> 3745 </xs:element> 3746 <xs:element name="streetAddress" type="xs:string" minOccurs="0" maxOccurs="1"> 3747 <xs:annotation> 3748 <xs:documentation> 3749 The street address. For example, 100 Main Street. 3750 </xs:documentation> 3751 </xs:annotation> 3752 </xs:element> 3753 </xs:sequence> 3754 <xs:attribute name="bom-ref" type="bom:refType"> 3755 <xs:annotation> 3756 <xs:documentation> 3757 An optional identifier which can be used to reference the address elsewhere in the BOM. 3758 Uniqueness is enforced within all elements and children of the root-level bom element. 3759 </xs:documentation> 3760 </xs:annotation> 3761 </xs:attribute> 3762 </xs:complexType> 3763 3764 <xs:simpleType name="machineLearningApproachType"> 3765 <xs:restriction base="xs:string"> 3766 <xs:enumeration value="supervised"> 3767 <xs:annotation> 3768 <xs:documentation> 3769 Supervised machine learning involves training an algorithm on labeled 3770 data to predict or classify new data based on the patterns learned from 3771 the labeled examples. 3772 </xs:documentation> 3773 </xs:annotation> 3774 </xs:enumeration> 3775 <xs:enumeration value="unsupervised"> 3776 <xs:annotation> 3777 <xs:documentation> 3778 Unsupervised machine learning involves training algorithms on unlabeled 3779 data to discover patterns, structures, or relationships without explicit 3780 guidance, allowing the model to identify inherent structures or clusters 3781 within the data. 3782 </xs:documentation> 3783 </xs:annotation> 3784 </xs:enumeration> 3785 <xs:enumeration value="reinforcement-learning"> 3786 <xs:annotation> 3787 <xs:documentation> 3788 Reinforcement learning is a type of machine learning where an agent learns 3789 to make decisions by interacting with an environment to maximize cumulative 3790 rewards, through trial and error. 3791 </xs:documentation> 3792 </xs:annotation> 3793 </xs:enumeration> 3794 <xs:enumeration value="semi-supervised"> 3795 <xs:annotation> 3796 <xs:documentation> 3797 Semi-supervised machine learning utilizes a combination of labeled and 3798 unlabeled data during training to improve model performance, leveraging 3799 the benefits of both supervised and unsupervised learning techniques. 3800 </xs:documentation> 3801 </xs:annotation> 3802 </xs:enumeration> 3803 <xs:enumeration value="self-supervised"> 3804 <xs:annotation> 3805 <xs:documentation> 3806 Self-supervised machine learning involves training models to predict parts 3807 of the input data from other parts of the same data, without requiring 3808 external labels, enabling learning from large amounts of unlabeled data. 3809 </xs:documentation> 3810 </xs:annotation> 3811 </xs:enumeration> 3812 </xs:restriction> 3813 </xs:simpleType> 3814 3815 <xs:complexType name="componentDataType"> 3816 <xs:sequence> 3817 <xs:element name="type" type="bom:componentDataTypeEnumeration" minOccurs="1" maxOccurs="1"> 3818 <xs:annotation> 3819 <xs:documentation> 3820 The general theme or subject matter of the data being specified. 3821 </xs:documentation> 3822 </xs:annotation> 3823 </xs:element> 3824 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 3825 <xs:annotation> 3826 <xs:documentation> 3827 The name of the dataset. 3828 </xs:documentation> 3829 </xs:annotation> 3830 </xs:element> 3831 <xs:element name="contents" minOccurs="0" maxOccurs="1"> 3832 <xs:annotation> 3833 <xs:documentation> 3834 The contents or references to the contents of the data being described. 3835 </xs:documentation> 3836 </xs:annotation> 3837 <xs:complexType> 3838 <xs:sequence> 3839 <xs:element name="attachment" type="bom:attachedTextType" minOccurs="0" maxOccurs="1"> 3840 <xs:annotation> 3841 <xs:documentation>An optional way to include textual or encoded data.</xs:documentation> 3842 </xs:annotation> 3843 </xs:element> 3844 <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 3845 <xs:annotation> 3846 <xs:documentation>The URL to where the data can be retrieved.</xs:documentation> 3847 </xs:annotation> 3848 </xs:element> 3849 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 3850 <xs:annotation> 3851 <xs:documentation>Provides the ability to document name-value parameters used for configuration.</xs:documentation> 3852 </xs:annotation> 3853 </xs:element> 3854 </xs:sequence> 3855 </xs:complexType> 3856 </xs:element> 3857 <xs:element name="classification" type="xs:string" minOccurs="0" maxOccurs="1"> 3858 <xs:annotation> 3859 <xs:documentation> 3860 Data classification tags data according to its type, sensitivity, and value if altered, stolen, or destroyed. 3861 </xs:documentation> 3862 </xs:annotation> 3863 </xs:element> 3864 <xs:element name="sensitiveData" minOccurs="0" maxOccurs="unbounded"> 3865 <xs:annotation> 3866 <xs:documentation> 3867 A description of any sensitive data in a dataset. 3868 </xs:documentation> 3869 </xs:annotation> 3870 </xs:element> 3871 <xs:element name="graphics" type="bom:graphicsCollectionType" minOccurs="0" maxOccurs="1"> 3872 <xs:annotation> 3873 <xs:documentation> 3874 A collection of graphics that represent various measurements. 3875 </xs:documentation> 3876 </xs:annotation> 3877 </xs:element> 3878 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 3879 <xs:annotation> 3880 <xs:documentation> 3881 A description of the dataset. Can describe size of dataset, whether it's used for source code, 3882 training, testing, or validation, etc. 3883 </xs:documentation> 3884 </xs:annotation> 3885 </xs:element> 3886 <xs:element name="governance" type="bom:dataGovernance" minOccurs="0" maxOccurs="1" /> 3887 </xs:sequence> 3888 <xs:attribute name="bom-ref" type="bom:refType"> 3889 <xs:annotation> 3890 <xs:documentation> 3891 An optional identifier which can be used to reference the dataset elsewhere in the BOM. 3892 Every bom-ref MUST be unique within the BOM. 3893 </xs:documentation> 3894 </xs:annotation> 3895 </xs:attribute> 3896 </xs:complexType> 3897 3898 <xs:complexType name="dataGovernance"> 3899 <xs:sequence> 3900 <xs:element name="custodians" minOccurs="0" maxOccurs="1"> 3901 <xs:annotation> 3902 <xs:documentation> 3903 Data custodians are responsible for the safe custody, transport, and storage of data. 3904 </xs:documentation> 3905 </xs:annotation> 3906 <xs:complexType> 3907 <xs:sequence> 3908 <xs:element name="custodian" type="bom:organizationOrIndividualType" minOccurs="0" maxOccurs="unbounded"/> 3909 </xs:sequence> 3910 </xs:complexType> 3911 </xs:element> 3912 <xs:element name="stewards" minOccurs="0" maxOccurs="1"> 3913 <xs:annotation> 3914 <xs:documentation> 3915 Data stewards are responsible for data content, context, and associated business rules. 3916 </xs:documentation> 3917 </xs:annotation> 3918 <xs:complexType> 3919 <xs:sequence> 3920 <xs:element name="steward" type="bom:organizationOrIndividualType" minOccurs="0" maxOccurs="unbounded"/> 3921 </xs:sequence> 3922 </xs:complexType> 3923 </xs:element> 3924 <xs:element name="owners" minOccurs="0" maxOccurs="1"> 3925 <xs:annotation> 3926 <xs:documentation> 3927 Data owners are concerned with risk and appropriate access to data. 3928 </xs:documentation> 3929 </xs:annotation> 3930 <xs:complexType> 3931 <xs:sequence> 3932 <xs:element name="owner" type="bom:organizationOrIndividualType" minOccurs="0" maxOccurs="unbounded"/> 3933 </xs:sequence> 3934 </xs:complexType> 3935 </xs:element> 3936 </xs:sequence> 3937 </xs:complexType> 3938 3939 <xs:complexType name="organizationOrIndividualType"> 3940 <xs:choice> 3941 <xs:element name="organization" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1" /> 3942 <xs:element name="individual" type="bom:organizationalContact" minOccurs="0" maxOccurs="1" /> 3943 </xs:choice> 3944 </xs:complexType> 3945 3946 <xs:complexType name="graphicsCollectionType"> 3947 <xs:annotation> 3948 <xs:documentation> 3949 A collection of graphics that represent various measurements. 3950 </xs:documentation> 3951 </xs:annotation> 3952 <xs:sequence> 3953 <xs:element name="description" minOccurs="0" maxOccurs="1"> 3954 <xs:annotation> 3955 <xs:documentation> 3956 A description of this collection of graphics. 3957 </xs:documentation> 3958 </xs:annotation> 3959 </xs:element> 3960 <xs:element name="collection" minOccurs="0" maxOccurs="1"> 3961 <xs:annotation> 3962 <xs:documentation> 3963 A collection of graphics. 3964 </xs:documentation> 3965 </xs:annotation> 3966 <xs:complexType> 3967 <xs:sequence> 3968 <xs:element name="graphic" minOccurs="0" maxOccurs="unbounded"> 3969 <xs:complexType> 3970 <xs:sequence> 3971 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 3972 <xs:annotation> 3973 <xs:documentation> 3974 The name of the graphic. 3975 </xs:documentation> 3976 </xs:annotation> 3977 </xs:element> 3978 <xs:element name="image" type="bom:attachedTextType" minOccurs="0" maxOccurs="1"> 3979 <xs:annotation> 3980 <xs:documentation> 3981 The graphic (vector or raster). Base64 encoding MUST be specified for binary images. 3982 </xs:documentation> 3983 </xs:annotation> 3984 </xs:element> 3985 </xs:sequence> 3986 </xs:complexType> 3987 </xs:element> 3988 </xs:sequence> 3989 </xs:complexType> 3990 </xs:element> 3991 </xs:sequence> 3992 </xs:complexType> 3993 3994 <xs:simpleType name="componentDataTypeEnumeration"> 3995 <xs:restriction base="xs:string"> 3996 <xs:enumeration value="source-code"> 3997 <xs:annotation> 3998 <xs:documentation>Any type of code, code snippet, or data-as-code.</xs:documentation> 3999 </xs:annotation> 4000 </xs:enumeration> 4001 <xs:enumeration value="configuration"> 4002 <xs:annotation> 4003 <xs:documentation>Parameters or settings that may be used by other components.</xs:documentation> 4004 </xs:annotation> 4005 </xs:enumeration> 4006 <xs:enumeration value="dataset"> 4007 <xs:annotation> 4008 <xs:documentation>A collection of data.</xs:documentation> 4009 </xs:annotation> 4010 </xs:enumeration> 4011 <xs:enumeration value="definition"> 4012 <xs:annotation> 4013 <xs:documentation>Data that can be used to create new instances of what the definition defines.</xs:documentation> 4014 </xs:annotation> 4015 </xs:enumeration> 4016 <xs:enumeration value="other"> 4017 <xs:annotation> 4018 <xs:documentation>Any other type of data that does not fit into existing definitions.</xs:documentation> 4019 </xs:annotation> 4020 </xs:enumeration> 4021 </xs:restriction> 4022 </xs:simpleType> 4023 4024 <xs:complexType name="bomReferenceType"> 4025 <xs:attribute name="ref" use="required"> 4026 <xs:annotation> 4027 <xs:documentation>References a component or service by its bom-ref attribute</xs:documentation> 4028 </xs:annotation> 4029 <xs:simpleType> 4030 <xs:union memberTypes="bom:refLinkType bom:bomLinkType"/> 4031 </xs:simpleType> 4032 </xs:attribute> 4033 <xs:anyAttribute namespace="##other" processContents="lax"> 4034 <xs:annotation> 4035 <xs:documentation>User-defined attributes may be used on this element as long as they 4036 do not have the same name as an existing attribute used by the schema.</xs:documentation> 4037 </xs:annotation> 4038 </xs:anyAttribute> 4039 </xs:complexType> 4040 4041 <xs:complexType name="propertiesType"> 4042 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4043 <xs:element name="property" type="bom:propertyType"/> 4044 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 4045 <xs:annotation> 4046 <xs:documentation> 4047 Allows any undeclared elements as long as the elements are placed in a different namespace. 4048 </xs:documentation> 4049 </xs:annotation> 4050 </xs:any> 4051 </xs:sequence> 4052 <xs:anyAttribute namespace="##any" processContents="lax"> 4053 <xs:annotation> 4054 <xs:documentation>User-defined attributes may be used on this element as long as they 4055 do not have the same name as an existing attribute used by the schema.</xs:documentation> 4056 </xs:annotation> 4057 </xs:anyAttribute> 4058 </xs:complexType> 4059 4060 <xs:complexType name="propertyType"> 4061 <xs:annotation> 4062 <xs:documentation>Specifies an individual property with a name and value.</xs:documentation> 4063 </xs:annotation> 4064 <xs:simpleContent> 4065 <xs:extension base="xs:normalizedString"> 4066 <xs:attribute name="name" type="xs:string" use="required"> 4067 <xs:annotation> 4068 <xs:documentation>The name of the property. Duplicate names are allowed, each potentially having a different value.</xs:documentation> 4069 </xs:annotation> 4070 </xs:attribute> 4071 </xs:extension> 4072 </xs:simpleContent> 4073 </xs:complexType> 4074 4075 <xs:complexType name="vulnerabilitiesType"> 4076 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4077 <xs:element name="vulnerability" type="bom:vulnerabilityType"> 4078 <xs:annotation> 4079 <xs:documentation>Defines a weakness in a component or service that could be exploited or triggered by a threat source.</xs:documentation> 4080 </xs:annotation> 4081 </xs:element> 4082 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 4083 <xs:annotation> 4084 <xs:documentation> 4085 Allows any undeclared elements as long as the elements are placed in a different namespace. 4086 </xs:documentation> 4087 </xs:annotation> 4088 </xs:any> 4089 </xs:sequence> 4090 <xs:anyAttribute namespace="##any" processContents="lax"> 4091 <xs:annotation> 4092 <xs:documentation>User-defined attributes may be used on this element as long as they 4093 do not have the same name as an existing attribute used by the schema.</xs:documentation> 4094 </xs:annotation> 4095 </xs:anyAttribute> 4096 </xs:complexType> 4097 4098 <xs:complexType name="vulnerabilityType"> 4099 <xs:sequence minOccurs="0" maxOccurs="1"> 4100 <xs:element name="id" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 4101 <xs:annotation> 4102 <xs:documentation>The identifier that uniquely identifies the vulnerability. For example: 4103 CVE-2021-39182, GHSA-35m5-8cvj-8783, and SNYK-PYTHON-ENROCRYPT-1912876.</xs:documentation> 4104 </xs:annotation> 4105 </xs:element> 4106 <xs:element name="source" type="bom:vulnerabilitySourceType" minOccurs="0" maxOccurs="1"> 4107 <xs:annotation> 4108 <xs:documentation>The source that published the vulnerability.</xs:documentation> 4109 </xs:annotation> 4110 </xs:element> 4111 <xs:element name="references" minOccurs="0" maxOccurs="1"> 4112 <xs:annotation> 4113 <xs:documentation>Zero or more pointers to vulnerabilities that are the equivalent of the 4114 vulnerability specified. Often times, the same vulnerability may exist in multiple sources of 4115 vulnerability intelligence, but have different identifiers. References provide a way to 4116 correlate vulnerabilities across multiple sources of vulnerability intelligence.</xs:documentation> 4117 </xs:annotation> 4118 <xs:complexType> 4119 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4120 <xs:element name="reference"> 4121 <xs:annotation> 4122 <xs:documentation>A pointer to a vulnerability that is the equivalent of the 4123 vulnerability specified.</xs:documentation> 4124 </xs:annotation> 4125 <xs:complexType> 4126 <xs:sequence minOccurs="1" maxOccurs="1"> 4127 <xs:element name="id" type="xs:normalizedString" minOccurs="1" maxOccurs="1"> 4128 <xs:annotation> 4129 <xs:documentation>The identifier that uniquely identifies the vulnerability. For example: 4130 CVE-2021-39182, GHSA-35m5-8cvj-8783, and SNYK-PYTHON-ENROCRYPT-1912876.</xs:documentation> 4131 </xs:annotation> 4132 </xs:element> 4133 <xs:element name="source" type="bom:vulnerabilitySourceType" minOccurs="1" maxOccurs="1"> 4134 <xs:annotation> 4135 <xs:documentation>The source that published the vulnerability.</xs:documentation> 4136 </xs:annotation> 4137 </xs:element> 4138 </xs:sequence> 4139 </xs:complexType> 4140 </xs:element> 4141 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 4142 <xs:annotation> 4143 <xs:documentation> 4144 Allows any undeclared elements as long as the elements are placed in a different namespace. 4145 </xs:documentation> 4146 </xs:annotation> 4147 </xs:any> 4148 </xs:sequence> 4149 </xs:complexType> 4150 </xs:element> 4151 <xs:element name="ratings" minOccurs="0" maxOccurs="1"> 4152 <xs:annotation> 4153 <xs:documentation xml:lang="en">List of vulnerability ratings.</xs:documentation> 4154 </xs:annotation> 4155 <xs:complexType> 4156 <xs:sequence> 4157 <xs:element name="rating" type="bom:ratingType" minOccurs="0" maxOccurs="unbounded"/> 4158 </xs:sequence> 4159 </xs:complexType> 4160 </xs:element> 4161 <xs:element name="cwes" minOccurs="0" maxOccurs="1"> 4162 <xs:complexType> 4163 <xs:annotation> 4164 <xs:documentation xml:lang="en"> 4165 List of Common Weaknesses Enumerations (CWEs) codes that describes this vulnerability. 4166 For example 399 (of https://cwe.mitre.org/data/definitions/399.html) 4167 </xs:documentation> 4168 </xs:annotation> 4169 <xs:sequence> 4170 <xs:element name="cwe" type="xs:integer" minOccurs="0" maxOccurs="unbounded"/> 4171 </xs:sequence> 4172 </xs:complexType> 4173 </xs:element> 4174 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 4175 <xs:annotation> 4176 <xs:documentation>A description of the vulnerability as provided by the source.</xs:documentation> 4177 </xs:annotation> 4178 </xs:element> 4179 <xs:element name="detail" type="xs:string" minOccurs="0" maxOccurs="1"> 4180 <xs:annotation> 4181 <xs:documentation>If available, an in-depth description of the vulnerability as provided by the 4182 source organization. Details often include information useful in understanding root cause.</xs:documentation> 4183 </xs:annotation> 4184 </xs:element> 4185 <xs:element name="recommendation" type="xs:string" minOccurs="0" maxOccurs="1"> 4186 <xs:annotation> 4187 <xs:documentation>Recommendations of how the vulnerability can be remediated or mitigated.</xs:documentation> 4188 </xs:annotation> 4189 </xs:element> 4190 <xs:element name="workaround" type="xs:string" minOccurs="0" maxOccurs="1"> 4191 <xs:annotation> 4192 <xs:documentation>A bypass, usually temporary, of the vulnerability that reduces its likelihood and/or impact. Workarounds often involve changes to configuration or deployments.</xs:documentation> 4193 </xs:annotation> 4194 </xs:element> 4195 <xs:element name="proofOfConcept" minOccurs="0" maxOccurs="1"> 4196 <xs:complexType> 4197 <xs:annotation> 4198 <xs:documentation xml:lang="en"> 4199 Evidence used to reproduce the vulnerability. 4200 </xs:documentation> 4201 </xs:annotation> 4202 <xs:sequence> 4203 <xs:element name="reproductionSteps" type="xs:string" minOccurs="0" maxOccurs="1"> 4204 <xs:annotation> 4205 <xs:documentation>Precise steps to reproduce the vulnerability.</xs:documentation> 4206 </xs:annotation> 4207 </xs:element> 4208 <xs:element name="environment" type="xs:string" minOccurs="0" maxOccurs="1"> 4209 <xs:annotation> 4210 <xs:documentation>A description of the environment in which reproduction was possible.</xs:documentation> 4211 </xs:annotation> 4212 </xs:element> 4213 <xs:element name="supportingMaterial" minOccurs="0" maxOccurs="1"> 4214 <xs:annotation> 4215 <xs:documentation>Supporting material that helps in reproducing or understanding how reproduction is possible. This may include screenshots, payloads, and PoC exploit code.</xs:documentation> 4216 </xs:annotation> 4217 <xs:complexType> 4218 <xs:sequence> 4219 <xs:element name="attachment" type="bom:attachedTextType" minOccurs="0" maxOccurs="unbounded" /> 4220 </xs:sequence> 4221 </xs:complexType> 4222 </xs:element> 4223 </xs:sequence> 4224 </xs:complexType> 4225 </xs:element> 4226 <xs:element name="advisories" minOccurs="0" maxOccurs="1"> 4227 <xs:complexType> 4228 <xs:annotation> 4229 <xs:documentation xml:lang="en"> 4230 Published advisories of the vulnerability if provided. 4231 </xs:documentation> 4232 </xs:annotation> 4233 <xs:sequence> 4234 <xs:element name="advisory" type="bom:advisoryType" minOccurs="0" maxOccurs="unbounded"/> 4235 </xs:sequence> 4236 </xs:complexType> 4237 </xs:element> 4238 <xs:element name="created" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 4239 <xs:annotation> 4240 <xs:documentation>The date and time (timestamp) when the vulnerability record was created in the vulnerability database.</xs:documentation> 4241 </xs:annotation> 4242 </xs:element> 4243 <xs:element name="published" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 4244 <xs:annotation> 4245 <xs:documentation>The date and time (timestamp) when the vulnerability record was first published.</xs:documentation> 4246 </xs:annotation> 4247 </xs:element> 4248 <xs:element name="updated" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 4249 <xs:annotation> 4250 <xs:documentation>The date and time (timestamp) when the vulnerability record was last updated.</xs:documentation> 4251 </xs:annotation> 4252 </xs:element> 4253 <xs:element name="rejected" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 4254 <xs:annotation> 4255 <xs:documentation>The date and time (timestamp) when the vulnerability record was rejected (if applicable).</xs:documentation> 4256 </xs:annotation> 4257 </xs:element> 4258 <xs:element name="credits" minOccurs="0" maxOccurs="1"> 4259 <xs:annotation> 4260 <xs:documentation>Individuals or organizations credited with the discovery of the vulnerability.</xs:documentation> 4261 </xs:annotation> 4262 <xs:complexType> 4263 <xs:sequence> 4264 <xs:element name="organizations" minOccurs="0" maxOccurs="1"> 4265 <xs:annotation> 4266 <xs:documentation>The organizations credited with vulnerability discovery.</xs:documentation> 4267 </xs:annotation> 4268 <xs:complexType> 4269 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4270 <xs:element name="organization" type="bom:organizationalEntity"/> 4271 </xs:sequence> 4272 </xs:complexType> 4273 </xs:element> 4274 <xs:element name="individuals" minOccurs="0" maxOccurs="1"> 4275 <xs:annotation> 4276 <xs:documentation>The individuals, not associated with organizations, that are credited with vulnerability discovery.</xs:documentation> 4277 </xs:annotation> 4278 <xs:complexType> 4279 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4280 <xs:element name="individual" type="bom:organizationalContact"/> 4281 </xs:sequence> 4282 </xs:complexType> 4283 </xs:element> 4284 </xs:sequence> 4285 </xs:complexType> 4286 </xs:element> 4287 <xs:element name="tools" minOccurs="0" maxOccurs="1"> 4288 <xs:annotation> 4289 <xs:documentation>The tool(s) used to identify, confirm, or score the vulnerability.</xs:documentation> 4290 </xs:annotation> 4291 <xs:complexType> 4292 <xs:choice> 4293 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4294 <xs:element name="tool" minOccurs="0" type="bom:toolType"> 4295 <xs:annotation> 4296 <xs:documentation>DEPRECATED. Use tools\components or tools\services instead.</xs:documentation> 4297 </xs:annotation> 4298 </xs:element> 4299 </xs:sequence> 4300 <xs:sequence minOccurs="0" maxOccurs="1"> 4301 <xs:element name="components" type="bom:componentsType" minOccurs="0" maxOccurs="1"> 4302 <xs:annotation> 4303 <xs:documentation>A list of software and hardware components used as tools.</xs:documentation> 4304 </xs:annotation> 4305 </xs:element> 4306 <xs:element name="services" type="bom:servicesType" minOccurs="0" maxOccurs="1"> 4307 <xs:annotation> 4308 <xs:documentation>A list of services used as tools.</xs:documentation> 4309 </xs:annotation> 4310 </xs:element> 4311 </xs:sequence> 4312 </xs:choice> 4313 </xs:complexType> 4314 </xs:element> 4315 <xs:element name="analysis" minOccurs="0" maxOccurs="1"> 4316 <xs:complexType> 4317 <xs:annotation> 4318 <xs:documentation xml:lang="en"> 4319 An assessment of the impact and exploitability of the vulnerability. 4320 </xs:documentation> 4321 </xs:annotation> 4322 <xs:sequence minOccurs="0" maxOccurs="1"> 4323 <xs:element name="state" type="bom:impactAnalysisStateType" minOccurs="0" maxOccurs="1"> 4324 <xs:annotation> 4325 <xs:documentation xml:lang="en"> 4326 Declares the current state of an occurrence of a vulnerability, after automated or manual analysis. 4327 </xs:documentation> 4328 </xs:annotation> 4329 </xs:element> 4330 <xs:element name="justification" type="bom:impactAnalysisJustificationType" minOccurs="0" maxOccurs="1"> 4331 <xs:annotation> 4332 <xs:documentation xml:lang="en"> 4333 The rationale of why the impact analysis state was asserted. 4334 </xs:documentation> 4335 </xs:annotation> 4336 </xs:element> 4337 <xs:element name="responses" minOccurs="0" maxOccurs="1"> 4338 <xs:annotation> 4339 <xs:documentation>A response to the vulnerability by the manufacturer, supplier, or 4340 project responsible for the affected component or service. More than one response 4341 is allowed. Responses are strongly encouraged for vulnerabilities where the analysis 4342 state is exploitable.</xs:documentation> 4343 </xs:annotation> 4344 <xs:complexType> 4345 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4346 <xs:element name="response" type="bom:impactAnalysisResponsesType"/> 4347 </xs:sequence> 4348 </xs:complexType> 4349 </xs:element> 4350 <xs:element name="detail" type="xs:string" minOccurs="0" maxOccurs="1"> 4351 <xs:annotation> 4352 <xs:documentation xml:lang="en"> 4353 Detailed description of the impact including methods used during assessment. 4354 If a vulnerability is not exploitable, this field should include specific details 4355 on why the component or service is not impacted by this vulnerability. 4356 </xs:documentation> 4357 </xs:annotation> 4358 </xs:element> 4359 <xs:element name="firstIssued" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 4360 <xs:annotation> 4361 <xs:documentation xml:lang="en"> 4362 The date and time (timestamp) when the analysis was first issued. 4363 </xs:documentation> 4364 </xs:annotation> 4365 </xs:element> 4366 <xs:element name="lastUpdated" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 4367 <xs:annotation> 4368 <xs:documentation xml:lang="en"> 4369 The date and time (timestamp) when the analysis was last updated. 4370 </xs:documentation> 4371 </xs:annotation> 4372 </xs:element> 4373 </xs:sequence> 4374 </xs:complexType> 4375 </xs:element> 4376 <xs:element name="affects" minOccurs="0" maxOccurs="1"> 4377 <xs:annotation> 4378 <xs:documentation>The components or services that are affected by the vulnerability.</xs:documentation> 4379 </xs:annotation> 4380 <xs:complexType> 4381 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4382 <xs:element name="target"> 4383 <xs:complexType> 4384 <xs:sequence minOccurs="0" maxOccurs="1"> 4385 <xs:element name="ref" minOccurs="1" maxOccurs="1"> 4386 <xs:annotation> 4387 <xs:documentation>References a component or service by the objects bom-ref.</xs:documentation> 4388 </xs:annotation> 4389 <xs:simpleType> 4390 <xs:union memberTypes="bom:refLinkType bom:bomLinkElementType"/> 4391 </xs:simpleType> 4392 </xs:element> 4393 <xs:element name="versions" minOccurs="0" maxOccurs="1"> 4394 <xs:annotation> 4395 <xs:documentation>Zero or more individual versions or range of versions.</xs:documentation> 4396 </xs:annotation> 4397 <xs:complexType> 4398 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4399 <xs:element name="version"> 4400 <xs:complexType> 4401 <xs:sequence minOccurs="0" maxOccurs="1"> 4402 <xs:choice> 4403 <xs:element name="version" type="bom:versionType" minOccurs="1" maxOccurs="1"> 4404 <xs:annotation> 4405 <xs:documentation>A single version of a component or service.</xs:documentation> 4406 </xs:annotation> 4407 </xs:element> 4408 <xs:element name="range" type="bom:versionRangeType" minOccurs="1" maxOccurs="1"> 4409 <xs:annotation> 4410 <xs:documentation>A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/purl-spec/VERSION-RANGE-SPEC.rst</xs:documentation> 4411 </xs:annotation> 4412 </xs:element> 4413 </xs:choice> 4414 <xs:element name="status" type="bom:impactAnalysisAffectedStatusType" minOccurs="0" maxOccurs="1" default="affected"> 4415 <xs:annotation> 4416 <xs:documentation> 4417 The vulnerability status for the version or range of versions. 4418 </xs:documentation> 4419 </xs:annotation> 4420 </xs:element> 4421 </xs:sequence> 4422 </xs:complexType> 4423 </xs:element> 4424 </xs:sequence> 4425 </xs:complexType> 4426 </xs:element> 4427 </xs:sequence> 4428 </xs:complexType> 4429 </xs:element> 4430 </xs:sequence> 4431 </xs:complexType> 4432 </xs:element> 4433 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 4434 <xs:annotation> 4435 <xs:documentation>Provides the ability to document properties in a name/value store. 4436 This provides flexibility to include data not officially supported in the standard 4437 without having to use additional namespaces or create extensions. Property names 4438 of interest to the general public are encouraged to be registered in the 4439 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 4440 Formal registration is OPTIONAL.</xs:documentation> 4441 </xs:annotation> 4442 </xs:element> 4443 </xs:sequence> 4444 <xs:attribute name="bom-ref" type="bom:refType"> 4445 <xs:annotation> 4446 <xs:documentation> 4447 An optional identifier which can be used to reference the vulnerability elsewhere in the BOM. 4448 Uniqueness is enforced within all elements and children of the root-level bom element. 4449 </xs:documentation> 4450 </xs:annotation> 4451 </xs:attribute> 4452 </xs:complexType> 4453 4454 <xs:complexType name="vulnerabilitySourceType"> 4455 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4456 <xs:element name="name" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 4457 <xs:annotation> 4458 <xs:documentation>The name of the source. 4459 For example: NVD, National Vulnerability Database, OSS Index, VulnDB, and GitHub Advisories 4460 </xs:documentation> 4461 </xs:annotation> 4462 </xs:element> 4463 <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 4464 <xs:annotation> 4465 <xs:documentation>The url of the vulnerability documentation as provided by the source. 4466 For example: https://nvd.nist.gov/vuln/detail/CVE-2021-39182</xs:documentation> 4467 </xs:annotation> 4468 </xs:element> 4469 </xs:sequence> 4470 </xs:complexType> 4471 4472 <xs:complexType name="ratingType"> 4473 <xs:sequence> 4474 <xs:element name="source" type="bom:vulnerabilitySourceType" minOccurs="0" maxOccurs="1"> 4475 <xs:annotation> 4476 <xs:documentation>The source that calculated the severity or risk rating of the vulnerability.</xs:documentation> 4477 </xs:annotation> 4478 </xs:element> 4479 <xs:element name="score" type="xs:decimal" minOccurs="0" maxOccurs="1"> 4480 <xs:annotation> 4481 <xs:documentation>The numerical score of the rating.</xs:documentation> 4482 </xs:annotation> 4483 </xs:element> 4484 <xs:element name="severity" type="bom:severityType" minOccurs="0" maxOccurs="1"> 4485 <xs:annotation> 4486 <xs:documentation>Textual representation of the severity that corresponds to the numerical score of the rating.</xs:documentation> 4487 </xs:annotation> 4488 </xs:element> 4489 <xs:element name="method" type="bom:scoreSourceType" minOccurs="0" maxOccurs="1"> 4490 <xs:annotation> 4491 <xs:documentation>The risk scoring methodology/standard used.</xs:documentation> 4492 </xs:annotation> 4493 </xs:element> 4494 <xs:element name="vector" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 4495 <xs:annotation> 4496 <xs:documentation>Textual representation of the metric values used to score the vulnerability.</xs:documentation> 4497 </xs:annotation> 4498 </xs:element> 4499 <xs:element name="justification" type="xs:string" minOccurs="0" maxOccurs="1"> 4500 <xs:annotation> 4501 <xs:documentation>An optional reason for rating the vulnerability as it was.</xs:documentation> 4502 </xs:annotation> 4503 </xs:element> 4504 </xs:sequence> 4505 </xs:complexType> 4506 4507 <xs:complexType name="advisoryType"> 4508 <xs:sequence> 4509 <xs:element name="title" type="xs:normalizedString" minOccurs="0" maxOccurs="1"> 4510 <xs:annotation> 4511 <xs:documentation>An optional name of the advisory.</xs:documentation> 4512 </xs:annotation> 4513 </xs:element> 4514 <xs:element name="url" type="xs:anyURI" minOccurs="1" maxOccurs="1"> 4515 <xs:annotation> 4516 <xs:documentation>Location where the advisory can be obtained.</xs:documentation> 4517 </xs:annotation> 4518 </xs:element> 4519 </xs:sequence> 4520 </xs:complexType> 4521 4522 <xs:complexType name="annotationsType"> 4523 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4524 <xs:element name="annotation" type="bom:annotationType"/> 4525 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 4526 <xs:annotation> 4527 <xs:documentation> 4528 Allows any undeclared elements as long as the elements are placed in a different namespace. 4529 </xs:documentation> 4530 </xs:annotation> 4531 </xs:any> 4532 </xs:sequence> 4533 <xs:anyAttribute namespace="##any" processContents="lax"> 4534 <xs:annotation> 4535 <xs:documentation>User-defined attributes may be used on this element as long as they 4536 do not have the same name as an existing attribute used by the schema.</xs:documentation> 4537 </xs:annotation> 4538 </xs:anyAttribute> 4539 </xs:complexType> 4540 4541 <xs:complexType name="annotatorChoiceType"> 4542 <xs:choice> 4543 <xs:element name="organization" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 4544 <xs:annotation> 4545 <xs:documentation>The organization that created the annotation</xs:documentation> 4546 </xs:annotation> 4547 </xs:element> 4548 <xs:element name="individual" type="bom:organizationalContact" minOccurs="0" maxOccurs="1"> 4549 <xs:annotation> 4550 <xs:documentation>The person that created the annotation</xs:documentation> 4551 </xs:annotation> 4552 </xs:element> 4553 <xs:element name="component" type="bom:component" minOccurs="0" maxOccurs="1"> 4554 <xs:annotation> 4555 <xs:documentation>The tool or component that created the annotation</xs:documentation> 4556 </xs:annotation> 4557 </xs:element> 4558 <xs:element name="service" type="bom:service" minOccurs="0" maxOccurs="1"> 4559 <xs:annotation> 4560 <xs:documentation>The service that created the annotation</xs:documentation> 4561 </xs:annotation> 4562 </xs:element> 4563 </xs:choice> 4564 </xs:complexType> 4565 4566 <xs:complexType name="annotationType"> 4567 <xs:sequence> 4568 <xs:element name="subjects" minOccurs="0" maxOccurs="1"> 4569 <xs:annotation> 4570 <xs:documentation> 4571 The objects in the BOM identified by their bom-ref's. This is often components or services, but may be any object type supporting bom-refs. 4572 </xs:documentation> 4573 </xs:annotation> 4574 <xs:complexType> 4575 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4576 <xs:element name="subject" type="bom:bomReferenceType"/> 4577 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 4578 <xs:annotation> 4579 <xs:documentation> 4580 Allows any undeclared elements as long as the elements are placed in a different namespace. 4581 </xs:documentation> 4582 </xs:annotation> 4583 </xs:any> 4584 </xs:sequence> 4585 </xs:complexType> 4586 </xs:element> 4587 <xs:element name="annotator" type="bom:annotatorChoiceType" minOccurs="1" maxOccurs="1"> 4588 <xs:annotation> 4589 <xs:documentation>The organization, individual, component, or service which created the textual content 4590 of the annotation.</xs:documentation> 4591 </xs:annotation> 4592 </xs:element> 4593 <xs:element name="timestamp" type="xs:dateTime" minOccurs="1" maxOccurs="1"> 4594 <xs:annotation> 4595 <xs:documentation>The date and time (timestamp) when the annotation was created.</xs:documentation> 4596 </xs:annotation> 4597 </xs:element> 4598 <xs:element name="text" type="xs:string" minOccurs="1" maxOccurs="1"> 4599 <xs:annotation> 4600 <xs:documentation>The textual content of the annotation.</xs:documentation> 4601 </xs:annotation> 4602 </xs:element> 4603 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 4604 <xs:annotation> 4605 <xs:documentation> 4606 Allows any undeclared elements as long as the elements are placed in a different namespace. 4607 </xs:documentation> 4608 </xs:annotation> 4609 </xs:any> 4610 </xs:sequence> 4611 <xs:attribute name="bom-ref" type="bom:refType"> 4612 <xs:annotation> 4613 <xs:documentation> 4614 An optional identifier which can be used to reference the annotation elsewhere in the BOM. 4615 Uniqueness is enforced within all elements and children of the root-level bom element. 4616 </xs:documentation> 4617 </xs:annotation> 4618 </xs:attribute> 4619 <xs:anyAttribute namespace="##any" processContents="lax"> 4620 <xs:annotation> 4621 <xs:documentation>User-defined attributes may be used on this element as long as they 4622 do not have the same name as an existing attribute used by the schema.</xs:documentation> 4623 </xs:annotation> 4624 </xs:anyAttribute> 4625 </xs:complexType> 4626 4627 <xs:simpleType name="severityType" final="restriction"> 4628 <xs:annotation> 4629 <xs:documentation xml:lang="en"> 4630 Textual representation of the severity of the vulnerability adopted by the analysis method. If the 4631 analysis method uses values other than what is provided, the user is expected to translate appropriately. 4632 </xs:documentation> 4633 </xs:annotation> 4634 <xs:restriction base="xs:string"> 4635 <xs:enumeration value="critical"/> 4636 <xs:enumeration value="high"/> 4637 <xs:enumeration value="medium"/> 4638 <xs:enumeration value="low"/> 4639 <xs:enumeration value="info"/> 4640 <xs:enumeration value="none"/> 4641 <xs:enumeration value="unknown"/> 4642 </xs:restriction> 4643 </xs:simpleType> 4644 4645 <xs:simpleType name="impactAnalysisStateType" final="restriction"> 4646 <xs:annotation> 4647 <xs:documentation xml:lang="en"> 4648 Declares the current state of an occurrence of a vulnerability, after automated or manual analysis. 4649 </xs:documentation> 4650 </xs:annotation> 4651 <xs:restriction base="xs:string"> 4652 <xs:enumeration value="resolved"> 4653 <xs:annotation> 4654 <xs:documentation> 4655 The vulnerability has been remediated. 4656 </xs:documentation> 4657 </xs:annotation> 4658 </xs:enumeration> 4659 <xs:enumeration value="resolved_with_pedigree"> 4660 <xs:annotation> 4661 <xs:documentation> 4662 The vulnerability has been remediated and evidence of the changes are provided in the affected 4663 components pedigree containing verifiable commit history and/or diff(s). 4664 </xs:documentation> 4665 </xs:annotation> 4666 </xs:enumeration> 4667 <xs:enumeration value="exploitable"> 4668 <xs:annotation> 4669 <xs:documentation> 4670 The vulnerability may be directly or indirectly exploitable. 4671 </xs:documentation> 4672 </xs:annotation> 4673 </xs:enumeration> 4674 <xs:enumeration value="in_triage"> 4675 <xs:annotation> 4676 <xs:documentation> 4677 The vulnerability is being investigated. 4678 </xs:documentation> 4679 </xs:annotation> 4680 </xs:enumeration> 4681 <xs:enumeration value="false_positive"> 4682 <xs:annotation> 4683 <xs:documentation> 4684 The vulnerability is not specific to the component or service and was falsely identified or associated. 4685 </xs:documentation> 4686 </xs:annotation> 4687 </xs:enumeration> 4688 <xs:enumeration value="not_affected"> 4689 <xs:annotation> 4690 <xs:documentation> 4691 The component or service is not affected by the vulnerability. Justification should be specified 4692 for all not_affected cases. 4693 </xs:documentation> 4694 </xs:annotation> 4695 </xs:enumeration> 4696 </xs:restriction> 4697 </xs:simpleType> 4698 4699 <xs:simpleType name="impactAnalysisJustificationType" final="restriction"> 4700 <xs:annotation> 4701 <xs:documentation xml:lang="en"> 4702 The rationale of why the impact analysis state was asserted. 4703 </xs:documentation> 4704 </xs:annotation> 4705 <xs:restriction base="xs:string"> 4706 <xs:enumeration value="code_not_present"> 4707 <xs:annotation> 4708 <xs:documentation> 4709 The code has been removed or tree-shaked. 4710 </xs:documentation> 4711 </xs:annotation> 4712 </xs:enumeration> 4713 <xs:enumeration value="code_not_reachable"> 4714 <xs:annotation> 4715 <xs:documentation> 4716 The vulnerable code is not invoked at runtime. 4717 </xs:documentation> 4718 </xs:annotation> 4719 </xs:enumeration> 4720 <xs:enumeration value="requires_configuration"> 4721 <xs:annotation> 4722 <xs:documentation> 4723 Exploitability requires a configurable option to be set/unset. 4724 </xs:documentation> 4725 </xs:annotation> 4726 </xs:enumeration> 4727 <xs:enumeration value="requires_dependency"> 4728 <xs:annotation> 4729 <xs:documentation> 4730 Exploitability requires a dependency that is not present. 4731 </xs:documentation> 4732 </xs:annotation> 4733 </xs:enumeration> 4734 <xs:enumeration value="requires_environment"> 4735 <xs:annotation> 4736 <xs:documentation> 4737 Exploitability requires a certain environment which is not present. 4738 </xs:documentation> 4739 </xs:annotation> 4740 </xs:enumeration> 4741 <xs:enumeration value="protected_by_compiler"> 4742 <xs:annotation> 4743 <xs:documentation> 4744 Exploitability requires a compiler flag to be set/unset. 4745 </xs:documentation> 4746 </xs:annotation> 4747 </xs:enumeration> 4748 <xs:enumeration value="protected_at_runtime"> 4749 <xs:annotation> 4750 <xs:documentation> 4751 Exploits are prevented at runtime. 4752 </xs:documentation> 4753 </xs:annotation> 4754 </xs:enumeration> 4755 <xs:enumeration value="protected_at_perimeter"> 4756 <xs:annotation> 4757 <xs:documentation> 4758 Attacks are blocked at physical, logical, or network perimeter. 4759 </xs:documentation> 4760 </xs:annotation> 4761 </xs:enumeration> 4762 <xs:enumeration value="protected_by_mitigating_control"> 4763 <xs:annotation> 4764 <xs:documentation> 4765 Preventative measures have been implemented that reduce the likelihood and/or impact of the vulnerability. 4766 </xs:documentation> 4767 </xs:annotation> 4768 </xs:enumeration> 4769 </xs:restriction> 4770 </xs:simpleType> 4771 4772 <xs:simpleType name="scoreSourceType" final="restriction"> 4773 <xs:annotation> 4774 <xs:documentation xml:lang="en"> 4775 Specifies the severity or risk scoring methodology or standard used. 4776 </xs:documentation> 4777 </xs:annotation> 4778 <xs:restriction base="xs:string"> 4779 <xs:enumeration value="CVSSv2"> 4780 <xs:annotation> 4781 <xs:documentation xml:lang="en"> 4782 Common Vulnerability Scoring System v2.0 standard as defined at https://www.first.org/cvss/v2/ 4783 </xs:documentation> 4784 </xs:annotation> 4785 </xs:enumeration> 4786 <xs:enumeration value="CVSSv3"> 4787 <xs:annotation> 4788 <xs:documentation xml:lang="en"> 4789 Common Vulnerability Scoring System v3.0 standard as defined at https://www.first.org/cvss/v3-0/ 4790 </xs:documentation> 4791 </xs:annotation> 4792 </xs:enumeration> 4793 <xs:enumeration value="CVSSv31"> 4794 <xs:annotation> 4795 <xs:documentation xml:lang="en"> 4796 Common Vulnerability Scoring System v3.1 standard as defined at https://www.first.org/cvss/v3-1/ 4797 </xs:documentation> 4798 </xs:annotation> 4799 </xs:enumeration> 4800 <xs:enumeration value="CVSSv4"> 4801 <xs:annotation> 4802 <xs:documentation xml:lang="en"> 4803 Common Vulnerability Scoring System v4.0 standard as defined at https://www.first.org/cvss/v4-0/ 4804 </xs:documentation> 4805 </xs:annotation> 4806 </xs:enumeration> 4807 <xs:enumeration value="OWASP"> 4808 <xs:annotation> 4809 <xs:documentation xml:lang="en"> 4810 OWASP Risk Rating as defined at https://owasp.org/www-community/OWASP_Risk_Rating_Methodology 4811 </xs:documentation> 4812 </xs:annotation> 4813 </xs:enumeration> 4814 <xs:enumeration value="SSVC"> 4815 <xs:annotation> 4816 <xs:documentation xml:lang="en"> 4817 Stakeholder Specific Vulnerability Categorization as defined at https://github.com/CERTCC/SSVC 4818 </xs:documentation> 4819 </xs:annotation> 4820 </xs:enumeration> 4821 <xs:enumeration value="other"> 4822 <xs:annotation> 4823 <xs:documentation xml:lang="en"> 4824 Another severity or risk scoring methodology 4825 </xs:documentation> 4826 </xs:annotation> 4827 </xs:enumeration> 4828 </xs:restriction> 4829 </xs:simpleType> 4830 4831 <xs:simpleType name="impactAnalysisResponsesType" final="restriction"> 4832 <xs:annotation> 4833 <xs:documentation xml:lang="en"> 4834 The rationale of why the impact analysis state was asserted. 4835 </xs:documentation> 4836 </xs:annotation> 4837 <xs:restriction base="xs:string"> 4838 <xs:enumeration value="can_not_fix"/> 4839 <xs:enumeration value="will_not_fix"/> 4840 <xs:enumeration value="update"/> 4841 <xs:enumeration value="rollback"/> 4842 <xs:enumeration value="workaround_available"/> 4843 </xs:restriction> 4844 </xs:simpleType> 4845 4846 <xs:simpleType name="impactAnalysisAffectedStatusType" final="restriction"> 4847 <xs:annotation> 4848 <xs:documentation xml:lang="en"> 4849 The vulnerability status of a given version or range of versions of a product. The statuses 4850 'affected' and 'unaffected' indicate that the version is affected or unaffected by the vulnerability. 4851 The status 'unknown' indicates that it is unknown or unspecified whether the given version is affected. 4852 There can be many reasons for an 'unknown' status, including that an investigation has not been 4853 undertaken or that a vendor has not disclosed the status. 4854 </xs:documentation> 4855 </xs:annotation> 4856 <xs:restriction base="xs:string"> 4857 <xs:enumeration value="affected"/> 4858 <xs:enumeration value="unaffected"/> 4859 <xs:enumeration value="unknown"/> 4860 </xs:restriction> 4861 </xs:simpleType> 4862 4863 <xs:complexType name="formulationType"> 4864 <xs:annotation> 4865 <xs:documentation> 4866 Describes how a component or service was manufactured or deployed. This is achieved through the use 4867 of formulas, workflows, tasks, and steps, which declare the precise steps to reproduce along with the 4868 observed formulas describing the steps which transpired in the manufacturing process. 4869 </xs:documentation> 4870 </xs:annotation> 4871 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 4872 <xs:element name="formula" type="bom:formulaType"/> 4873 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 4874 <xs:annotation> 4875 <xs:documentation> 4876 Allows any undeclared elements as long as the elements are placed in a different namespace. 4877 </xs:documentation> 4878 </xs:annotation> 4879 </xs:any> 4880 </xs:sequence> 4881 <xs:anyAttribute namespace="##any" processContents="lax"> 4882 <xs:annotation> 4883 <xs:documentation>User-defined attributes may be used on this element as long as they 4884 do not have the same name as an existing attribute used by the schema.</xs:documentation> 4885 </xs:annotation> 4886 </xs:anyAttribute> 4887 </xs:complexType> 4888 4889 <xs:complexType name="formulaType"> 4890 <xs:annotation> 4891 <xs:documentation> 4892 Describes workflows and resources that captures rules and other aspects of how the associated 4893 BOM component or service was formed. 4894 </xs:documentation> 4895 </xs:annotation> 4896 <xs:sequence> 4897 <xs:element name="components" type="bom:componentsType" minOccurs="0" maxOccurs="1"> 4898 <xs:annotation> 4899 <xs:documentation>Transient components that are used in tasks that constitute one or more of 4900 this formula's workflows</xs:documentation> 4901 </xs:annotation> 4902 </xs:element> 4903 <xs:element name="services" type="bom:servicesType" minOccurs="0" maxOccurs="1"> 4904 <xs:annotation> 4905 <xs:documentation>Transient services that are used in tasks that constitute one or more of 4906 this formula's workflows</xs:documentation> 4907 </xs:annotation> 4908 </xs:element> 4909 <xs:element name="workflows" type="bom:workflowsType" minOccurs="0" maxOccurs="1"> 4910 <xs:annotation> 4911 <xs:documentation>List of workflows that can be declared to accomplish specific orchestrated goals 4912 and independently triggered.</xs:documentation> 4913 </xs:annotation> 4914 </xs:element> 4915 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 4916 <xs:annotation> 4917 <xs:documentation>Provides the ability to document properties in a name/value store. 4918 This provides flexibility to include data not officially supported in the standard 4919 without having to use additional namespaces or create extensions. Property names 4920 of interest to the general public are encouraged to be registered in the 4921 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 4922 Formal registration is OPTIONAL.</xs:documentation> 4923 </xs:annotation> 4924 </xs:element> 4925 </xs:sequence> 4926 <xs:attribute name="bom-ref" type="bom:refType"> 4927 <xs:annotation> 4928 <xs:documentation> 4929 An optional identifier which can be used to reference the formula elsewhere in the BOM. 4930 Uniqueness is enforced within all elements and children of the root-level bom element. 4931 </xs:documentation> 4932 </xs:annotation> 4933 </xs:attribute> 4934 <xs:anyAttribute namespace="##any" processContents="lax"> 4935 <xs:annotation> 4936 <xs:documentation>User-defined attributes may be used on this element as long as they 4937 do not have the same name as an existing attribute used by the schema.</xs:documentation> 4938 </xs:annotation> 4939 </xs:anyAttribute> 4940 </xs:complexType> 4941 4942 <xs:complexType name="workflowsType"> 4943 <xs:sequence> 4944 <xs:element name="workflow" type="bom:workflowType" minOccurs="0" maxOccurs="unbounded"/> 4945 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 4946 <xs:annotation> 4947 <xs:documentation> 4948 Allows any undeclared elements as long as the elements are placed in a different namespace. 4949 </xs:documentation> 4950 </xs:annotation> 4951 </xs:any> 4952 </xs:sequence> 4953 <xs:anyAttribute namespace="##any" processContents="lax"> 4954 <xs:annotation> 4955 <xs:documentation>User-defined attributes may be used on this element as long as they 4956 do not have the same name as an existing attribute used by the schema.</xs:documentation> 4957 </xs:annotation> 4958 </xs:anyAttribute> 4959 </xs:complexType> 4960 4961 <xs:complexType name="workflowType"> 4962 <xs:sequence> 4963 <xs:element name="uid" type="xs:string" minOccurs="1" maxOccurs="1"> 4964 <xs:annotation> 4965 <xs:documentation> 4966 The unique identifier for the resource instance within its deployment context. 4967 </xs:documentation> 4968 </xs:annotation> 4969 </xs:element> 4970 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 4971 <xs:annotation> 4972 <xs:documentation> 4973 The name of the resource instance. 4974 </xs:documentation> 4975 </xs:annotation> 4976 </xs:element> 4977 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 4978 <xs:annotation> 4979 <xs:documentation> 4980 The description of the resource instance. 4981 </xs:documentation> 4982 </xs:annotation> 4983 </xs:element> 4984 <xs:element name="resourceReferences" type="bom:resourceReferencesType" minOccurs="0" maxOccurs="1"> 4985 <xs:annotation> 4986 <xs:documentation>References to component or service resources that are used to realize 4987 the resource instance.</xs:documentation> 4988 </xs:annotation> 4989 </xs:element> 4990 <xs:element name="tasks" type="bom:tasksType" minOccurs="0" maxOccurs="1"> 4991 <xs:annotation> 4992 <xs:documentation>The tasks that comprise the workflow.</xs:documentation> 4993 </xs:annotation> 4994 </xs:element> 4995 <xs:element name="taskDependencies" type="bom:dependenciesType" minOccurs="0" maxOccurs="1"> 4996 <xs:annotation> 4997 <xs:documentation>The graph of dependencies between tasks within the workflow.</xs:documentation> 4998 </xs:annotation> 4999 </xs:element> 5000 <xs:element name="taskTypes" minOccurs="1" maxOccurs="1"> 5001 <xs:annotation> 5002 <xs:documentation>Indicates the types of activities performed by the set of workflow tasks.</xs:documentation> 5003 </xs:annotation> 5004 <xs:complexType> 5005 <xs:sequence> 5006 <xs:element name="taskType" type="bom:taskTypeEnum" minOccurs="0" maxOccurs="unbounded" /> 5007 </xs:sequence> 5008 </xs:complexType> 5009 </xs:element> 5010 <xs:element name="trigger" type="bom:triggerType" minOccurs="0" maxOccurs="1"> 5011 <xs:annotation> 5012 <xs:documentation>The trigger that initiated the task.</xs:documentation> 5013 </xs:annotation> 5014 </xs:element> 5015 <xs:element name="steps" minOccurs="0" maxOccurs="1"> 5016 <xs:annotation> 5017 <xs:documentation> 5018 The sequence of steps for the task. 5019 </xs:documentation> 5020 </xs:annotation> 5021 <xs:complexType> 5022 <xs:sequence> 5023 <xs:element name="step" type="bom:stepType" minOccurs="0" maxOccurs="unbounded"/> 5024 </xs:sequence> 5025 </xs:complexType> 5026 </xs:element> 5027 <xs:element name="inputs" minOccurs="0" maxOccurs="1"> 5028 <xs:annotation> 5029 <xs:documentation>Represents resources and data brought into a task at runtime by executor 5030 or task commands</xs:documentation> 5031 </xs:annotation> 5032 <xs:complexType> 5033 <xs:sequence> 5034 <xs:element name="input" type="bom:inputType" minOccurs="0" maxOccurs="unbounded" /> 5035 </xs:sequence> 5036 </xs:complexType> 5037 </xs:element> 5038 <xs:element name="outputs" minOccurs="0" maxOccurs="1"> 5039 <xs:annotation> 5040 <xs:documentation>Represents resources and data output from a task at runtime by executor 5041 or task commands</xs:documentation> 5042 </xs:annotation> 5043 <xs:complexType> 5044 <xs:sequence> 5045 <xs:element name="output" type="bom:outputType" minOccurs="0" maxOccurs="unbounded" /> 5046 </xs:sequence> 5047 </xs:complexType> 5048 </xs:element> 5049 <xs:element name="timeStart" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 5050 <xs:annotation> 5051 <xs:documentation> 5052 The date and time (timestamp) when the task started. 5053 </xs:documentation> 5054 </xs:annotation> 5055 </xs:element> 5056 <xs:element name="timeEnd" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 5057 <xs:annotation> 5058 <xs:documentation> 5059 The date and time (timestamp) when the task ended. 5060 </xs:documentation> 5061 </xs:annotation> 5062 </xs:element> 5063 <xs:element name="workspaces" type="bom:workspacesType" minOccurs="0" maxOccurs="1"> 5064 <xs:annotation> 5065 <xs:documentation>A set of named filesystem or data resource shareable by workflow tasks.</xs:documentation> 5066 </xs:annotation> 5067 </xs:element> 5068 <xs:element name="runtimeTopology" type="bom:dependenciesType" minOccurs="0" maxOccurs="1"> 5069 <xs:annotation> 5070 <xs:documentation>A graph of the component runtime topology for workflow's instance. 5071 A description of the runtime component and service topology. This can describe a partial or 5072 complete topology used to host and execute the task (e.g., hardware, operating systems, 5073 configurations, etc.)</xs:documentation> 5074 </xs:annotation> 5075 </xs:element> 5076 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5077 <xs:annotation> 5078 <xs:documentation>Provides the ability to document properties in a name/value store. 5079 This provides flexibility to include data not officially supported in the standard 5080 without having to use additional namespaces or create extensions. Property names 5081 of interest to the general public are encouraged to be registered in the 5082 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 5083 Formal registration is OPTIONAL.</xs:documentation> 5084 </xs:annotation> 5085 </xs:element> 5086 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5087 <xs:annotation> 5088 <xs:documentation> 5089 Allows any undeclared elements as long as the elements are placed in a different namespace. 5090 </xs:documentation> 5091 </xs:annotation> 5092 </xs:any> 5093 </xs:sequence> 5094 <xs:attribute name="bom-ref" type="bom:refType" use="required"> 5095 <xs:annotation> 5096 <xs:documentation> 5097 An optional identifier which can be used to reference the workflow elsewhere in the BOM. 5098 Uniqueness is enforced within all elements and children of the root-level bom element. 5099 </xs:documentation> 5100 </xs:annotation> 5101 </xs:attribute> 5102 <xs:anyAttribute namespace="##any" processContents="lax"> 5103 <xs:annotation> 5104 <xs:documentation>User-defined attributes may be used on this element as long as they 5105 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5106 </xs:annotation> 5107 </xs:anyAttribute> 5108 </xs:complexType> 5109 5110 <xs:complexType name="resourceReferencesType"> 5111 <xs:sequence> 5112 <xs:element name="resourceReference" type="bom:resourceReferenceType" minOccurs="0" maxOccurs="unbounded" /> 5113 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5114 <xs:annotation> 5115 <xs:documentation> 5116 Allows any undeclared elements as long as the elements are placed in a different namespace. 5117 </xs:documentation> 5118 </xs:annotation> 5119 </xs:any> 5120 </xs:sequence> 5121 <xs:anyAttribute namespace="##any" processContents="lax"> 5122 <xs:annotation> 5123 <xs:documentation>User-defined attributes may be used on this element as long as they 5124 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5125 </xs:annotation> 5126 </xs:anyAttribute> 5127 </xs:complexType> 5128 5129 <xs:complexType name="resourceReferenceType"> 5130 <xs:sequence> 5131 <xs:choice> 5132 <xs:element name="ref" minOccurs="1" maxOccurs="1"> 5133 <xs:annotation> 5134 <xs:documentation> 5135 References an object by its bom-ref attribute 5136 </xs:documentation> 5137 </xs:annotation> 5138 <xs:simpleType> 5139 <xs:union memberTypes="bom:refLinkType bom:bomLinkElementType"/> 5140 </xs:simpleType> 5141 </xs:element> 5142 <xs:element name="externalReference" type="bom:externalReference" minOccurs="1" maxOccurs="1"> 5143 <xs:annotation> 5144 <xs:documentation> 5145 Reference to an externally accessible resource. 5146 </xs:documentation> 5147 </xs:annotation> 5148 </xs:element> 5149 </xs:choice> 5150 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5151 <xs:annotation> 5152 <xs:documentation> 5153 Allows any undeclared elements as long as the elements are placed in a different namespace. 5154 </xs:documentation> 5155 </xs:annotation> 5156 </xs:any> 5157 </xs:sequence> 5158 <xs:anyAttribute namespace="##any" processContents="lax"> 5159 <xs:annotation> 5160 <xs:documentation>User-defined attributes may be used on this element as long as they 5161 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5162 </xs:annotation> 5163 </xs:anyAttribute> 5164 </xs:complexType> 5165 5166 <xs:complexType name="tasksType"> 5167 <xs:sequence> 5168 <xs:element name="task" type="bom:taskType" minOccurs="0" maxOccurs="unbounded" /> 5169 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5170 <xs:annotation> 5171 <xs:documentation> 5172 Allows any undeclared elements as long as the elements are placed in a different namespace. 5173 </xs:documentation> 5174 </xs:annotation> 5175 </xs:any> 5176 </xs:sequence> 5177 <xs:anyAttribute namespace="##any" processContents="lax"> 5178 <xs:annotation> 5179 <xs:documentation>User-defined attributes may be used on this element as long as they 5180 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5181 </xs:annotation> 5182 </xs:anyAttribute> 5183 </xs:complexType> 5184 5185 <xs:complexType name="taskType"> 5186 <xs:sequence> 5187 <xs:element name="uid" type="xs:string" minOccurs="1" maxOccurs="1"> 5188 <xs:annotation> 5189 <xs:documentation> 5190 The unique identifier for the resource instance within its deployment context. 5191 </xs:documentation> 5192 </xs:annotation> 5193 </xs:element> 5194 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 5195 <xs:annotation> 5196 <xs:documentation> 5197 The name of the resource instance. 5198 </xs:documentation> 5199 </xs:annotation> 5200 </xs:element> 5201 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 5202 <xs:annotation> 5203 <xs:documentation> 5204 The description of the resource instance. 5205 </xs:documentation> 5206 </xs:annotation> 5207 </xs:element> 5208 <xs:element name="resourceReferences" type="bom:resourceReferencesType" minOccurs="0" maxOccurs="1"> 5209 <xs:annotation> 5210 <xs:documentation> 5211 References to component or service resources that are used to realize the resource instance. 5212 </xs:documentation> 5213 </xs:annotation> 5214 </xs:element> 5215 <xs:element name="taskTypes" minOccurs="1" maxOccurs="1"> 5216 <xs:annotation> 5217 <xs:documentation> 5218 Indicates the types of activities performed by the set of workflow tasks. 5219 </xs:documentation> 5220 </xs:annotation> 5221 <xs:complexType> 5222 <xs:sequence> 5223 <xs:element name="taskType" type="bom:taskTypeEnum" minOccurs="0" maxOccurs="unbounded"/> 5224 </xs:sequence> 5225 </xs:complexType> 5226 </xs:element> 5227 <xs:element name="trigger" type="bom:triggerType" minOccurs="0" maxOccurs="1"> 5228 <xs:annotation> 5229 <xs:documentation> 5230 The trigger that initiated the task. 5231 </xs:documentation> 5232 </xs:annotation> 5233 </xs:element> 5234 <xs:element name="steps" minOccurs="0" maxOccurs="1"> 5235 <xs:annotation> 5236 <xs:documentation> 5237 The sequence of steps for the task. 5238 </xs:documentation> 5239 </xs:annotation> 5240 <xs:complexType> 5241 <xs:sequence> 5242 <xs:element name="step" type="bom:stepType" minOccurs="0" maxOccurs="unbounded"/> 5243 </xs:sequence> 5244 </xs:complexType> 5245 </xs:element> 5246 <xs:element name="inputs" minOccurs="0" maxOccurs="1"> 5247 <xs:annotation> 5248 <xs:documentation> 5249 Represents resources and data brought into a task at runtime by executor or task commands. 5250 </xs:documentation> 5251 </xs:annotation> 5252 <xs:complexType> 5253 <xs:sequence> 5254 <xs:element name="input" type="bom:inputType" minOccurs="0" maxOccurs="unbounded"/> 5255 </xs:sequence> 5256 </xs:complexType> 5257 </xs:element> 5258 <xs:element name="outputs" minOccurs="0" maxOccurs="1"> 5259 <xs:annotation> 5260 <xs:documentation> 5261 Represents resources and data output from a task at runtime by executor or task commands 5262 </xs:documentation> 5263 </xs:annotation> 5264 <xs:complexType> 5265 <xs:sequence> 5266 <xs:element name="output" type="bom:outputType" minOccurs="0" maxOccurs="unbounded"/> 5267 </xs:sequence> 5268 </xs:complexType> 5269 </xs:element> 5270 <xs:element name="timeStart" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 5271 <xs:annotation> 5272 <xs:documentation> 5273 The date and time (timestamp) when the task started. 5274 </xs:documentation> 5275 </xs:annotation> 5276 </xs:element> 5277 <xs:element name="timeEnd" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 5278 <xs:annotation> 5279 <xs:documentation> 5280 The date and time (timestamp) when the task ended. 5281 </xs:documentation> 5282 </xs:annotation> 5283 </xs:element> 5284 <xs:element name="workspaces" type="bom:workspacesType" minOccurs="0" maxOccurs="1"> 5285 <xs:annotation> 5286 <xs:documentation> 5287 A set of named filesystem or data resource shareable by workflow tasks. 5288 </xs:documentation> 5289 </xs:annotation> 5290 </xs:element> 5291 <xs:element name="runtimeTopology" type="bom:dependenciesType" minOccurs="0" maxOccurs="1"> 5292 <xs:annotation> 5293 <xs:documentation> 5294 A graph of the component runtime topology for task's instance. 5295 </xs:documentation> 5296 </xs:annotation> 5297 </xs:element> 5298 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5299 <xs:annotation> 5300 <xs:documentation>Provides the ability to document properties in a name/value store. 5301 This provides flexibility to include data not officially supported in the standard 5302 without having to use additional namespaces or create extensions. Property names 5303 of interest to the general public are encouraged to be registered in the 5304 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 5305 Formal registration is OPTIONAL.</xs:documentation> 5306 </xs:annotation> 5307 </xs:element> 5308 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5309 <xs:annotation> 5310 <xs:documentation> 5311 Allows any undeclared elements as long as the elements are placed in a different namespace. 5312 </xs:documentation> 5313 </xs:annotation> 5314 </xs:any> 5315 </xs:sequence> 5316 <xs:attribute name="bom-ref" type="bom:refType" use="required"> 5317 <xs:annotation> 5318 <xs:documentation> 5319 An optional identifier which can be used to reference the task elsewhere in the BOM. 5320 Uniqueness is enforced within all elements and children of the root-level bom element. 5321 </xs:documentation> 5322 </xs:annotation> 5323 </xs:attribute> 5324 <xs:anyAttribute namespace="##any" processContents="lax"> 5325 <xs:annotation> 5326 <xs:documentation>User-defined attributes may be used on this element as long as they 5327 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5328 </xs:annotation> 5329 </xs:anyAttribute> 5330 </xs:complexType> 5331 5332 <xs:simpleType name="taskTypeEnum"> 5333 <xs:restriction base="xs:string"> 5334 <xs:enumeration value="copy"> 5335 <xs:annotation> 5336 <xs:documentation>A task that copies software or data used to accomplish other tasks in the workflow.</xs:documentation> 5337 </xs:annotation> 5338 </xs:enumeration> 5339 <xs:enumeration value="clone"> 5340 <xs:annotation> 5341 <xs:documentation>A task that clones a software repository into the workflow in order to retrieve its source code or data for use in a build step.</xs:documentation> 5342 </xs:annotation> 5343 </xs:enumeration> 5344 <xs:enumeration value="lint"> 5345 <xs:annotation> 5346 <xs:documentation>A task that checks source code for programmatic and stylistic errors.</xs:documentation> 5347 </xs:annotation> 5348 </xs:enumeration> 5349 <xs:enumeration value="scan"> 5350 <xs:annotation> 5351 <xs:documentation>A task that performs a scan against source code, or built or deployed components and services. Scans are typically run to gather or test for security vulnerabilities or policy compliance.</xs:documentation> 5352 </xs:annotation> 5353 </xs:enumeration> 5354 <xs:enumeration value="merge"> 5355 <xs:annotation> 5356 <xs:documentation>A task that merges changes or fixes into source code prior to a build step in the workflow.</xs:documentation> 5357 </xs:annotation> 5358 </xs:enumeration> 5359 <xs:enumeration value="build"> 5360 <xs:annotation> 5361 <xs:documentation>A task that builds the source code, dependencies and/or data into an artifact that can be deployed to and executed on target systems.</xs:documentation> 5362 </xs:annotation> 5363 </xs:enumeration> 5364 <xs:enumeration value="test"> 5365 <xs:annotation> 5366 <xs:documentation>A task that verifies the functionality of a component or service.</xs:documentation> 5367 </xs:annotation> 5368 </xs:enumeration> 5369 <xs:enumeration value="deliver"> 5370 <xs:annotation> 5371 <xs:documentation>A task that delivers a built artifact to one or more target repositories or storage systems.</xs:documentation> 5372 </xs:annotation> 5373 </xs:enumeration> 5374 <xs:enumeration value="deploy"> 5375 <xs:annotation> 5376 <xs:documentation>A task that deploys a built artifact for execution on one or more target systems.</xs:documentation> 5377 </xs:annotation> 5378 </xs:enumeration> 5379 <xs:enumeration value="release"> 5380 <xs:annotation> 5381 <xs:documentation>A task that releases a built, versioned artifact to a target repository or distribution system.</xs:documentation> 5382 </xs:annotation> 5383 </xs:enumeration> 5384 <xs:enumeration value="clean"> 5385 <xs:annotation> 5386 <xs:documentation>A task that cleans unnecessary tools, build artifacts and/or data from workflow storage.</xs:documentation> 5387 </xs:annotation> 5388 </xs:enumeration> 5389 <xs:enumeration value="other"> 5390 <xs:annotation> 5391 <xs:documentation>A workflow task that does not match current task type definitions.</xs:documentation> 5392 </xs:annotation> 5393 </xs:enumeration> 5394 </xs:restriction> 5395 </xs:simpleType> 5396 5397 <xs:complexType name="workspacesType"> 5398 <xs:sequence> 5399 <xs:element name="workspace" type="bom:workspaceType" minOccurs="0" maxOccurs="unbounded"/> 5400 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5401 <xs:annotation> 5402 <xs:documentation> 5403 Allows any undeclared elements as long as the elements are placed in a different namespace. 5404 </xs:documentation> 5405 </xs:annotation> 5406 </xs:any> 5407 </xs:sequence> 5408 <xs:anyAttribute namespace="##any" processContents="lax"> 5409 <xs:annotation> 5410 <xs:documentation>User-defined attributes may be used on this element as long as they 5411 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5412 </xs:annotation> 5413 </xs:anyAttribute> 5414 </xs:complexType> 5415 5416 <xs:complexType name="workspaceType"> 5417 <xs:annotation> 5418 <xs:documentation> 5419 A named filesystem or data resource shareable by workflow tasks. 5420 </xs:documentation> 5421 </xs:annotation> 5422 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 5423 <xs:element name="uid" type="xs:string" minOccurs="1" maxOccurs="1"> 5424 <xs:annotation> 5425 <xs:documentation> 5426 The unique identifier for the resource instance within its deployment context. 5427 </xs:documentation> 5428 </xs:annotation> 5429 </xs:element> 5430 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 5431 <xs:annotation> 5432 <xs:documentation> 5433 The name of the resource instance. 5434 </xs:documentation> 5435 </xs:annotation> 5436 </xs:element> 5437 <xs:element name="aliases" minOccurs="0" maxOccurs="1"> 5438 <xs:annotation> 5439 <xs:documentation> 5440 The names for the workspace as referenced by other workflow tasks. Effectively, a name mapping 5441 so other tasks can use their own local name in their steps. 5442 </xs:documentation> 5443 </xs:annotation> 5444 <xs:complexType> 5445 <xs:sequence> 5446 <xs:element name="alias" type="xs:string" minOccurs="0" maxOccurs="unbounded" /> 5447 </xs:sequence> 5448 </xs:complexType> 5449 </xs:element> 5450 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 5451 <xs:annotation> 5452 <xs:documentation> 5453 The description of the resource instance. 5454 </xs:documentation> 5455 </xs:annotation> 5456 </xs:element> 5457 <xs:element name="resourceReferences" type="bom:resourceReferencesType" minOccurs="0" maxOccurs="1"> 5458 <xs:annotation> 5459 <xs:documentation> 5460 References to component or service resources that are used to realize the resource instance. 5461 </xs:documentation> 5462 </xs:annotation> 5463 </xs:element> 5464 <xs:element name="accessMode" type="bom:accessModeEnum" minOccurs="0" maxOccurs="1"> 5465 <xs:annotation> 5466 <xs:documentation> 5467 Describes the read-write access control for the workspace relative to the owning resource instance. 5468 </xs:documentation> 5469 </xs:annotation> 5470 </xs:element> 5471 <xs:element name="mountPath" type="xs:string" minOccurs="0" maxOccurs="1"> 5472 <xs:annotation> 5473 <xs:documentation> 5474 A path to a location on disk where the workspace will be available to the associated task's steps. 5475 </xs:documentation> 5476 </xs:annotation> 5477 </xs:element> 5478 <xs:element name="managedDataType" type="xs:string" minOccurs="0" maxOccurs="1"> 5479 <xs:annotation> 5480 <xs:documentation> 5481 The name of a domain-specific data type the workspace represents. This property is for CI/CD 5482 frameworks that are able to provide access to structured, managed data at a more granular level 5483 than a filesystem. 5484 </xs:documentation> 5485 </xs:annotation> 5486 </xs:element> 5487 <xs:element name="volumeRequest" type="xs:string" minOccurs="0" maxOccurs="1"> 5488 <xs:annotation> 5489 <xs:documentation> 5490 Identifies the reference to the request for a specific volume type and parameters. 5491 </xs:documentation> 5492 </xs:annotation> 5493 </xs:element> 5494 <xs:element name="volume" type="bom:volumeType" minOccurs="0" maxOccurs="1"> 5495 <xs:annotation> 5496 <xs:documentation> 5497 Information about the actual volume instance allocated to the workspace. 5498 </xs:documentation> 5499 </xs:annotation> 5500 </xs:element> 5501 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5502 <xs:annotation> 5503 <xs:documentation>Provides the ability to document properties in a name/value store. 5504 This provides flexibility to include data not officially supported in the standard 5505 without having to use additional namespaces or create extensions. Property names 5506 of interest to the general public are encouraged to be registered in the 5507 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 5508 Formal registration is OPTIONAL.</xs:documentation> 5509 </xs:annotation> 5510 </xs:element> 5511 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5512 <xs:annotation> 5513 <xs:documentation> 5514 Allows any undeclared elements as long as the elements are placed in a different namespace. 5515 </xs:documentation> 5516 </xs:annotation> 5517 </xs:any> 5518 </xs:sequence> 5519 <xs:attribute name="bom-ref" type="bom:refType" use="required"> 5520 <xs:annotation> 5521 <xs:documentation> 5522 An optional identifier which can be used to reference the workflow elsewhere in the BOM. 5523 Uniqueness is enforced within all elements and children of the root-level bom element. 5524 </xs:documentation> 5525 </xs:annotation> 5526 </xs:attribute> 5527 <xs:anyAttribute namespace="##any" processContents="lax"> 5528 <xs:annotation> 5529 <xs:documentation>User-defined attributes may be used on this element as long as they 5530 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5531 </xs:annotation> 5532 </xs:anyAttribute> 5533 </xs:complexType> 5534 5535 <xs:simpleType name="accessModeEnum"> 5536 <xs:restriction base="xs:string"> 5537 <xs:enumeration value="read-only"/> 5538 <xs:enumeration value="read-write"/> 5539 <xs:enumeration value="read-write-once"/> 5540 <xs:enumeration value="write-once"/> 5541 <xs:enumeration value="write-only"/> 5542 </xs:restriction> 5543 </xs:simpleType> 5544 5545 <xs:complexType name="volumeType"> 5546 <xs:annotation> 5547 <xs:documentation> 5548 An identifiable, logical unit of data storage tied to a physical device. 5549 </xs:documentation> 5550 </xs:annotation> 5551 <xs:sequence> 5552 <xs:element name="uid" type="xs:string" minOccurs="0" maxOccurs="1"> 5553 <xs:annotation> 5554 <xs:documentation> 5555 The unique identifier for the volume instance within its deployment context. 5556 </xs:documentation> 5557 </xs:annotation> 5558 </xs:element> 5559 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 5560 <xs:annotation> 5561 <xs:documentation> 5562 The name of the volume instance 5563 </xs:documentation> 5564 </xs:annotation> 5565 </xs:element> 5566 <xs:element name="mode" type="bom:volumeModeEnum" minOccurs="0" maxOccurs="1" default="filesystem"> 5567 <xs:annotation> 5568 <xs:documentation> 5569 The mode for the volume instance. 5570 </xs:documentation> 5571 </xs:annotation> 5572 </xs:element> 5573 <xs:element name="path" type="xs:string" minOccurs="0" maxOccurs="1"> 5574 <xs:annotation> 5575 <xs:documentation> 5576 The underlying path created from the actual volume. 5577 </xs:documentation> 5578 </xs:annotation> 5579 </xs:element> 5580 <xs:element name="sizeAllocated" type="xs:string" minOccurs="0" maxOccurs="1"> 5581 <xs:annotation> 5582 <xs:documentation> 5583 The allocated size of the volume accessible to the associated workspace. This should include 5584 the scalar size as well as IEC standard unit in either decimal or binary form. 5585 </xs:documentation> 5586 </xs:annotation> 5587 </xs:element> 5588 <xs:element name="persistent" type="xs:boolean" minOccurs="0" maxOccurs="1"> 5589 <xs:annotation> 5590 <xs:documentation> 5591 Indicates if the volume persists beyond the life of the resource it is associated with. 5592 </xs:documentation> 5593 </xs:annotation> 5594 </xs:element> 5595 <xs:element name="remote" type="xs:boolean" minOccurs="0" maxOccurs="1"> 5596 <xs:annotation> 5597 <xs:documentation> 5598 Indicates if the volume is remotely (i.e., network) attached. 5599 </xs:documentation> 5600 </xs:annotation> 5601 </xs:element> 5602 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5603 <xs:annotation> 5604 <xs:documentation>Provides the ability to document properties in a name/value store. 5605 This provides flexibility to include data not officially supported in the standard 5606 without having to use additional namespaces or create extensions. Property names 5607 of interest to the general public are encouraged to be registered in the 5608 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 5609 Formal registration is OPTIONAL.</xs:documentation> 5610 </xs:annotation> 5611 </xs:element> 5612 </xs:sequence> 5613 </xs:complexType> 5614 5615 <xs:simpleType name="volumeModeEnum"> 5616 <xs:restriction base="xs:string"> 5617 <xs:enumeration value="filesystem"/> 5618 <xs:enumeration value="block"/> 5619 </xs:restriction> 5620 </xs:simpleType> 5621 5622 <xs:complexType name="stepType"> 5623 <xs:annotation> 5624 <xs:documentation> 5625 Executes specific commands or tools in order to accomplish its owning task as part of a sequence. 5626 </xs:documentation> 5627 </xs:annotation> 5628 <xs:sequence> 5629 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 5630 <xs:annotation> 5631 <xs:documentation> 5632 A name for the step. 5633 </xs:documentation> 5634 </xs:annotation> 5635 </xs:element> 5636 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 5637 <xs:annotation> 5638 <xs:documentation> 5639 A description of the step. 5640 </xs:documentation> 5641 </xs:annotation> 5642 </xs:element> 5643 <xs:element name="commands" minOccurs="0" maxOccurs="1"> 5644 <xs:annotation> 5645 <xs:documentation> 5646 Ordered list of commands or directives for the step 5647 </xs:documentation> 5648 </xs:annotation> 5649 <xs:complexType> 5650 <xs:sequence> 5651 <xs:element name="command" minOccurs="0" maxOccurs="unbounded"> 5652 <xs:complexType> 5653 <xs:sequence> 5654 <xs:element name="executed" type="xs:string" minOccurs="0" maxOccurs="1"> 5655 <xs:annotation> 5656 <xs:documentation> 5657 A text representation of the executed command. 5658 </xs:documentation> 5659 </xs:annotation> 5660 </xs:element> 5661 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5662 <xs:annotation> 5663 <xs:documentation>Provides the ability to document properties in a name/value store. 5664 This provides flexibility to include data not officially supported in the standard 5665 without having to use additional namespaces or create extensions. Property names 5666 of interest to the general public are encouraged to be registered in the 5667 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 5668 Formal registration is OPTIONAL.</xs:documentation> 5669 </xs:annotation> 5670 </xs:element> 5671 </xs:sequence> 5672 </xs:complexType> 5673 </xs:element> 5674 </xs:sequence> 5675 </xs:complexType> 5676 </xs:element> 5677 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5678 <xs:annotation> 5679 <xs:documentation>Provides the ability to document properties in a name/value store. 5680 This provides flexibility to include data not officially supported in the standard 5681 without having to use additional namespaces or create extensions. Property names 5682 of interest to the general public are encouraged to be registered in the 5683 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 5684 Formal registration is OPTIONAL.</xs:documentation> 5685 </xs:annotation> 5686 </xs:element> 5687 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5688 <xs:annotation> 5689 <xs:documentation> 5690 Allows any undeclared elements as long as the elements are placed in a different namespace. 5691 </xs:documentation> 5692 </xs:annotation> 5693 </xs:any> 5694 </xs:sequence> 5695 <xs:anyAttribute namespace="##any" processContents="lax"> 5696 <xs:annotation> 5697 <xs:documentation>User-defined attributes may be used on this element as long as they 5698 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5699 </xs:annotation> 5700 </xs:anyAttribute> 5701 </xs:complexType> 5702 5703 <xs:complexType name="triggerType"> 5704 <xs:sequence> 5705 <xs:element name="uid" type="xs:string" minOccurs="1" maxOccurs="1"> 5706 <xs:annotation> 5707 <xs:documentation> 5708 The unique identifier for the resource instance within its deployment context. 5709 </xs:documentation> 5710 </xs:annotation> 5711 </xs:element> 5712 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 5713 <xs:annotation> 5714 <xs:documentation> 5715 The name of the resource instance. 5716 </xs:documentation> 5717 </xs:annotation> 5718 </xs:element> 5719 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 5720 <xs:annotation> 5721 <xs:documentation> 5722 The description of the resource instance. 5723 </xs:documentation> 5724 </xs:annotation> 5725 </xs:element> 5726 <xs:element name="resourceReferences" type="bom:resourceReferencesType" minOccurs="0" maxOccurs="1"> 5727 <xs:annotation> 5728 <xs:documentation> 5729 References to component or service resources that are used to realize the resource instance. 5730 </xs:documentation> 5731 </xs:annotation> 5732 </xs:element> 5733 <xs:element name="type" type="bom:triggerTypeType" minOccurs="1" maxOccurs="1"> 5734 <xs:annotation> 5735 <xs:documentation> 5736 The source type of event which caused the trigger to fire. 5737 </xs:documentation> 5738 </xs:annotation> 5739 </xs:element> 5740 <xs:element name="event" type="bom:eventType" minOccurs="0" maxOccurs="1"> 5741 <xs:annotation> 5742 <xs:documentation> 5743 The event data that caused the associated trigger to activate. 5744 </xs:documentation> 5745 </xs:annotation> 5746 </xs:element> 5747 <xs:element name="conditions" minOccurs="0" maxOccurs="1"> 5748 <xs:complexType> 5749 <xs:sequence> 5750 <xs:element name="condition" minOccurs="0" maxOccurs="unbounded"> 5751 <xs:annotation> 5752 <xs:documentation> 5753 A condition that was used to determine a trigger should be activated. 5754 </xs:documentation> 5755 </xs:annotation> 5756 <xs:complexType> 5757 <xs:sequence> 5758 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 5759 <xs:annotation> 5760 <xs:documentation> 5761 Describes the set of conditions which cause the trigger to activate. 5762 </xs:documentation> 5763 </xs:annotation> 5764 </xs:element> 5765 <xs:element name="expression" type="xs:string" minOccurs="0" maxOccurs="1"> 5766 <xs:annotation> 5767 <xs:documentation> 5768 The logical expression that was evaluated that determined the trigger should be fired. 5769 </xs:documentation> 5770 </xs:annotation> 5771 </xs:element> 5772 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5773 <xs:annotation> 5774 <xs:documentation>Provides the ability to document properties in a name/value store. 5775 This provides flexibility to include data not officially supported in the standard 5776 without having to use additional namespaces or create extensions. Property names 5777 of interest to the general public are encouraged to be registered in the 5778 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 5779 Formal registration is OPTIONAL.</xs:documentation> 5780 </xs:annotation> 5781 </xs:element> 5782 </xs:sequence> 5783 </xs:complexType> 5784 </xs:element> 5785 </xs:sequence> 5786 </xs:complexType> 5787 </xs:element> 5788 <xs:element name="timeActivated" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 5789 <xs:annotation> 5790 <xs:documentation> 5791 The date and time (timestamp) when the trigger was activated. 5792 </xs:documentation> 5793 </xs:annotation> 5794 </xs:element> 5795 <xs:element name="inputs" minOccurs="0" maxOccurs="1"> 5796 <xs:annotation> 5797 <xs:documentation> 5798 Represents resources and data brought into a task at runtime by executor or task commands 5799 </xs:documentation> 5800 </xs:annotation> 5801 <xs:complexType> 5802 <xs:sequence> 5803 <xs:element name="input" type="bom:inputType" minOccurs="0" maxOccurs="unbounded" /> 5804 </xs:sequence> 5805 </xs:complexType> 5806 </xs:element> 5807 <xs:element name="outputs" minOccurs="0" maxOccurs="1"> 5808 <xs:annotation> 5809 <xs:documentation> 5810 Represents resources and data output from a task at runtime by executor or task commands 5811 </xs:documentation> 5812 </xs:annotation> 5813 <xs:complexType> 5814 <xs:sequence> 5815 <xs:element name="output" type="bom:outputType" minOccurs="0" maxOccurs="unbounded" /> 5816 </xs:sequence> 5817 </xs:complexType> 5818 </xs:element> 5819 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5820 <xs:annotation> 5821 <xs:documentation>Provides the ability to document properties in a name/value store. 5822 This provides flexibility to include data not officially supported in the standard 5823 without having to use additional namespaces or create extensions. Property names 5824 of interest to the general public are encouraged to be registered in the 5825 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 5826 Formal registration is OPTIONAL.</xs:documentation> 5827 </xs:annotation> 5828 </xs:element> 5829 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5830 <xs:annotation> 5831 <xs:documentation> 5832 Allows any undeclared elements as long as the elements are placed in a different namespace. 5833 </xs:documentation> 5834 </xs:annotation> 5835 </xs:any> 5836 </xs:sequence> 5837 <xs:attribute name="bom-ref" type="bom:refType" use="required"> 5838 <xs:annotation> 5839 <xs:documentation> 5840 An optional identifier which can be used to reference the trigger elsewhere in the BOM. 5841 Uniqueness is enforced within all elements and children of the root-level bom element. 5842 </xs:documentation> 5843 </xs:annotation> 5844 </xs:attribute> 5845 <xs:anyAttribute namespace="##any" processContents="lax"> 5846 <xs:annotation> 5847 <xs:documentation>User-defined attributes may be used on this element as long as they 5848 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5849 </xs:annotation> 5850 </xs:anyAttribute> 5851 </xs:complexType> 5852 5853 <xs:simpleType name="triggerTypeType"> 5854 <xs:restriction base="xs:string"> 5855 <xs:enumeration value="manual"/> 5856 <xs:enumeration value="api"/> 5857 <xs:enumeration value="webhook"/> 5858 <xs:enumeration value="scheduled"/> 5859 </xs:restriction> 5860 </xs:simpleType> 5861 5862 <xs:complexType name="eventType"> 5863 <xs:sequence> 5864 <xs:element name="uid" type="xs:string" minOccurs="0" maxOccurs="1"> 5865 <xs:annotation> 5866 <xs:documentation> 5867 The unique identifier of the event. 5868 </xs:documentation> 5869 </xs:annotation> 5870 </xs:element> 5871 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 5872 <xs:annotation> 5873 <xs:documentation> 5874 A description of the event. 5875 </xs:documentation> 5876 </xs:annotation> 5877 </xs:element> 5878 <xs:element name="timeReceived" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 5879 <xs:annotation> 5880 <xs:documentation> 5881 The date and time (timestamp) when the event was received. 5882 </xs:documentation> 5883 </xs:annotation> 5884 </xs:element> 5885 <xs:element name="data" type="bom:attachedTextType" minOccurs="0" maxOccurs="1"> 5886 <xs:annotation> 5887 <xs:documentation> 5888 Encoding of the raw event data. 5889 </xs:documentation> 5890 </xs:annotation> 5891 </xs:element> 5892 <xs:element name="source" type="bom:resourceReferenceType" minOccurs="0" maxOccurs="1"> 5893 <xs:annotation> 5894 <xs:documentation> 5895 References the component or service that was the source of the event 5896 </xs:documentation> 5897 </xs:annotation> 5898 </xs:element> 5899 <xs:element name="target" type="bom:resourceReferenceType" minOccurs="0" maxOccurs="1"> 5900 <xs:annotation> 5901 <xs:documentation> 5902 References the component or service that was the target of the event 5903 </xs:documentation> 5904 </xs:annotation> 5905 </xs:element> 5906 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5907 <xs:annotation> 5908 <xs:documentation>Provides the ability to document properties in a name/value store. 5909 This provides flexibility to include data not officially supported in the standard 5910 without having to use additional namespaces or create extensions. Property names 5911 of interest to the general public are encouraged to be registered in the 5912 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 5913 Formal registration is OPTIONAL.</xs:documentation> 5914 </xs:annotation> 5915 </xs:element> 5916 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 5917 <xs:annotation> 5918 <xs:documentation> 5919 Allows any undeclared elements as long as the elements are placed in a different namespace. 5920 </xs:documentation> 5921 </xs:annotation> 5922 </xs:any> 5923 </xs:sequence> 5924 <xs:anyAttribute namespace="##any" processContents="lax"> 5925 <xs:annotation> 5926 <xs:documentation>User-defined attributes may be used on this element as long as they 5927 do not have the same name as an existing attribute used by the schema.</xs:documentation> 5928 </xs:annotation> 5929 </xs:anyAttribute> 5930 </xs:complexType> 5931 5932 <xs:complexType name="inputType"> 5933 <xs:annotation> 5934 <xs:documentation> 5935 Type that represents various input data types and formats. 5936 </xs:documentation> 5937 </xs:annotation> 5938 <xs:sequence> 5939 <xs:choice> 5940 <xs:element name="resource" type="bom:resourceReferenceType" minOccurs="1" maxOccurs="1"> 5941 <xs:annotation> 5942 <xs:documentation> 5943 A reference to an independent resource provided as an input to a task by the workflow runtime. 5944 </xs:documentation> 5945 </xs:annotation> 5946 </xs:element> 5947 <xs:element name="parameters" type="bom:parametersType" minOccurs="1" maxOccurs="1"> 5948 <xs:annotation> 5949 <xs:documentation> 5950 Inputs that have the form of parameters with names and values. 5951 </xs:documentation> 5952 </xs:annotation> 5953 </xs:element> 5954 <xs:element name="environmentVars" minOccurs="1" maxOccurs="1"> 5955 <xs:annotation> 5956 <xs:documentation> 5957 Inputs that have the form of parameters with names and values. 5958 </xs:documentation> 5959 </xs:annotation> 5960 <xs:complexType> 5961 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 5962 <!-- maxOccurs="unbounded" NEEDS to be set on the sequence, not the individual elements --> 5963 <xs:choice> 5964 <xs:element name="environmentVar" type="bom:propertyType" minOccurs="0" maxOccurs="1"/> 5965 <xs:element name="value" type="xs:string" minOccurs="0" maxOccurs="1"/> 5966 </xs:choice> 5967 </xs:sequence> 5968 </xs:complexType> 5969 </xs:element> 5970 <xs:element name="data" type="bom:attachedTextType" minOccurs="1" maxOccurs="1"> 5971 <xs:annotation> 5972 <xs:documentation> 5973 Inputs that have the form of data. 5974 </xs:documentation> 5975 </xs:annotation> 5976 </xs:element> 5977 </xs:choice> 5978 <xs:element name="source" type="bom:resourceReferenceType" minOccurs="0" maxOccurs="1"> 5979 <xs:annotation> 5980 <xs:documentation> 5981 A references to the component or service that provided the input to the task 5982 (e.g., reference to a service with data flow value of inbound) 5983 </xs:documentation> 5984 </xs:annotation> 5985 </xs:element> 5986 <xs:element name="target" type="bom:resourceReferenceType" minOccurs="0" maxOccurs="1"> 5987 <xs:annotation> 5988 <xs:documentation> 5989 A reference to the component or service that received or stored the input if not the task 5990 itself (e.g., a local, named storage workspace) 5991 </xs:documentation> 5992 </xs:annotation> 5993 </xs:element> 5994 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 5995 <xs:annotation> 5996 <xs:documentation>Provides the ability to document properties in a name/value store. 5997 This provides flexibility to include data not officially supported in the standard 5998 without having to use additional namespaces or create extensions. Property names 5999 of interest to the general public are encouraged to be registered in the 6000 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 6001 Formal registration is OPTIONAL.</xs:documentation> 6002 </xs:annotation> 6003 </xs:element> 6004 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 6005 <xs:annotation> 6006 <xs:documentation> 6007 Allows any undeclared elements as long as the elements are placed in a different namespace. 6008 </xs:documentation> 6009 </xs:annotation> 6010 </xs:any> 6011 </xs:sequence> 6012 <xs:anyAttribute namespace="##any" processContents="lax"> 6013 <xs:annotation> 6014 <xs:documentation>User-defined attributes may be used on this element as long as they 6015 do not have the same name as an existing attribute used by the schema.</xs:documentation> 6016 </xs:annotation> 6017 </xs:anyAttribute> 6018 </xs:complexType> 6019 6020 <xs:complexType name="outputType"> 6021 <xs:annotation> 6022 <xs:documentation> 6023 Represents resources and data output from a task at runtime by executor or task commands 6024 </xs:documentation> 6025 </xs:annotation> 6026 <xs:sequence> 6027 <xs:choice> 6028 <xs:element name="resource" type="bom:resourceReferenceType" minOccurs="1" maxOccurs="1"> 6029 <xs:annotation> 6030 <xs:documentation> 6031 A reference to an independent resource generated as output by the task. 6032 </xs:documentation> 6033 </xs:annotation> 6034 </xs:element> 6035 <xs:element name="environmentVars" minOccurs="1" maxOccurs="1"> 6036 <xs:annotation> 6037 <xs:documentation> 6038 Outputs that have the form of environment variables. 6039 </xs:documentation> 6040 </xs:annotation> 6041 <xs:complexType> 6042 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 6043 <!-- maxOccurs="unbounded" NEEDS to be set on the sequence, not the individual elements --> 6044 <xs:choice> 6045 <xs:element name="environmentVar" type="bom:propertyType" minOccurs="0" maxOccurs="1"/> 6046 <xs:element name="value" type="xs:string" minOccurs="0" maxOccurs="1"/> 6047 </xs:choice> 6048 </xs:sequence> 6049 </xs:complexType> 6050 </xs:element> 6051 <xs:element name="data" type="bom:attachedTextType" minOccurs="1" maxOccurs="1"> 6052 <xs:annotation> 6053 <xs:documentation> 6054 Outputs that have the form of data. 6055 </xs:documentation> 6056 </xs:annotation> 6057 </xs:element> 6058 </xs:choice> 6059 <xs:element name="type" type="bom:outputTypeEnum" minOccurs="0" maxOccurs="1"> 6060 <xs:annotation> 6061 <xs:documentation> 6062 Describes the type of data output. 6063 </xs:documentation> 6064 </xs:annotation> 6065 </xs:element> 6066 <xs:element name="source" type="bom:resourceReferenceType" minOccurs="0" maxOccurs="1"> 6067 <xs:annotation> 6068 <xs:documentation> 6069 Component or service that generated or provided the output from the task (e.g., a build tool) 6070 </xs:documentation> 6071 </xs:annotation> 6072 </xs:element> 6073 <xs:element name="target" type="bom:resourceReferenceType" minOccurs="0" maxOccurs="1"> 6074 <xs:annotation> 6075 <xs:documentation> 6076 Component or service that received the output from the task 6077 (e.g., reference to an artifactory service with data flow value of outbound) 6078 </xs:documentation> 6079 </xs:annotation> 6080 </xs:element> 6081 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 6082 <xs:annotation> 6083 <xs:documentation>Provides the ability to document properties in a name/value store. 6084 This provides flexibility to include data not officially supported in the standard 6085 without having to use additional namespaces or create extensions. Property names 6086 of interest to the general public are encouraged to be registered in the 6087 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 6088 Formal registration is OPTIONAL.</xs:documentation> 6089 </xs:annotation> 6090 </xs:element> 6091 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 6092 <xs:annotation> 6093 <xs:documentation> 6094 Allows any undeclared elements as long as the elements are placed in a different namespace. 6095 </xs:documentation> 6096 </xs:annotation> 6097 </xs:any> 6098 </xs:sequence> 6099 <xs:anyAttribute namespace="##any" processContents="lax"> 6100 <xs:annotation> 6101 <xs:documentation>User-defined attributes may be used on this element as long as they 6102 do not have the same name as an existing attribute used by the schema.</xs:documentation> 6103 </xs:annotation> 6104 </xs:anyAttribute> 6105 </xs:complexType> 6106 6107 <xs:simpleType name="outputTypeEnum"> 6108 <xs:restriction base="xs:string"> 6109 <xs:enumeration value="artifact"/> 6110 <xs:enumeration value="attestation"/> 6111 <xs:enumeration value="log"/> 6112 <xs:enumeration value="evidence"/> 6113 <xs:enumeration value="metrics"/> 6114 <xs:enumeration value="other"/> 6115 </xs:restriction> 6116 </xs:simpleType> 6117 6118 <xs:complexType name="parametersType"> 6119 <xs:sequence> 6120 <xs:element name="parameter" type="bom:parameterType" minOccurs="0" maxOccurs="unbounded" /> 6121 </xs:sequence> 6122 </xs:complexType> 6123 6124 <xs:complexType name="parameterType"> 6125 <xs:annotation> 6126 <xs:documentation> 6127 A representation of a functional parameter. 6128 </xs:documentation> 6129 </xs:annotation> 6130 <xs:sequence> 6131 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 6132 <xs:annotation> 6133 <xs:documentation> 6134 The name of the parameter. 6135 </xs:documentation> 6136 </xs:annotation> 6137 </xs:element> 6138 <xs:element name="value" type="xs:string" minOccurs="0" maxOccurs="1"> 6139 <xs:annotation> 6140 <xs:documentation> 6141 The value of the parameter. 6142 </xs:documentation> 6143 </xs:annotation> 6144 </xs:element> 6145 <xs:element name="dataType" type="xs:string" minOccurs="0" maxOccurs="1"> 6146 <xs:annotation> 6147 <xs:documentation> 6148 The data type of the parameter. 6149 </xs:documentation> 6150 </xs:annotation> 6151 </xs:element> 6152 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 6153 <xs:annotation> 6154 <xs:documentation> 6155 Allows any undeclared elements as long as the elements are placed in a different namespace. 6156 </xs:documentation> 6157 </xs:annotation> 6158 </xs:any> 6159 </xs:sequence> 6160 <xs:anyAttribute namespace="##any" processContents="lax"> 6161 <xs:annotation> 6162 <xs:documentation>User-defined attributes may be used on this element as long as they 6163 do not have the same name as an existing attribute used by the schema.</xs:documentation> 6164 </xs:annotation> 6165 </xs:anyAttribute> 6166 </xs:complexType> 6167 6168 <xs:complexType name="cryptoPropertiesType"> 6169 <xs:annotation> 6170 <xs:documentation> 6171 Cryptographic assets have properties that uniquely define them and that make them actionable for 6172 further reasoning. As an example, it makes a difference if one knows the algorithm family (e.g. AES) 6173 or the specific variant or instantiation (e.g. AES-128-GCM). This is because the security level and the 6174 algorithm primitive (authenticated encryption) is only defined by the definition of the algorithm variant. 6175 The presence of a weak cryptographic algorithm like SHA1 vs. HMAC-SHA1 also makes a difference. 6176 </xs:documentation> 6177 </xs:annotation> 6178 <xs:sequence> 6179 <xs:element name="assetType" minOccurs="1" maxOccurs="1"> 6180 <xs:annotation> 6181 <xs:documentation> 6182 Cryptographic assets occur in several forms. Algorithms and protocols are most commonly 6183 implemented in specialized cryptographic libraries. They may however also be 'hardcoded' 6184 in software components. Certificates and related cryptographic material like keys, tokens, 6185 secrets or passwords are other cryptographic assets to be modelled. 6186 </xs:documentation> 6187 </xs:annotation> 6188 <xs:simpleType> 6189 <xs:restriction base="xs:string"> 6190 <xs:enumeration value="algorithm"> 6191 <xs:annotation> 6192 <xs:documentation> 6193 Mathematical function commonly used for data encryption, authentication, and 6194 digital signatures. 6195 </xs:documentation> 6196 </xs:annotation> 6197 </xs:enumeration> 6198 <xs:enumeration value="certificate"> 6199 <xs:annotation> 6200 <xs:documentation> 6201 An electronic document that is used to provide the identity or validate a public key. 6202 </xs:documentation> 6203 </xs:annotation> 6204 </xs:enumeration> 6205 <xs:enumeration value="protocol"> 6206 <xs:annotation> 6207 <xs:documentation> 6208 A set of rules and guidelines that govern the behavior and communication with each other. 6209 </xs:documentation> 6210 </xs:annotation> 6211 </xs:enumeration> 6212 <xs:enumeration value="related-crypto-material"> 6213 <xs:annotation> 6214 <xs:documentation> 6215 Other cryptographic assets that are related to algorithms, certificate, and protocols 6216 such as keys and tokens. 6217 </xs:documentation> 6218 </xs:annotation> 6219 </xs:enumeration> 6220 </xs:restriction> 6221 </xs:simpleType> 6222 </xs:element> 6223 <xs:element name="algorithmProperties" minOccurs="0" maxOccurs="1"> 6224 <xs:annotation> 6225 <xs:documentation> 6226 Additional properties specific to a cryptographic algorithm. 6227 </xs:documentation> 6228 </xs:annotation> 6229 <xs:complexType> 6230 <xs:sequence> 6231 <xs:element name="primitive" minOccurs="0" maxOccurs="1"> 6232 <xs:annotation> 6233 <xs:documentation> 6234 Cryptographic building blocks used in higher-level cryptographic systems and 6235 protocols. Primitives represent different cryptographic routines: deterministic 6236 random bit generators (drbg, e.g. CTR_DRBG from NIST SP800-90A-r1), message 6237 authentication codes (mac, e.g. HMAC-SHA-256), blockciphers (e.g. AES), 6238 streamciphers (e.g. Salsa20), signatures (e.g. ECDSA), hash functions (e.g. SHA-256), 6239 public-key encryption schemes (pke, e.g. RSA), extended output functions 6240 (xof, e.g. SHAKE256), key derivation functions (e.g. pbkdf2), key agreement 6241 algorithms (e.g. ECDH), key encapsulation mechanisms (e.g. ML-KEM), authenticated 6242 encryption (ae, e.g. AES-GCM) and the combination of multiple algorithms 6243 (combiner, e.g. SP800-56Cr2). 6244 </xs:documentation> 6245 </xs:annotation> 6246 <xs:simpleType> 6247 <xs:restriction base="xs:string"> 6248 <xs:enumeration value="drbg"> 6249 <xs:annotation> 6250 <xs:documentation> 6251 Deterministic Random Bit Generator (DRBG) is a type of pseudorandom 6252 number generator designed to produce a sequence of bits from an initial 6253 seed value. DRBGs are commonly used in cryptographic applications where 6254 reproducibility of random values is important. 6255 </xs:documentation> 6256 </xs:annotation> 6257 </xs:enumeration> 6258 <xs:enumeration value="mac"> 6259 <xs:annotation> 6260 <xs:documentation> 6261 In cryptography, a Message Authentication Code (MAC) is information 6262 used for authenticating and integrity-checking a message. 6263 </xs:documentation> 6264 </xs:annotation> 6265 </xs:enumeration> 6266 <xs:enumeration value="block-cipher"> 6267 <xs:annotation> 6268 <xs:documentation> 6269 A block cipher is a symmetric key algorithm that operates on fixed-size 6270 blocks of data. It encrypts or decrypts the data in block units, 6271 providing confidentiality. Block ciphers are widely used in various 6272 cryptographic modes and protocols for secure data transmission. 6273 </xs:documentation> 6274 </xs:annotation> 6275 </xs:enumeration> 6276 <xs:enumeration value="stream-cipher"> 6277 <xs:annotation> 6278 <xs:documentation> 6279 A stream cipher is a symmetric key cipher where plaintext digits are 6280 combined with a pseudorandom cipher digit stream (keystream). 6281 </xs:documentation> 6282 </xs:annotation> 6283 </xs:enumeration> 6284 <xs:enumeration value="signature"> 6285 <xs:annotation> 6286 <xs:documentation> 6287 In cryptography, a signature is a digital representation of a message 6288 or data that proves its origin, identity, and integrity. Digital 6289 signatures are generated using cryptographic algorithms and are widely 6290 used for authentication and verification in secure communication. 6291 </xs:documentation> 6292 </xs:annotation> 6293 </xs:enumeration> 6294 <xs:enumeration value="hash"> 6295 <xs:annotation> 6296 <xs:documentation> 6297 A hash function is a mathematical algorithm that takes an input 6298 (or 'message') and produces a fixed-size string of characters, which is 6299 typically a hash value. Hash functions are commonly used in various 6300 cryptographic applications, including data integrity verification and 6301 password hashing. 6302 </xs:documentation> 6303 </xs:annotation> 6304 </xs:enumeration> 6305 <xs:enumeration value="pke"> 6306 <xs:annotation> 6307 <xs:documentation> 6308 Public Key Encryption (PKE) is a type of encryption that uses a pair of 6309 public and private keys for secure communication. The public key is used 6310 for encryption, while the private key is used for decryption. PKE is a 6311 fundamental component of public-key cryptography. 6312 </xs:documentation> 6313 </xs:annotation> 6314 </xs:enumeration> 6315 <xs:enumeration value="xof"> 6316 <xs:annotation> 6317 <xs:documentation> 6318 An XOF is an extendable output function that can take arbitrary input 6319 and creates a stream of output, up to a limit determined by the size of 6320 the internal state of the hash function that underlies the XOF. 6321 </xs:documentation> 6322 </xs:annotation> 6323 </xs:enumeration> 6324 <xs:enumeration value="kdf"> 6325 <xs:annotation> 6326 <xs:documentation> 6327 A Key Derivation Function (KDF) derives key material from another source 6328 of entropy while preserving the entropy of the input. 6329 </xs:documentation> 6330 </xs:annotation> 6331 </xs:enumeration> 6332 <xs:enumeration value="key-agree"> 6333 <xs:annotation> 6334 <xs:documentation> 6335 In cryptography, a key-agreement is a protocol whereby two or more 6336 parties agree on a cryptographic key in such a way that both influence 6337 the outcome. 6338 </xs:documentation> 6339 </xs:annotation> 6340 </xs:enumeration> 6341 <xs:enumeration value="kem"> 6342 <xs:annotation> 6343 <xs:documentation> 6344 A Key Encapsulation Mechanism (KEM) algorithm is a mechanism for 6345 transporting random keying material to a recipient using the recipient's 6346 public key. 6347 </xs:documentation> 6348 </xs:annotation> 6349 </xs:enumeration> 6350 <xs:enumeration value="ae"> 6351 <xs:annotation> 6352 <xs:documentation> 6353 Authenticated Encryption (AE) is a cryptographic process that provides 6354 both confidentiality and data integrity. It ensures that the encrypted 6355 data has not been tampered with and comes from a legitimate source. 6356 AE is commonly used in secure communication protocols. 6357 </xs:documentation> 6358 </xs:annotation> 6359 </xs:enumeration> 6360 <xs:enumeration value="combiner"> 6361 <xs:annotation> 6362 <xs:documentation> 6363 A combiner aggregates many candidates for a cryptographic primitive and 6364 generates a new candidate for the same primitive. 6365 </xs:documentation> 6366 </xs:annotation> 6367 </xs:enumeration> 6368 <xs:enumeration value="other"> 6369 <xs:annotation> 6370 <xs:documentation> 6371 Another primitive type. 6372 </xs:documentation> 6373 </xs:annotation> 6374 </xs:enumeration> 6375 <xs:enumeration value="unknown"> 6376 <xs:annotation> 6377 <xs:documentation> 6378 The primitive is not known. 6379 </xs:documentation> 6380 </xs:annotation> 6381 </xs:enumeration> 6382 </xs:restriction> 6383 </xs:simpleType> 6384 </xs:element> 6385 <xs:element name="parameterSetIdentifier" type="xs:string" minOccurs="0" maxOccurs="1"> 6386 <xs:annotation> 6387 <xs:documentation> 6388 An identifier for the parameter set of the cryptographic algorithm. Examples: in 6389 AES128, '128' identifies the key length in bits, in SHA256, '256' identifies the 6390 digest length, '128' in SHAKE128 identifies its maximum security level in bits, and 6391 'SHA2-128s' identifies a parameter set used in SLH-DSA (FIPS205). 6392 </xs:documentation> 6393 </xs:annotation> 6394 </xs:element> 6395 <xs:element name="curve" type="xs:string" minOccurs="0" maxOccurs="1"> 6396 <xs:annotation> 6397 <xs:documentation> 6398 The specific underlying Elliptic Curve (EC) definition employed which is an indicator 6399 of the level of security strength, performance and complexity. Absent an 6400 authoritative source of curve names, CycloneDX recommends use of curve names as 6401 defined at https://neuromancer.sk/std/, the source from which can be found at 6402 https://github.com/J08nY/std-curves. 6403 </xs:documentation> 6404 </xs:annotation> 6405 </xs:element> 6406 <xs:element name="executionEnvironment" minOccurs="0" maxOccurs="1"> 6407 <xs:annotation> 6408 <xs:documentation> 6409 The target and execution environment in which the algorithm is implemented in. 6410 </xs:documentation> 6411 </xs:annotation> 6412 <xs:simpleType> 6413 <xs:restriction base="xs:string"> 6414 <xs:enumeration value="software-plain-ram"> 6415 <xs:annotation> 6416 <xs:documentation> 6417 A software implementation running in plain unencrypted RAM. 6418 </xs:documentation> 6419 </xs:annotation> 6420 </xs:enumeration> 6421 <xs:enumeration value="software-encrypted-ram"> 6422 <xs:annotation> 6423 <xs:documentation> 6424 A software implementation running in encrypted RAM. 6425 </xs:documentation> 6426 </xs:annotation> 6427 </xs:enumeration><xs:enumeration value="software-tee"> 6428 <xs:annotation> 6429 <xs:documentation> 6430 A software implementation running in a trusted execution environment. 6431 </xs:documentation> 6432 </xs:annotation> 6433 </xs:enumeration><xs:enumeration value="hardware"> 6434 <xs:annotation> 6435 <xs:documentation> 6436 A hardware implementation. 6437 </xs:documentation> 6438 </xs:annotation> 6439 </xs:enumeration><xs:enumeration value="other"> 6440 <xs:annotation> 6441 <xs:documentation> 6442 Another implementation environment. 6443 </xs:documentation> 6444 </xs:annotation> 6445 </xs:enumeration><xs:enumeration value="unknown"> 6446 <xs:annotation> 6447 <xs:documentation> 6448 The execution environment is not known. 6449 </xs:documentation> 6450 </xs:annotation> 6451 </xs:enumeration> 6452 </xs:restriction> 6453 </xs:simpleType> 6454 </xs:element> 6455 <xs:element name="implementationPlatform" minOccurs="0" maxOccurs="1"> 6456 <xs:annotation> 6457 <xs:documentation> 6458 The target platform for which the algorithm is implemented. The implementation can 6459 be 'generic', running on any platform or for a specific platform. 6460 </xs:documentation> 6461 </xs:annotation> 6462 <xs:simpleType> 6463 <xs:restriction base="xs:string"> 6464 <xs:enumeration value="generic"/> 6465 <xs:enumeration value="x86_32"/> 6466 <xs:enumeration value="x86_64"/> 6467 <xs:enumeration value="armv7-a"/> 6468 <xs:enumeration value="armv7-m"/> 6469 <xs:enumeration value="armv8-a"/> 6470 <xs:enumeration value="armv8-m"/> 6471 <xs:enumeration value="armv9-a"/> 6472 <xs:enumeration value="armv9-m"/> 6473 <xs:enumeration value="s390x"/> 6474 <xs:enumeration value="ppc64"/> 6475 <xs:enumeration value="ppc64le"/> 6476 <xs:enumeration value="other"/> 6477 <xs:enumeration value="unknown"/> 6478 </xs:restriction> 6479 </xs:simpleType> 6480 </xs:element> 6481 <xs:element name="certificationLevel" minOccurs="0" maxOccurs="unbounded"> 6482 <xs:annotation> 6483 <xs:documentation> 6484 The certification that the implementation of the cryptographic algorithm has 6485 received, if any. Certifications include revisions and levels of FIPS 140 or 6486 Common Criteria of different Extended Assurance Levels (CC-EAL). 6487 </xs:documentation> 6488 </xs:annotation> 6489 <xs:simpleType> 6490 <xs:restriction base="xs:string"> 6491 <xs:enumeration value="none"> 6492 <xs:annotation> 6493 <xs:documentation> 6494 No certification obtained 6495 </xs:documentation> 6496 </xs:annotation> 6497 </xs:enumeration> 6498 <xs:enumeration value="fips140-1-l1"> 6499 <xs:annotation> 6500 <xs:documentation> 6501 FIPS 140-1 Level 1 6502 </xs:documentation> 6503 </xs:annotation> 6504 </xs:enumeration> 6505 <xs:enumeration value="fips140-1-l2"> 6506 <xs:annotation> 6507 <xs:documentation> 6508 FIPS 140-1 Level 2 6509 </xs:documentation> 6510 </xs:annotation> 6511 </xs:enumeration> 6512 <xs:enumeration value="fips140-1-l3"> 6513 <xs:annotation> 6514 <xs:documentation> 6515 FIPS 140-1 Level 3 6516 </xs:documentation> 6517 </xs:annotation> 6518 </xs:enumeration> 6519 <xs:enumeration value="fips140-1-l4"> 6520 <xs:annotation> 6521 <xs:documentation> 6522 FIPS 140-1 Level 4 6523 </xs:documentation> 6524 </xs:annotation> 6525 </xs:enumeration> 6526 <xs:enumeration value="fips140-2-l1"> 6527 <xs:annotation> 6528 <xs:documentation> 6529 FIPS 140-2 Level 1 6530 </xs:documentation> 6531 </xs:annotation> 6532 </xs:enumeration> 6533 <xs:enumeration value="fips140-2-l2"> 6534 <xs:annotation> 6535 <xs:documentation> 6536 FIPS 140-2 Level 2 6537 </xs:documentation> 6538 </xs:annotation> 6539 </xs:enumeration> 6540 <xs:enumeration value="fips140-2-l3"> 6541 <xs:annotation> 6542 <xs:documentation> 6543 FIPS 140-2 Level 3 6544 </xs:documentation> 6545 </xs:annotation> 6546 </xs:enumeration> 6547 <xs:enumeration value="fips140-2-l4"> 6548 <xs:annotation> 6549 <xs:documentation> 6550 FIPS 140-2 Level 4 6551 </xs:documentation> 6552 </xs:annotation> 6553 </xs:enumeration> 6554 <xs:enumeration value="fips140-3-l1"> 6555 <xs:annotation> 6556 <xs:documentation> 6557 FIPS 140-3 Level 1 6558 </xs:documentation> 6559 </xs:annotation> 6560 </xs:enumeration> 6561 <xs:enumeration value="fips140-3-l2"> 6562 <xs:annotation> 6563 <xs:documentation> 6564 FIPS 140-3 Level 2 6565 </xs:documentation> 6566 </xs:annotation> 6567 </xs:enumeration> 6568 <xs:enumeration value="fips140-3-l3"> 6569 <xs:annotation> 6570 <xs:documentation> 6571 FIPS 140-3 Level 3 6572 </xs:documentation> 6573 </xs:annotation> 6574 </xs:enumeration> 6575 <xs:enumeration value="fips140-3-l4"> 6576 <xs:annotation> 6577 <xs:documentation> 6578 FIPS 140-3 Level 4 6579 </xs:documentation> 6580 </xs:annotation> 6581 </xs:enumeration> 6582 <xs:enumeration value="cc-eal1"> 6583 <xs:annotation> 6584 <xs:documentation> 6585 Common Criteria - Evaluation Assurance Level 1 6586 </xs:documentation> 6587 </xs:annotation> 6588 </xs:enumeration> 6589 <xs:enumeration value="cc-eal1+"> 6590 <xs:annotation> 6591 <xs:documentation> 6592 Common Criteria - Evaluation Assurance Level 1 (Augmented) 6593 </xs:documentation> 6594 </xs:annotation> 6595 </xs:enumeration> 6596 <xs:enumeration value="cc-eal2"> 6597 <xs:annotation> 6598 <xs:documentation> 6599 Common Criteria - Evaluation Assurance Level 2 6600 </xs:documentation> 6601 </xs:annotation> 6602 </xs:enumeration> 6603 <xs:enumeration value="cc-eal2+"> 6604 <xs:annotation> 6605 <xs:documentation> 6606 Common Criteria - Evaluation Assurance Level 2 (Augmented) 6607 </xs:documentation> 6608 </xs:annotation> 6609 </xs:enumeration> 6610 <xs:enumeration value="cc-eal3"> 6611 <xs:annotation> 6612 <xs:documentation> 6613 Common Criteria - Evaluation Assurance Level 3 6614 </xs:documentation> 6615 </xs:annotation> 6616 </xs:enumeration> 6617 <xs:enumeration value="cc-eal3+"> 6618 <xs:annotation> 6619 <xs:documentation> 6620 Common Criteria - Evaluation Assurance Level 3 (Augmented) 6621 </xs:documentation> 6622 </xs:annotation> 6623 </xs:enumeration> 6624 <xs:enumeration value="cc-eal4"> 6625 <xs:annotation> 6626 <xs:documentation> 6627 Common Criteria - Evaluation Assurance Level 4 6628 </xs:documentation> 6629 </xs:annotation> 6630 </xs:enumeration> 6631 <xs:enumeration value="cc-eal4+"> 6632 <xs:annotation> 6633 <xs:documentation> 6634 Common Criteria - Evaluation Assurance Level 4 (Augmented) 6635 </xs:documentation> 6636 </xs:annotation> 6637 </xs:enumeration> 6638 <xs:enumeration value="cc-eal5"> 6639 <xs:annotation> 6640 <xs:documentation> 6641 Common Criteria - Evaluation Assurance Level 5 6642 </xs:documentation> 6643 </xs:annotation> 6644 </xs:enumeration> 6645 <xs:enumeration value="cc-eal5+"> 6646 <xs:annotation> 6647 <xs:documentation> 6648 Common Criteria - Evaluation Assurance Level 5 (Augmented) 6649 </xs:documentation> 6650 </xs:annotation> 6651 </xs:enumeration> 6652 <xs:enumeration value="cc-eal6"> 6653 <xs:annotation> 6654 <xs:documentation> 6655 Common Criteria - Evaluation Assurance Level 6 6656 </xs:documentation> 6657 </xs:annotation> 6658 </xs:enumeration> 6659 <xs:enumeration value="cc-eal6+"> 6660 <xs:annotation> 6661 <xs:documentation> 6662 Common Criteria - Evaluation Assurance Level 6 (Augmented) 6663 </xs:documentation> 6664 </xs:annotation> 6665 </xs:enumeration> 6666 <xs:enumeration value="cc-eal7"> 6667 <xs:annotation> 6668 <xs:documentation> 6669 Common Criteria - Evaluation Assurance Level 7 6670 </xs:documentation> 6671 </xs:annotation> 6672 </xs:enumeration> 6673 <xs:enumeration value="cc-eal7+"> 6674 <xs:annotation> 6675 <xs:documentation> 6676 Common Criteria - Evaluation Assurance Level 7 (Augmented) 6677 </xs:documentation> 6678 </xs:annotation> 6679 </xs:enumeration> 6680 <xs:enumeration value="other"> 6681 <xs:annotation> 6682 <xs:documentation> 6683 Another certification 6684 </xs:documentation> 6685 </xs:annotation> 6686 </xs:enumeration> 6687 <xs:enumeration value="unknown"> 6688 <xs:annotation> 6689 <xs:documentation> 6690 The certification level is not known 6691 </xs:documentation> 6692 </xs:annotation> 6693 </xs:enumeration> 6694 </xs:restriction> 6695 </xs:simpleType> 6696 </xs:element> 6697 <xs:element name="mode" minOccurs="0" maxOccurs="1"> 6698 <xs:annotation> 6699 <xs:documentation> 6700 The mode of operation in which the cryptographic algorithm (block cipher) is used. 6701 </xs:documentation> 6702 </xs:annotation> 6703 <xs:simpleType> 6704 <xs:restriction base="xs:string"> 6705 <xs:enumeration value="cbc"> 6706 <xs:annotation> 6707 <xs:documentation> 6708 Cipher block chaining 6709 </xs:documentation> 6710 </xs:annotation> 6711 </xs:enumeration> 6712 <xs:enumeration value="ecb"> 6713 <xs:annotation> 6714 <xs:documentation> 6715 Electronic codebook 6716 </xs:documentation> 6717 </xs:annotation> 6718 </xs:enumeration> 6719 <xs:enumeration value="ccm"> 6720 <xs:annotation> 6721 <xs:documentation> 6722 Counter with cipher block chaining message authentication code 6723 </xs:documentation> 6724 </xs:annotation> 6725 </xs:enumeration> 6726 <xs:enumeration value="gcm"> 6727 <xs:annotation> 6728 <xs:documentation> 6729 Galois/counter 6730 </xs:documentation> 6731 </xs:annotation> 6732 </xs:enumeration> 6733 <xs:enumeration value="cfb"> 6734 <xs:annotation> 6735 <xs:documentation> 6736 Cipher feedback 6737 </xs:documentation> 6738 </xs:annotation> 6739 </xs:enumeration> 6740 <xs:enumeration value="ofb"> 6741 <xs:annotation> 6742 <xs:documentation> 6743 Output feedback 6744 </xs:documentation> 6745 </xs:annotation> 6746 </xs:enumeration> 6747 <xs:enumeration value="ctr"> 6748 <xs:annotation> 6749 <xs:documentation> 6750 Counter 6751 </xs:documentation> 6752 </xs:annotation> 6753 </xs:enumeration> 6754 <xs:enumeration value="other"> 6755 <xs:annotation> 6756 <xs:documentation> 6757 Another mode of operation 6758 </xs:documentation> 6759 </xs:annotation> 6760 </xs:enumeration> 6761 <xs:enumeration value="unknown"> 6762 <xs:annotation> 6763 <xs:documentation> 6764 The mode of operation is not known 6765 </xs:documentation> 6766 </xs:annotation> 6767 </xs:enumeration> 6768 </xs:restriction> 6769 </xs:simpleType> 6770 </xs:element> 6771 <xs:element name="padding" minOccurs="0" maxOccurs="1"> 6772 <xs:annotation> 6773 <xs:documentation> 6774 The padding scheme that is used for the cryptographic algorithm. 6775 </xs:documentation> 6776 </xs:annotation> 6777 <xs:simpleType> 6778 <xs:restriction base="xs:string"> 6779 <xs:enumeration value="pkcs5"> 6780 <xs:annotation> 6781 <xs:documentation> 6782 Password-Based Cryptography Specification #5 6783 </xs:documentation> 6784 </xs:annotation> 6785 </xs:enumeration> 6786 <xs:enumeration value="pkcs7"> 6787 <xs:annotation> 6788 <xs:documentation> 6789 Public Key Cryptography Standard: Cryptographic Message Syntax 6790 </xs:documentation> 6791 </xs:annotation> 6792 </xs:enumeration> 6793 <xs:enumeration value="pkcs1v15"> 6794 <xs:annotation> 6795 <xs:documentation> 6796 Public Key Cryptography Standard: RSA Cryptography v1.5 6797 </xs:documentation> 6798 </xs:annotation> 6799 </xs:enumeration> 6800 <xs:enumeration value="oaep"> 6801 <xs:annotation> 6802 <xs:documentation> 6803 Optimal asymmetric encryption padding 6804 </xs:documentation> 6805 </xs:annotation> 6806 </xs:enumeration> 6807 <xs:enumeration value="raw"> 6808 <xs:annotation> 6809 <xs:documentation> 6810 Raw 6811 </xs:documentation> 6812 </xs:annotation> 6813 </xs:enumeration> 6814 <xs:enumeration value="other"> 6815 <xs:annotation> 6816 <xs:documentation> 6817 Another padding scheme 6818 </xs:documentation> 6819 </xs:annotation> 6820 </xs:enumeration> 6821 <xs:enumeration value="unknown"> 6822 <xs:annotation> 6823 <xs:documentation> 6824 The padding scheme is not known 6825 </xs:documentation> 6826 </xs:annotation> 6827 </xs:enumeration> 6828 </xs:restriction> 6829 </xs:simpleType> 6830 </xs:element> 6831 <xs:element name="cryptoFunctions" minOccurs="0" maxOccurs="1"> 6832 <xs:annotation> 6833 <xs:documentation> 6834 The cryptographic functions implemented by the cryptographic algorithm. 6835 </xs:documentation> 6836 </xs:annotation> 6837 <xs:complexType> 6838 <xs:sequence> 6839 <xs:element name="cryptoFunction" minOccurs="0" maxOccurs="unbounded"> 6840 <xs:simpleType> 6841 <xs:restriction base="xs:string"> 6842 <xs:enumeration value="generate"/> 6843 <xs:enumeration value="keygen"/> 6844 <xs:enumeration value="encrypt"/> 6845 <xs:enumeration value="decrypt"/> 6846 <xs:enumeration value="digest"/> 6847 <xs:enumeration value="tag"/> 6848 <xs:enumeration value="keyderive"/> 6849 <xs:enumeration value="sign"/> 6850 <xs:enumeration value="verify"/> 6851 <xs:enumeration value="encapsulate"/> 6852 <xs:enumeration value="decapsulate"/> 6853 <xs:enumeration value="other"/> 6854 <xs:enumeration value="unknown"/> 6855 </xs:restriction> 6856 </xs:simpleType> 6857 </xs:element> 6858 </xs:sequence> 6859 </xs:complexType> 6860 </xs:element> 6861 <xs:element name="classicalSecurityLevel" minOccurs="0" maxOccurs="1"> 6862 <xs:annotation> 6863 <xs:documentation> 6864 The classical security level that a cryptographic algorithm provides (in bits). 6865 </xs:documentation> 6866 </xs:annotation> 6867 <xs:simpleType> 6868 <xs:restriction base="xs:integer"> 6869 <xs:minInclusive value="0"/> 6870 </xs:restriction> 6871 </xs:simpleType> 6872 </xs:element> 6873 <xs:element name="nistQuantumSecurityLevel" minOccurs="0" maxOccurs="1"> 6874 <xs:annotation> 6875 <xs:documentation> 6876 The NIST security strength category as defined in 6877 https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria). 6878 A value of 0 indicates that none of the categories are met. 6879 </xs:documentation> 6880 </xs:annotation> 6881 <xs:simpleType> 6882 <xs:restriction base="xs:integer"> 6883 <xs:minInclusive value="0"/> 6884 <xs:maxInclusive value="6"/> 6885 </xs:restriction> 6886 </xs:simpleType> 6887 </xs:element> 6888 </xs:sequence> 6889 </xs:complexType> 6890 </xs:element> 6891 <xs:element name="certificateProperties" minOccurs="0" maxOccurs="1"> 6892 <xs:annotation> 6893 <xs:documentation> 6894 Properties for cryptographic assets of asset type 'certificate' 6895 </xs:documentation> 6896 </xs:annotation> 6897 <xs:complexType> 6898 <xs:sequence> 6899 <xs:element name="subjectName" type="xs:string" minOccurs="0" maxOccurs="1"> 6900 <xs:annotation> 6901 <xs:documentation> 6902 The subject name for the certificate 6903 </xs:documentation> 6904 </xs:annotation> 6905 </xs:element> 6906 <xs:element name="issuerName" type="xs:string" minOccurs="0" maxOccurs="1"> 6907 <xs:annotation> 6908 <xs:documentation> 6909 The issuer name for the certificate 6910 </xs:documentation> 6911 </xs:annotation> 6912 </xs:element> 6913 <xs:element name="notValidBefore" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 6914 <xs:annotation> 6915 <xs:documentation> 6916 The date and time according to ISO-8601 standard from which the certificate is valid 6917 </xs:documentation> 6918 </xs:annotation> 6919 </xs:element> 6920 <xs:element name="notValidAfter" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 6921 <xs:annotation> 6922 <xs:documentation> 6923 The date and time according to ISO-8601 standard from which the certificate is not valid anymore 6924 </xs:documentation> 6925 </xs:annotation> 6926 </xs:element> 6927 <xs:element name="signatureAlgorithmRef" type="bom:refType" minOccurs="0" maxOccurs="1"> 6928 <xs:annotation> 6929 <xs:documentation> 6930 The bom-ref to signature algorithm used by the certificate 6931 </xs:documentation> 6932 </xs:annotation> 6933 </xs:element> 6934 <xs:element name="subjectPublicKeyRef" type="bom:refType" minOccurs="0" maxOccurs="1"> 6935 <xs:annotation> 6936 <xs:documentation> 6937 The bom-ref to the public key of the subject 6938 </xs:documentation> 6939 </xs:annotation> 6940 </xs:element> 6941 <xs:element name="certificateFormat" type="xs:string" minOccurs="0" maxOccurs="1"> 6942 <xs:annotation> 6943 <xs:documentation> 6944 The format of the certificate. Examples include X.509, PEM, DER, and CVC 6945 </xs:documentation> 6946 </xs:annotation> 6947 </xs:element> 6948 <xs:element name="certificateExtension" type="xs:string" minOccurs="0" maxOccurs="1"> 6949 <xs:annotation> 6950 <xs:documentation> 6951 The file extension of the certificate. Examples include crt, pem, cer, der, and p12. 6952 </xs:documentation> 6953 </xs:annotation> 6954 </xs:element> 6955 </xs:sequence> 6956 </xs:complexType> 6957 </xs:element> 6958 <xs:element name="relatedCryptoMaterialProperties" minOccurs="0" maxOccurs="1"> 6959 <xs:annotation> 6960 <xs:documentation> 6961 Properties for cryptographic assets of asset type 'relatedCryptoMaterial' 6962 </xs:documentation> 6963 </xs:annotation> 6964 <xs:complexType> 6965 <xs:sequence> 6966 <xs:element name="type" minOccurs="0" maxOccurs="1"> 6967 <xs:annotation> 6968 <xs:documentation> 6969 The type for the related cryptographic material 6970 </xs:documentation> 6971 </xs:annotation> 6972 <xs:simpleType> 6973 <xs:restriction base="xs:string"> 6974 <xs:enumeration value="private-key"/> 6975 <xs:enumeration value="public-key"/> 6976 <xs:enumeration value="secret-key"/> 6977 <xs:enumeration value="key"/> 6978 <xs:enumeration value="ciphertext"/> 6979 <xs:enumeration value="signature"/> 6980 <xs:enumeration value="digest"/> 6981 <xs:enumeration value="initialization-vector"/> 6982 <xs:enumeration value="nonce"/> 6983 <xs:enumeration value="seed"/> 6984 <xs:enumeration value="salt"/> 6985 <xs:enumeration value="shared-secret"/> 6986 <xs:enumeration value="tag"/> 6987 <xs:enumeration value="additional-data"/> 6988 <xs:enumeration value="password"/> 6989 <xs:enumeration value="credential"/> 6990 <xs:enumeration value="token"/> 6991 <xs:enumeration value="other"/> 6992 <xs:enumeration value="unknown"/> 6993 </xs:restriction> 6994 </xs:simpleType> 6995 </xs:element> 6996 <xs:element name="id" type="xs:string" minOccurs="0" maxOccurs="1"> 6997 <xs:annotation> 6998 <xs:documentation> 6999 The optional unique identifier for the related cryptographic material. 7000 </xs:documentation> 7001 </xs:annotation> 7002 </xs:element> 7003 <xs:element name="state" minOccurs="0" maxOccurs="1"> 7004 <xs:annotation> 7005 <xs:documentation> 7006 The key state as defined by NIST SP 800-57. 7007 </xs:documentation> 7008 </xs:annotation> 7009 <xs:simpleType> 7010 <xs:restriction base="xs:string"> 7011 <xs:enumeration value="pre-activation"/> 7012 <xs:enumeration value="active"/> 7013 <xs:enumeration value="suspended"/> 7014 <xs:enumeration value="deactivated"/> 7015 <xs:enumeration value="compromised"/> 7016 <xs:enumeration value="destroyed"/> 7017 </xs:restriction> 7018 </xs:simpleType> 7019 </xs:element> 7020 <xs:element name="algorithmRef" type="bom:refType" minOccurs="0" maxOccurs="1"> 7021 <xs:annotation> 7022 <xs:documentation> 7023 The bom-ref to the algorithm used to generate the related cryptographic material. 7024 </xs:documentation> 7025 </xs:annotation> 7026 </xs:element> 7027 <xs:element name="creationDate" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 7028 <xs:annotation> 7029 <xs:documentation> 7030 The date and time (timestamp) when the related cryptographic material was created. 7031 </xs:documentation> 7032 </xs:annotation> 7033 </xs:element> 7034 <xs:element name="activationDate" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 7035 <xs:annotation> 7036 <xs:documentation> 7037 The date and time (timestamp) when the related cryptographic material was activated. 7038 </xs:documentation> 7039 </xs:annotation> 7040 </xs:element> 7041 <xs:element name="updateDate" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 7042 <xs:annotation> 7043 <xs:documentation> 7044 The date and time (timestamp) when the related cryptographic material was updated. 7045 </xs:documentation> 7046 </xs:annotation> 7047 </xs:element> 7048 <xs:element name="expirationDate" type="xs:dateTime" minOccurs="0" maxOccurs="1"> 7049 <xs:annotation> 7050 <xs:documentation> 7051 The date and time (timestamp) when the related cryptographic material expires. 7052 </xs:documentation> 7053 </xs:annotation> 7054 </xs:element> 7055 <xs:element name="value" type="xs:string" minOccurs="0" maxOccurs="1"> 7056 <xs:annotation> 7057 <xs:documentation> 7058 The associated value of the cryptographic material. 7059 </xs:documentation> 7060 </xs:annotation> 7061 </xs:element> 7062 <xs:element name="size" type="xs:integer" minOccurs="0" maxOccurs="1"> 7063 <xs:annotation> 7064 <xs:documentation> 7065 The size of the cryptographic asset (in bits). 7066 </xs:documentation> 7067 </xs:annotation> 7068 </xs:element> 7069 <xs:element name="format" type="xs:string" minOccurs="0" maxOccurs="1"> 7070 <xs:annotation> 7071 <xs:documentation> 7072 The format of the related cryptographic material (e.g. P8, PEM, DER). 7073 </xs:documentation> 7074 </xs:annotation> 7075 </xs:element> 7076 <xs:element name="securedBy" minOccurs="0" maxOccurs="1"> 7077 <xs:annotation> 7078 <xs:documentation> 7079 The mechanism by which the cryptographic asset is secured by. 7080 </xs:documentation> 7081 </xs:annotation> 7082 <xs:complexType> 7083 <xs:sequence> 7084 <xs:element name="mechanism" type="xs:string" minOccurs="0" maxOccurs="1"> 7085 <xs:annotation> 7086 <xs:documentation> 7087 Specifies the mechanism by which the cryptographic asset is secured by. 7088 Examples include HSM, TPM, XGX, Software, and None. 7089 </xs:documentation> 7090 </xs:annotation> 7091 </xs:element> 7092 <xs:element name="algorithmRef" type="bom:refType" minOccurs="0" maxOccurs="1"> 7093 <xs:annotation> 7094 <xs:documentation> 7095 The bom-ref to the algorithm. 7096 </xs:documentation> 7097 </xs:annotation> 7098 </xs:element> 7099 </xs:sequence> 7100 </xs:complexType> 7101 </xs:element> 7102 </xs:sequence> 7103 </xs:complexType> 7104 </xs:element> 7105 <xs:element name="protocolProperties" minOccurs="0" maxOccurs="1"> 7106 <xs:annotation> 7107 <xs:documentation> 7108 Properties specific to cryptographic assets of type: 'protocol'. 7109 </xs:documentation> 7110 </xs:annotation> 7111 <xs:complexType> 7112 <xs:sequence> 7113 <xs:element name="type" minOccurs="0" maxOccurs="1"> 7114 <xs:annotation> 7115 <xs:documentation> 7116 The concrete protocol type. 7117 </xs:documentation> 7118 </xs:annotation> 7119 <xs:simpleType> 7120 <xs:restriction base="xs:string"> 7121 <xs:enumeration value="tls"> 7122 <xs:annotation> 7123 <xs:documentation> 7124 Transport Layer Security 7125 </xs:documentation> 7126 </xs:annotation> 7127 </xs:enumeration> 7128 <xs:enumeration value="ssh"> 7129 <xs:annotation> 7130 <xs:documentation> 7131 Secure Shell 7132 </xs:documentation> 7133 </xs:annotation> 7134 </xs:enumeration> 7135 <xs:enumeration value="ipsec"> 7136 <xs:annotation> 7137 <xs:documentation> 7138 Internet Protocol Security 7139 </xs:documentation> 7140 </xs:annotation> 7141 </xs:enumeration> 7142 <xs:enumeration value="ike"> 7143 <xs:annotation> 7144 <xs:documentation> 7145 Internet Key Exchange 7146 </xs:documentation> 7147 </xs:annotation> 7148 </xs:enumeration> 7149 <xs:enumeration value="sstp"> 7150 <xs:annotation> 7151 <xs:documentation> 7152 Secure Socket Tunneling Protocol 7153 </xs:documentation> 7154 </xs:annotation> 7155 </xs:enumeration> 7156 <xs:enumeration value="wpa"> 7157 <xs:annotation> 7158 <xs:documentation> 7159 Wi-Fi Protected Access 7160 </xs:documentation> 7161 </xs:annotation> 7162 </xs:enumeration> 7163 <xs:enumeration value="other"> 7164 <xs:annotation> 7165 <xs:documentation> 7166 Another protocol type 7167 </xs:documentation> 7168 </xs:annotation> 7169 </xs:enumeration> 7170 <xs:enumeration value="unknown"> 7171 <xs:annotation> 7172 <xs:documentation> 7173 The protocol type is not known 7174 </xs:documentation> 7175 </xs:annotation> 7176 </xs:enumeration> 7177 </xs:restriction> 7178 </xs:simpleType> 7179 </xs:element> 7180 <xs:element name="version" type="xs:string" minOccurs="0" maxOccurs="1"> 7181 <xs:annotation> 7182 <xs:documentation> 7183 The version of the protocol. Examples include 1.0, 1.2, and 1.99. 7184 </xs:documentation> 7185 </xs:annotation> 7186 </xs:element> 7187 <xs:element name="cipherSuites" minOccurs="0" maxOccurs="1"> 7188 <xs:annotation> 7189 <xs:documentation> 7190 A list of cipher suites related to the protocol. 7191 </xs:documentation> 7192 </xs:annotation> 7193 <xs:complexType> 7194 <xs:sequence> 7195 <xs:element name="cipherSuite" minOccurs="0" maxOccurs="unbounded"> 7196 <xs:complexType> 7197 <xs:sequence> 7198 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 7199 <xs:annotation> 7200 <xs:documentation> 7201 A common name for the cipher suite. For example: TLS_DHE_RSA_WITH_AES_128_CCM 7202 </xs:documentation> 7203 </xs:annotation> 7204 </xs:element> 7205 <xs:element name="algorithms" minOccurs="0" maxOccurs="1"> 7206 <xs:annotation> 7207 <xs:documentation> 7208 A list of algorithms related to the cipher suite. 7209 </xs:documentation> 7210 </xs:annotation> 7211 <xs:complexType> 7212 <xs:sequence> 7213 <xs:element name="algorithm" type="bom:refType" minOccurs="0" maxOccurs="unbounded"> 7214 <xs:annotation> 7215 <xs:documentation> 7216 The bom-ref to algorithm cryptographic asset. 7217 </xs:documentation> 7218 </xs:annotation> 7219 </xs:element> 7220 </xs:sequence> 7221 </xs:complexType> 7222 </xs:element> 7223 <xs:element name="identifiers" minOccurs="0" maxOccurs="1"> 7224 <xs:annotation> 7225 <xs:documentation> 7226 A list of common identifiers for the cipher suite. 7227 </xs:documentation> 7228 </xs:annotation> 7229 <xs:complexType> 7230 <xs:sequence> 7231 <xs:element name="identifier" type="xs:string" minOccurs="0" maxOccurs="unbounded"> 7232 <xs:annotation> 7233 <xs:documentation> 7234 Cipher suite identifier. Examples include 0xC0 and 0x9E. 7235 </xs:documentation> 7236 </xs:annotation> 7237 </xs:element> 7238 </xs:sequence> 7239 </xs:complexType> 7240 </xs:element> 7241 </xs:sequence> 7242 </xs:complexType> 7243 </xs:element> 7244 </xs:sequence> 7245 </xs:complexType> 7246 </xs:element> 7247 <xs:element name="ikev2TransformTypes" minOccurs="0" maxOccurs="1"> 7248 <xs:annotation> 7249 <xs:documentation> 7250 The IKEv2 transform types supported (types 1-4), defined in RFC7296 section 3.3.2, 7251 and additional properties. 7252 </xs:documentation> 7253 </xs:annotation> 7254 <xs:complexType> 7255 <xs:sequence> 7256 <xs:element name="encr" type="bom:refType" minOccurs="0" maxOccurs="unbounded"> 7257 <xs:annotation> 7258 <xs:documentation> 7259 Transform Type 1: encryption algorithms 7260 </xs:documentation> 7261 </xs:annotation> 7262 </xs:element> 7263 <xs:element name="prf" type="bom:refType" minOccurs="0" maxOccurs="unbounded"> 7264 <xs:annotation> 7265 <xs:documentation> 7266 Transform Type 2: pseudorandom functions 7267 </xs:documentation> 7268 </xs:annotation> 7269 </xs:element> 7270 <xs:element name="integ" type="bom:refType" minOccurs="0" maxOccurs="unbounded"> 7271 <xs:annotation> 7272 <xs:documentation> 7273 Transform Type 3: integrity algorithms 7274 </xs:documentation> 7275 </xs:annotation> 7276 </xs:element> 7277 <xs:element name="ke" type="bom:refType" minOccurs="0" maxOccurs="unbounded"> 7278 <xs:annotation> 7279 <xs:documentation> 7280 Transform Type 4: Key Exchange Method (KE) per RFC9370, formerly called Diffie-Hellman Group (D-H) 7281 </xs:documentation> 7282 </xs:annotation> 7283 </xs:element> 7284 <xs:element name="esn" type="xs:boolean" minOccurs="0" maxOccurs="1"> 7285 <xs:annotation> 7286 <xs:documentation> 7287 Specifies if an Extended Sequence Number (ESN) is used. 7288 </xs:documentation> 7289 </xs:annotation> 7290 </xs:element> 7291 <xs:element name="auth" type="bom:refType" minOccurs="0" maxOccurs="unbounded"> 7292 <xs:annotation> 7293 <xs:documentation> 7294 IKEv2 Authentication method 7295 </xs:documentation> 7296 </xs:annotation> 7297 </xs:element> 7298 </xs:sequence> 7299 </xs:complexType> 7300 </xs:element> 7301 </xs:sequence> 7302 </xs:complexType> 7303 </xs:element> 7304 <xs:element name="oid" type="xs:string" minOccurs="0" maxOccurs="1"> 7305 <xs:annotation> 7306 <xs:documentation> 7307 The object identifier (OID) of the cryptographic asset. 7308 </xs:documentation> 7309 </xs:annotation> 7310 </xs:element> 7311 </xs:sequence> 7312 </xs:complexType> 7313 7314 <xs:complexType name="declarationsType"> 7315 <xs:sequence> 7316 <xs:element name="assessors" minOccurs="0" maxOccurs="1"> 7317 <xs:annotation> 7318 <xs:documentation> 7319 The list of assessors evaluating claims and determining conformance to requirements and confidence in that assessment. 7320 </xs:documentation> 7321 </xs:annotation> 7322 <xs:complexType> 7323 <xs:sequence> 7324 <xs:element name="assessor" minOccurs="0" maxOccurs="unbounded"> 7325 <xs:annotation> 7326 <xs:documentation> 7327 The assessor who evaluates claims and determines conformance to requirements and confidence in that assessment. 7328 </xs:documentation> 7329 </xs:annotation> 7330 <xs:complexType> 7331 <xs:sequence> 7332 <xs:element name="thirdParty" type="xs:boolean" minOccurs="0" maxOccurs="1"> 7333 <xs:annotation> 7334 <xs:documentation> 7335 The boolean indicating if the assessor is outside the organization generating claims. A value of false indicates a self assessor. 7336 </xs:documentation> 7337 </xs:annotation> 7338 </xs:element> 7339 <xs:element name="organization" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 7340 <xs:annotation> 7341 <xs:documentation> 7342 The entity issuing the assessment. 7343 </xs:documentation> 7344 </xs:annotation> 7345 </xs:element> 7346 </xs:sequence> 7347 <xs:attribute name="bom-ref" type="bom:refType"> 7348 <xs:annotation> 7349 <xs:documentation> 7350 An optional identifier which can be used to reference the object elsewhere in the BOM. 7351 Every bom-ref MUST be unique within the BOM. 7352 </xs:documentation> 7353 </xs:annotation> 7354 </xs:attribute> 7355 <xs:anyAttribute namespace="##other" processContents="lax"> 7356 <xs:annotation> 7357 <xs:documentation>User-defined attributes may be used on this element as long as they 7358 do not have the same name as an existing attribute used by the schema.</xs:documentation> 7359 </xs:annotation> 7360 </xs:anyAttribute> 7361 </xs:complexType> 7362 </xs:element> 7363 </xs:sequence> 7364 </xs:complexType> 7365 </xs:element> 7366 <xs:element name="attestations" minOccurs="0" maxOccurs="1"> 7367 <xs:annotation> 7368 <xs:documentation> 7369 The list of attestations asserted by an assessor that maps requirements to claims. 7370 </xs:documentation> 7371 </xs:annotation> 7372 <xs:complexType> 7373 <xs:sequence> 7374 <xs:element name="attestation" minOccurs="0" maxOccurs="unbounded"> 7375 <xs:annotation> 7376 <xs:documentation> 7377 An attestation asserted by an assessor that maps requirements to claims. 7378 </xs:documentation> 7379 </xs:annotation> 7380 <xs:complexType> 7381 <xs:sequence> 7382 <xs:element name="summary" type="xs:string" minOccurs="0" maxOccurs="1"> 7383 <xs:annotation> 7384 <xs:documentation> 7385 The short description explaining the main points of the attestation. 7386 </xs:documentation> 7387 </xs:annotation> 7388 </xs:element> 7389 <xs:element name="assessor" type="bom:refLinkType" minOccurs="0" maxOccurs="1"> 7390 <xs:annotation> 7391 <xs:documentation> 7392 The `bom-ref` to the assessor asserting the attestation. 7393 </xs:documentation> 7394 </xs:annotation> 7395 </xs:element> 7396 <xs:element name="map" minOccurs="0" maxOccurs="unbounded"> 7397 <xs:annotation> 7398 <xs:documentation> 7399 The grouping of requirements to claims and the attestors declared conformance and confidence thereof. 7400 </xs:documentation> 7401 </xs:annotation> 7402 <xs:complexType> 7403 <xs:sequence> 7404 <xs:element name="requirement" type="bom:refLinkType" minOccurs="0" maxOccurs="1"> 7405 <xs:annotation> 7406 <xs:documentation> 7407 The `bom-ref` to the requirement being attested to. 7408 </xs:documentation> 7409 </xs:annotation> 7410 </xs:element> 7411 <xs:element name="claims" minOccurs="0" maxOccurs="1"> 7412 <xs:annotation> 7413 <xs:documentation> 7414 The list of `bom-ref` to the claims being attested to. 7415 </xs:documentation> 7416 </xs:annotation> 7417 <xs:complexType> 7418 <xs:sequence> 7419 <xs:element name="claim" type="bom:refLinkType" minOccurs="0" maxOccurs="unbounded"> 7420 <xs:annotation> 7421 <xs:documentation> 7422 The `bom-ref` to the claim being attested to. 7423 </xs:documentation> 7424 </xs:annotation> 7425 </xs:element> 7426 </xs:sequence> 7427 </xs:complexType> 7428 </xs:element> 7429 <xs:element name="counterClaims" minOccurs="0" maxOccurs="1"> 7430 <xs:annotation> 7431 <xs:documentation> 7432 The list of `bom-ref` to the counter claims being attested to. 7433 </xs:documentation> 7434 </xs:annotation> 7435 <xs:complexType> 7436 <xs:sequence> 7437 <xs:element name="counterClaim" type="bom:refLinkType" minOccurs="0" maxOccurs="unbounded"> 7438 <xs:annotation> 7439 <xs:documentation> 7440 The `bom-ref` to the counter claim being attested to. 7441 </xs:documentation> 7442 </xs:annotation> 7443 </xs:element> 7444 </xs:sequence> 7445 </xs:complexType> 7446 </xs:element> 7447 <xs:element name="conformance" minOccurs="0" maxOccurs="1"> 7448 <xs:annotation> 7449 <xs:documentation> 7450 The conformance of the claim meeting a requirement. 7451 </xs:documentation> 7452 </xs:annotation> 7453 <xs:complexType> 7454 <xs:sequence> 7455 <xs:element name="score"> 7456 <xs:annotation> 7457 <xs:documentation> 7458 The conformance of the claim between and inclusive of 0 and 1, where 1 is 100% conformance. 7459 </xs:documentation> 7460 </xs:annotation> 7461 <xs:simpleType> 7462 <xs:restriction base="xs:decimal"> 7463 <xs:minInclusive value="0"/> 7464 <xs:maxInclusive value="1"/> 7465 </xs:restriction> 7466 </xs:simpleType> 7467 </xs:element> 7468 <xs:element name="rationale" type="xs:string" minOccurs="0" maxOccurs="1"> 7469 <xs:annotation> 7470 <xs:documentation> 7471 The rationale for the score of conformance. 7472 </xs:documentation> 7473 </xs:annotation> 7474 </xs:element> 7475 <xs:element name="mitigationStrategies" minOccurs="0" maxOccurs="1"> 7476 <xs:annotation> 7477 <xs:documentation> 7478 The list of `bom-ref` to the evidence provided describing the 7479 mitigation strategies. Each mitigation strategy should include an 7480 explanation of how any weaknesses in the evidence will be mitigated. 7481 </xs:documentation> 7482 </xs:annotation> 7483 <xs:complexType> 7484 <xs:sequence> 7485 <xs:element name="mitigationStrategy" type="bom:refLinkType" minOccurs="0" maxOccurs="unbounded"/> 7486 </xs:sequence> 7487 </xs:complexType> 7488 </xs:element> 7489 </xs:sequence> 7490 </xs:complexType> 7491 </xs:element> 7492 <xs:element name="confidence" minOccurs="0" maxOccurs="1"> 7493 <xs:annotation> 7494 <xs:documentation> 7495 The confidence of the claim meeting the requirement. 7496 </xs:documentation> 7497 </xs:annotation> 7498 <xs:complexType> 7499 <xs:sequence> 7500 <xs:element name="score"> 7501 <xs:annotation> 7502 <xs:documentation> 7503 The confidence of the claim between and inclusive of 0 and 1, where 1 is 100% confidence. 7504 </xs:documentation> 7505 </xs:annotation> 7506 <xs:simpleType> 7507 <xs:restriction base="xs:decimal"> 7508 <xs:minInclusive value="0"/> 7509 <xs:maxInclusive value="1"/> 7510 </xs:restriction> 7511 </xs:simpleType> 7512 </xs:element> 7513 <xs:element name="rationale" type="xs:string" minOccurs="0" maxOccurs="1"> 7514 <xs:annotation> 7515 <xs:documentation> 7516 The rationale for the confidence score. 7517 </xs:documentation> 7518 </xs:annotation> 7519 </xs:element> 7520 </xs:sequence> 7521 </xs:complexType> 7522 </xs:element> 7523 </xs:sequence> 7524 </xs:complexType> 7525 </xs:element> 7526 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 7527 <xs:annotation> 7528 <xs:documentation> 7529 Allows any undeclared elements as long as the elements are placed in a different namespace. 7530 </xs:documentation> 7531 </xs:annotation> 7532 </xs:any> 7533 </xs:sequence> 7534 </xs:complexType> 7535 </xs:element> 7536 </xs:sequence> 7537 </xs:complexType> 7538 </xs:element> 7539 <xs:element name="claims" minOccurs="0" maxOccurs="1"> 7540 <xs:annotation> 7541 <xs:documentation> 7542 The list of claims. 7543 </xs:documentation> 7544 </xs:annotation> 7545 <xs:complexType> 7546 <xs:sequence> 7547 <xs:element name="claim" minOccurs="0" maxOccurs="unbounded"> 7548 <xs:complexType> 7549 <xs:sequence> 7550 <xs:element name="target" type="bom:refLinkType" minOccurs="0" maxOccurs="1"> 7551 <xs:annotation> 7552 <xs:documentation> 7553 The `bom-ref` to a target representing a specific system, application, 7554 API, module, team, person, process, business unit, company, etc... 7555 that this claim is being applied to. 7556 </xs:documentation> 7557 </xs:annotation> 7558 </xs:element> 7559 <xs:element name="predicate" type="xs:string" minOccurs="0" maxOccurs="1"> 7560 <xs:annotation> 7561 <xs:documentation> 7562 The specific statement or assertion about the target. 7563 </xs:documentation> 7564 </xs:annotation> 7565 </xs:element> 7566 <xs:element name="mitigationStrategies" minOccurs="0" maxOccurs="1"> 7567 <xs:annotation> 7568 <xs:documentation> 7569 The list of `bom-ref` to the evidence provided describing the 7570 mitigation strategies. Each mitigation strategy should include an 7571 explanation of how any weaknesses in the evidence will be mitigated. 7572 </xs:documentation> 7573 </xs:annotation> 7574 <xs:complexType> 7575 <xs:sequence> 7576 <xs:element name="mitigationStrategy" type="bom:refLinkType" minOccurs="0" maxOccurs="unbounded"/> 7577 </xs:sequence> 7578 </xs:complexType> 7579 </xs:element> 7580 <xs:element name="reasoning" type="xs:string" minOccurs="0" maxOccurs="1"> 7581 <xs:annotation> 7582 <xs:documentation> 7583 The written explanation of why the evidence provided substantiates the claim. 7584 </xs:documentation> 7585 </xs:annotation> 7586 </xs:element> 7587 <xs:element name="evidence" type="bom:refLinkType" minOccurs="0" maxOccurs="unbounded"> 7588 <xs:annotation> 7589 <xs:documentation> 7590 The list of `bom-ref` to evidence that supports this claim. 7591 </xs:documentation> 7592 </xs:annotation> 7593 </xs:element> 7594 <xs:element name="counterEvidence" type="bom:refLinkType" minOccurs="0" maxOccurs="unbounded"> 7595 <xs:annotation> 7596 <xs:documentation> 7597 The list of `bom-ref` to counterEvidence that supports this claim. 7598 </xs:documentation> 7599 </xs:annotation> 7600 </xs:element> 7601 <xs:element name="externalReferences" type="bom:externalReferences" minOccurs="0" maxOccurs="1"> 7602 <xs:annotation> 7603 <xs:documentation>Provides the ability to document external references related to the claim the BOM describes.</xs:documentation> 7604 </xs:annotation> 7605 </xs:element> 7606 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 7607 <xs:annotation> 7608 <xs:documentation> 7609 Allows any undeclared elements as long as the elements are placed in a different namespace. 7610 </xs:documentation> 7611 </xs:annotation> 7612 </xs:any> 7613 </xs:sequence> 7614 <xs:attribute name="bom-ref" type="bom:refType"> 7615 <xs:annotation> 7616 <xs:documentation> 7617 An optional identifier which can be used to reference the object elsewhere 7618 in the BOM. Every bom-ref MUST be unique within the BOM. 7619 </xs:documentation> 7620 </xs:annotation> 7621 </xs:attribute> 7622 <xs:anyAttribute namespace="##other" processContents="lax"> 7623 <xs:annotation> 7624 <xs:documentation>User-defined attributes may be used on this element as long as they 7625 do not have the same name as an existing attribute used by the schema.</xs:documentation> 7626 </xs:annotation> 7627 </xs:anyAttribute> 7628 </xs:complexType> 7629 </xs:element> 7630 </xs:sequence> 7631 </xs:complexType> 7632 </xs:element> 7633 <xs:element name="evidence" minOccurs="0" maxOccurs="1"> 7634 <xs:annotation> 7635 <xs:documentation> 7636 The list of evidence 7637 </xs:documentation> 7638 </xs:annotation> 7639 <xs:complexType> 7640 <xs:sequence> 7641 <xs:element name="evidence" minOccurs="0" maxOccurs="unbounded"> 7642 <xs:annotation> 7643 <xs:documentation> 7644 The list of evidence 7645 </xs:documentation> 7646 </xs:annotation> 7647 <xs:complexType> 7648 <xs:sequence> 7649 <xs:element name="propertyName" type="xs:string" minOccurs="0" maxOccurs="1"> 7650 <xs:annotation> 7651 <xs:documentation> 7652 The reference to the property name as defined in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy/). 7653 </xs:documentation> 7654 </xs:annotation> 7655 </xs:element> 7656 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 7657 <xs:annotation> 7658 <xs:documentation> 7659 The written description of what this evidence is and how it was created. 7660 </xs:documentation> 7661 </xs:annotation> 7662 </xs:element> 7663 <xs:element name="data" minOccurs="0" maxOccurs="unbounded"> 7664 <xs:annotation> 7665 <xs:documentation> 7666 The output or analysis that supports claims. 7667 </xs:documentation> 7668 </xs:annotation> 7669 <xs:complexType> 7670 <xs:sequence> 7671 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 7672 <xs:annotation> 7673 <xs:documentation> 7674 The name of the data. 7675 </xs:documentation> 7676 </xs:annotation> 7677 </xs:element> 7678 <xs:element name="contents" minOccurs="0" maxOccurs="1"> 7679 <xs:annotation> 7680 <xs:documentation> 7681 The contents or references to the contents of the data being described. 7682 </xs:documentation> 7683 </xs:annotation> 7684 <xs:complexType> 7685 <xs:sequence> 7686 <xs:element name="attachment" type="bom:attachedTextType" minOccurs="0" maxOccurs="1"> 7687 <xs:annotation> 7688 <xs:documentation>An optional way to include textual or encoded data.</xs:documentation> 7689 </xs:annotation> 7690 </xs:element> 7691 <xs:element name="url" type="xs:anyURI" minOccurs="0" maxOccurs="1"> 7692 <xs:annotation> 7693 <xs:documentation>The URL to where the data can be retrieved.</xs:documentation> 7694 </xs:annotation> 7695 </xs:element> 7696 </xs:sequence> 7697 </xs:complexType> 7698 </xs:element> 7699 <xs:element name="classification" type="xs:string" minOccurs="0" maxOccurs="1"> 7700 <xs:annotation> 7701 <xs:documentation> 7702 Data classification tags data according to its type, sensitivity, and value if altered, stolen, or destroyed. 7703 </xs:documentation> 7704 </xs:annotation> 7705 </xs:element> 7706 <xs:element name="sensitiveData" minOccurs="0" maxOccurs="unbounded"> 7707 <xs:annotation> 7708 <xs:documentation> 7709 A description of any sensitive data. 7710 </xs:documentation> 7711 </xs:annotation> 7712 </xs:element> 7713 <xs:element name="governance" type="bom:dataGovernance" minOccurs="0" maxOccurs="1" /> 7714 </xs:sequence> 7715 </xs:complexType> 7716 </xs:element> 7717 <xs:element name="created" type="xs:dateTime" minOccurs="0"> 7718 <xs:annotation> 7719 <xs:documentation>The date and time (timestamp) when the evidence was created.</xs:documentation> 7720 </xs:annotation> 7721 </xs:element> 7722 <xs:element name="expires" type="xs:dateTime" minOccurs="0"> 7723 <xs:annotation> 7724 <xs:documentation>The optional date and time (timestamp) when the evidence is no longer valid.</xs:documentation> 7725 </xs:annotation> 7726 </xs:element> 7727 <xs:element name="author" type="bom:organizationalContact" minOccurs="0" maxOccurs="1"> 7728 <xs:annotation> 7729 <xs:documentation>The author of the evidence.</xs:documentation> 7730 </xs:annotation> 7731 </xs:element> 7732 <xs:element name="reviewer" type="bom:organizationalContact" minOccurs="0" maxOccurs="1"> 7733 <xs:annotation> 7734 <xs:documentation>The reviewer of the evidence.</xs:documentation> 7735 </xs:annotation> 7736 </xs:element> 7737 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 7738 <xs:annotation> 7739 <xs:documentation> 7740 Allows any undeclared elements as long as the elements are placed in a different namespace. 7741 </xs:documentation> 7742 </xs:annotation> 7743 </xs:any> 7744 </xs:sequence> 7745 <xs:attribute name="bom-ref" type="bom:refType"> 7746 <xs:annotation> 7747 <xs:documentation> 7748 An optional identifier which can be used to reference the object elsewhere 7749 in the BOM. Every bom-ref MUST be unique within the BOM. 7750 </xs:documentation> 7751 </xs:annotation> 7752 </xs:attribute> 7753 <xs:anyAttribute namespace="##other" processContents="lax"> 7754 <xs:annotation> 7755 <xs:documentation>User-defined attributes may be used on this element as long as they 7756 do not have the same name as an existing attribute used by the schema.</xs:documentation> 7757 </xs:annotation> 7758 </xs:anyAttribute> 7759 </xs:complexType> 7760 </xs:element> 7761 </xs:sequence> 7762 </xs:complexType> 7763 </xs:element> 7764 <xs:element name="targets" minOccurs="0" maxOccurs="1"> 7765 <xs:annotation> 7766 <xs:documentation> 7767 The list of targets which claims are made against. 7768 </xs:documentation> 7769 </xs:annotation> 7770 <xs:complexType> 7771 <xs:sequence> 7772 <xs:element name="organizations" minOccurs="0" maxOccurs="1"> 7773 <xs:annotation> 7774 <xs:documentation> 7775 The list of organizations which claims are made against. 7776 </xs:documentation> 7777 </xs:annotation> 7778 <xs:complexType> 7779 <xs:sequence> 7780 <xs:element name="organization" type="bom:organizationalEntity" minOccurs="0" maxOccurs="unbounded" /> 7781 </xs:sequence> 7782 </xs:complexType> 7783 </xs:element> 7784 <xs:element name="components" minOccurs="0" maxOccurs="1"> 7785 <xs:annotation> 7786 <xs:documentation> 7787 The list of components which claims are made against. 7788 </xs:documentation> 7789 </xs:annotation> 7790 <xs:complexType> 7791 <xs:sequence> 7792 <xs:element name="component" type="bom:component" minOccurs="0" maxOccurs="unbounded" /> 7793 </xs:sequence> 7794 </xs:complexType> 7795 </xs:element> 7796 <xs:element name="services" minOccurs="0" maxOccurs="1"> 7797 <xs:annotation> 7798 <xs:documentation> 7799 The list of services which claims are made against. 7800 </xs:documentation> 7801 </xs:annotation> 7802 <xs:complexType> 7803 <xs:sequence> 7804 <xs:element name="service" type="bom:service" minOccurs="0" maxOccurs="unbounded" /> 7805 </xs:sequence> 7806 </xs:complexType> 7807 </xs:element> 7808 </xs:sequence> 7809 </xs:complexType> 7810 </xs:element> 7811 <xs:element name="affirmation" minOccurs="0" maxOccurs="1"> 7812 <xs:complexType> 7813 <xs:sequence> 7814 <xs:element name="statement" type="xs:string" minOccurs="0" maxOccurs="1"> 7815 <xs:annotation> 7816 <xs:documentation> 7817 The brief statement affirmed by an individual regarding all declarations. 7818 This could be an affirmation of acceptance by a third-party auditor or receiving 7819 individual of a file. For example: "I certify, to the best of my knowledge, that all information is correct." 7820 </xs:documentation> 7821 </xs:annotation> 7822 </xs:element> 7823 <xs:element name="signatories" minOccurs="0" maxOccurs="1"> 7824 <xs:annotation> 7825 <xs:documentation> 7826 The list of signatories authorized on behalf of an organization to assert validity of this document. 7827 </xs:documentation> 7828 </xs:annotation> 7829 <xs:complexType> 7830 <xs:sequence> 7831 <xs:element name="signatory" minOccurs="0" maxOccurs="unbounded"> 7832 <xs:complexType> 7833 <xs:sequence> 7834 <xs:element name="name" type="xs:string" minOccurs="0" maxOccurs="1"> 7835 <xs:annotation> 7836 <xs:documentation> 7837 The signatory's name. 7838 </xs:documentation> 7839 </xs:annotation> 7840 </xs:element> 7841 <xs:element name="role" type="xs:string" minOccurs="0" maxOccurs="1"> 7842 <xs:annotation> 7843 <xs:documentation> 7844 The signatory's role within an organization. 7845 </xs:documentation> 7846 </xs:annotation> 7847 </xs:element> 7848 <xs:element name="organization" type="bom:organizationalEntity" minOccurs="0" maxOccurs="1"> 7849 <xs:annotation> 7850 <xs:documentation> 7851 The signatory's organization. 7852 </xs:documentation> 7853 </xs:annotation> 7854 </xs:element> 7855 <xs:element name="externalReference" type="bom:externalReference" minOccurs="0" maxOccurs="1"> 7856 <xs:annotation> 7857 <xs:documentation> 7858 An External reference provide a way to document systems, sites, and information that may be relevant, but are not included with the BOM. They may also establish specific relationships within or external to the BOM. 7859 </xs:documentation> 7860 </xs:annotation> 7861 </xs:element> 7862 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 7863 <xs:annotation> 7864 <xs:documentation> 7865 Allows any undeclared elements as long as the elements are placed in a different namespace. 7866 </xs:documentation> 7867 </xs:annotation> 7868 </xs:any> 7869 </xs:sequence> 7870 </xs:complexType> 7871 </xs:element> 7872 </xs:sequence> 7873 </xs:complexType> 7874 </xs:element> 7875 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 7876 <xs:annotation> 7877 <xs:documentation> 7878 Allows any undeclared elements as long as the elements are placed in a different namespace. 7879 </xs:documentation> 7880 </xs:annotation> 7881 </xs:any> 7882 </xs:sequence> 7883 </xs:complexType> 7884 </xs:element> 7885 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 7886 <xs:annotation> 7887 <xs:documentation> 7888 Allows any undeclared elements as long as the elements are placed in a different namespace. 7889 </xs:documentation> 7890 </xs:annotation> 7891 </xs:any> 7892 </xs:sequence> 7893 </xs:complexType> 7894 7895 <xs:complexType name="definitionsType"> 7896 <xs:annotation> 7897 <xs:documentation> 7898 A collection of reusable objects that are defined and may be used elsewhere in the BOM. 7899 </xs:documentation> 7900 </xs:annotation> 7901 <xs:sequence> 7902 <xs:element name="standards" type="bom:standardsType" minOccurs="0" maxOccurs="1"/> 7903 </xs:sequence> 7904 </xs:complexType> 7905 7906 <xs:complexType name="standardsType"> 7907 <xs:annotation> 7908 <xs:documentation> 7909 The list of standards which may consist of regulations, industry or organizational-specific standards, maturity models, best practices, or any other requirements which can be evaluated against or attested to. 7910 </xs:documentation> 7911 </xs:annotation> 7912 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 7913 <xs:element name="standard" type="bom:standard"/> 7914 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 7915 <xs:annotation> 7916 <xs:documentation> 7917 Allows any undeclared elements as long as the elements are placed in a different namespace. 7918 </xs:documentation> 7919 </xs:annotation> 7920 </xs:any> 7921 </xs:sequence> 7922 <xs:anyAttribute namespace="##any" processContents="lax"> 7923 <xs:annotation> 7924 <xs:documentation>User-defined attributes may be used on this element as long as they 7925 do not have the same name as an existing attribute used by the schema.</xs:documentation> 7926 </xs:annotation> 7927 </xs:anyAttribute> 7928 </xs:complexType> 7929 7930 <xs:complexType name="standard"> 7931 <xs:annotation> 7932 <xs:documentation> 7933 A standard may consist of regulations, industry or organizational-specific standards, maturity models, best practices, or any other requirements which can be evaluated against or attested to. 7934 </xs:documentation> 7935 </xs:annotation> 7936 <xs:sequence> 7937 <xs:element name="name" type="xs:string"> 7938 <xs:annotation> 7939 <xs:documentation> 7940 The name of the standard. This will often be a shortened, single name of the standard. 7941 </xs:documentation> 7942 </xs:annotation> 7943 </xs:element> 7944 <xs:element name="version" type="xs:string"> 7945 <xs:annotation> 7946 <xs:documentation> 7947 The version of the standard. 7948 </xs:documentation> 7949 </xs:annotation> 7950 </xs:element> 7951 <xs:element name="description" type="xs:string"> 7952 <xs:annotation> 7953 <xs:documentation> 7954 The description of the standard. 7955 </xs:documentation> 7956 </xs:annotation> 7957 </xs:element> 7958 <xs:element name="owner" type="xs:string"> 7959 <xs:annotation> 7960 <xs:documentation> 7961 The owner of the standard, often the entity responsible for its release. 7962 </xs:documentation> 7963 </xs:annotation> 7964 </xs:element> 7965 <xs:element name="requirements" minOccurs="0" maxOccurs="1"> 7966 <xs:annotation> 7967 <xs:documentation> 7968 The list of requirements comprising the standard. 7969 </xs:documentation> 7970 </xs:annotation> 7971 <xs:complexType> 7972 <xs:sequence> 7973 <xs:element name="requirement" minOccurs="0" maxOccurs="unbounded"> 7974 <xs:complexType> 7975 <xs:sequence> 7976 <xs:element name="identifier" type="xs:string" minOccurs="0" maxOccurs="1"> 7977 <xs:annotation> 7978 <xs:documentation> 7979 The unique identifier used in the standard to identify a specific requirement. This should match what is in the standard and should not be the requirements bom-ref. 7980 </xs:documentation> 7981 </xs:annotation> 7982 </xs:element> 7983 <xs:element name="title" type="xs:string" minOccurs="0" maxOccurs="1"> 7984 <xs:annotation> 7985 <xs:documentation> 7986 The title of the requirement. 7987 </xs:documentation> 7988 </xs:annotation> 7989 </xs:element> 7990 <xs:element name="text" type="xs:string" minOccurs="0" maxOccurs="1"> 7991 <xs:annotation> 7992 <xs:documentation> 7993 The textual content of the requirement. 7994 </xs:documentation> 7995 </xs:annotation> 7996 </xs:element> 7997 <xs:element name="descriptions" minOccurs="0" maxOccurs="1"> 7998 <xs:annotation> 7999 <xs:documentation> 8000 The supplemental text that provides additional guidance or context to the requirement, but is not directly part of the requirement. 8001 </xs:documentation> 8002 </xs:annotation> 8003 <xs:complexType> 8004 <xs:sequence> 8005 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"/> 8006 </xs:sequence> 8007 </xs:complexType> 8008 </xs:element> 8009 <xs:element name="openCre" minOccurs="0" maxOccurs="unbounded"> 8010 <xs:annotation> 8011 <xs:documentation> 8012 The Common Requirements Enumeration (CRE) identifier(s). CRE is a structured and standardized framework for uniting security standards and guidelines. CRE links each section of a resource to a shared topic identifier (a Common Requirement). Through this shared topic link, all resources map to each other. Use of CRE promotes clear and unambiguous communication among stakeholders. 8013 </xs:documentation> 8014 </xs:annotation> 8015 <xs:simpleType> 8016 <xs:restriction base="xs:string"> 8017 <xs:pattern value="CRE:[0-9]+-[0-9]+"/> 8018 </xs:restriction> 8019 </xs:simpleType> 8020 </xs:element> 8021 <xs:element name="parent" type="bom:refLinkType" minOccurs="0" maxOccurs="1"> 8022 <xs:annotation> 8023 <xs:documentation> 8024 The optional `bom-ref` to a parent requirement. This establishes a hierarchy of requirements. Top-level requirements must not define a parent. Only child requirements should define parents. 8025 </xs:documentation> 8026 </xs:annotation> 8027 </xs:element> 8028 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 8029 <xs:annotation> 8030 <xs:documentation>Provides the ability to document properties in a name/value store. 8031 This provides flexibility to include data not officially supported in the standard 8032 without having to use additional namespaces or create extensions. Property names 8033 of interest to the general public are encouraged to be registered in the 8034 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 8035 Formal registration is OPTIONAL.</xs:documentation> 8036 </xs:annotation> 8037 </xs:element> 8038 <xs:element name="externalReferences" type="bom:externalReferences" minOccurs="0" maxOccurs="1"> 8039 <xs:annotation> 8040 <xs:documentation>Provides the ability to document external references related to the BOM or 8041 to the project the BOM describes.</xs:documentation> 8042 </xs:annotation> 8043 </xs:element> 8044 </xs:sequence> 8045 <xs:attribute name="bom-ref" type="bom:refType"> 8046 <xs:annotation> 8047 <xs:documentation> 8048 An optional identifier which can be used to reference the object elsewhere 8049 in the BOM. Every bom-ref MUST be unique within the BOM. 8050 </xs:documentation> 8051 </xs:annotation> 8052 </xs:attribute> 8053 <xs:anyAttribute namespace="##other" processContents="lax"> 8054 <xs:annotation> 8055 <xs:documentation>User-defined attributes may be used on this element as long as they 8056 do not have the same name as an existing attribute used by the schema.</xs:documentation> 8057 </xs:annotation> 8058 </xs:anyAttribute> 8059 </xs:complexType> 8060 </xs:element> 8061 </xs:sequence> 8062 </xs:complexType> 8063 </xs:element> 8064 <xs:element name="levels" minOccurs="0" maxOccurs="1"> 8065 <xs:annotation> 8066 <xs:documentation> 8067 The list of levels associated with the standard. Some standards have different levels of compliance. 8068 </xs:documentation> 8069 </xs:annotation> 8070 <xs:complexType> 8071 <xs:sequence> 8072 <xs:element name="level" minOccurs="0" maxOccurs="unbounded"> 8073 <xs:complexType> 8074 <xs:sequence> 8075 <xs:element name="identifier" type="xs:string" minOccurs="0" maxOccurs="1"> 8076 <xs:annotation> 8077 <xs:documentation> 8078 The identifier used in the standard to identify a specific level. 8079 </xs:documentation> 8080 </xs:annotation> 8081 </xs:element> 8082 <xs:element name="title" type="xs:string" minOccurs="0" maxOccurs="1"> 8083 <xs:annotation> 8084 <xs:documentation> 8085 The title of the level. 8086 </xs:documentation> 8087 </xs:annotation> 8088 </xs:element> 8089 <xs:element name="description" type="xs:string" minOccurs="0" maxOccurs="1"> 8090 <xs:annotation> 8091 <xs:documentation> 8092 The description of the level. 8093 </xs:documentation> 8094 </xs:annotation> 8095 </xs:element> 8096 <xs:element name="requirements" minOccurs="0" maxOccurs="1"> 8097 <xs:annotation> 8098 <xs:documentation> 8099 The list of requirement `bom-ref`s that comprise the level. 8100 </xs:documentation> 8101 </xs:annotation> 8102 <xs:complexType> 8103 <xs:sequence> 8104 <xs:element name="requirement" type="bom:refLinkType" minOccurs="0" maxOccurs="unbounded"/> 8105 </xs:sequence> 8106 </xs:complexType> 8107 </xs:element> 8108 </xs:sequence> 8109 <xs:attribute name="bom-ref" type="bom:refType"> 8110 <xs:annotation> 8111 <xs:documentation> 8112 An optional identifier which can be used to reference the object elsewhere 8113 in the BOM. Every bom-ref MUST be unique within the BOM. 8114 </xs:documentation> 8115 </xs:annotation> 8116 </xs:attribute> 8117 <xs:anyAttribute namespace="##other" processContents="lax"> 8118 <xs:annotation> 8119 <xs:documentation>User-defined attributes may be used on this element as long as they 8120 do not have the same name as an existing attribute used by the schema.</xs:documentation> 8121 </xs:annotation> 8122 </xs:anyAttribute> 8123 </xs:complexType> 8124 </xs:element> 8125 </xs:sequence> 8126 </xs:complexType> 8127 </xs:element> 8128 <xs:element name="externalReferences" type="bom:externalReferences" minOccurs="0" maxOccurs="1"> 8129 <xs:annotation> 8130 <xs:documentation>Provides the ability to document external references related to the BOM or 8131 to the project the BOM describes.</xs:documentation> 8132 </xs:annotation> 8133 </xs:element> 8134 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 8135 <xs:annotation> 8136 <xs:documentation> 8137 Allows any undeclared elements as long as the elements are placed in a different namespace. 8138 </xs:documentation> 8139 </xs:annotation> 8140 </xs:any> 8141 </xs:sequence> 8142 <xs:attribute name="bom-ref" type="bom:refType"> 8143 <xs:annotation> 8144 <xs:documentation> 8145 An optional identifier which can be used to reference the object elsewhere 8146 in the BOM. Every bom-ref MUST be unique within the BOM. 8147 </xs:documentation> 8148 </xs:annotation> 8149 </xs:attribute> 8150 <xs:anyAttribute namespace="##other" processContents="lax"> 8151 <xs:annotation> 8152 <xs:documentation>User-defined attributes may be used on this element as long as they 8153 do not have the same name as an existing attribute used by the schema.</xs:documentation> 8154 </xs:annotation> 8155 </xs:anyAttribute> 8156 </xs:complexType> 8157 8158 <xs:complexType name="tagsType"> 8159 <xs:sequence minOccurs="0" maxOccurs="unbounded"> 8160 <xs:element name="tag" type="xs:normalizedString"> 8161 <xs:annotation> 8162 <xs:documentation>Textual strings that aid in discovery, search, and retrieval of the associated 8163 object. Tags often serve as a way to group or categorize similar or related objects by various 8164 attributes. 8165 8166 Examples include: 8167 "json-parser", "object-persistence", "text-to-image", "translation", and "object-detection" 8168 </xs:documentation> 8169 </xs:annotation> 8170 </xs:element> 8171 </xs:sequence> 8172 </xs:complexType> 8173 8174 <xs:element name="bom"> 8175 <xs:complexType> 8176 <xs:sequence> 8177 <xs:element name="metadata" type="bom:metadata" minOccurs="0" maxOccurs="1"> 8178 <xs:annotation> 8179 <xs:documentation>Provides additional information about a BOM.</xs:documentation> 8180 </xs:annotation> 8181 </xs:element> 8182 <xs:element name="components" type="bom:componentsType" minOccurs="0" maxOccurs="1"> 8183 <xs:annotation> 8184 <xs:documentation>A list of software and hardware components.</xs:documentation> 8185 </xs:annotation> 8186 </xs:element> 8187 <xs:element name="services" type="bom:servicesType" minOccurs="0" maxOccurs="1"> 8188 <xs:annotation> 8189 <xs:documentation>A list of services. This may include microservices, function-as-a-service, and other types of network or intra-process services.</xs:documentation> 8190 </xs:annotation> 8191 </xs:element> 8192 <xs:element name="externalReferences" type="bom:externalReferences" minOccurs="0" maxOccurs="1"> 8193 <xs:annotation> 8194 <xs:documentation>Provides the ability to document external references related to the BOM or 8195 to the project the BOM describes.</xs:documentation> 8196 </xs:annotation> 8197 </xs:element> 8198 <xs:element name="dependencies" type="bom:dependenciesType" minOccurs="0" maxOccurs="1"> 8199 <xs:annotation> 8200 <xs:documentation>Provides the ability to document dependency relationships.</xs:documentation> 8201 </xs:annotation> 8202 </xs:element> 8203 <xs:element name="compositions" type="bom:compositionsType" minOccurs="0" maxOccurs="1"> 8204 <xs:annotation> 8205 <xs:documentation>Compositions describe constituent parts (including components, services, and dependency relationships) and their completeness. The completeness of vulnerabilities expressed in a BOM may also be described.</xs:documentation> 8206 </xs:annotation> 8207 </xs:element> 8208 <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1"> 8209 <xs:annotation> 8210 <xs:documentation>Provides the ability to document properties in a name/value store. 8211 This provides flexibility to include data not officially supported in the standard 8212 without having to use additional namespaces or create extensions. Property names 8213 of interest to the general public are encouraged to be registered in the 8214 CycloneDX Property Taxonomy - https://github.com/CycloneDX/cyclonedx-property-taxonomy. 8215 Formal registration is OPTIONAL.</xs:documentation> 8216 </xs:annotation> 8217 </xs:element> 8218 <xs:element name="vulnerabilities" type="bom:vulnerabilitiesType" minOccurs="0" maxOccurs="1"> 8219 <xs:annotation> 8220 <xs:documentation>Vulnerabilities identified in components or services.</xs:documentation> 8221 </xs:annotation> 8222 </xs:element> 8223 <xs:element name="annotations" type="bom:annotationsType" minOccurs="0" maxOccurs="1"> 8224 <xs:annotation> 8225 <xs:documentation>Comments made by people, organizations, or tools about any object with 8226 a bom-ref, such as components, services, vulnerabilities, or the BOM itself. Unlike 8227 inventory information, annotations may contain opinion or commentary from various 8228 stakeholders. Annotations may be inline (with inventory) or externalized via BOM-Link, 8229 and may optionally be signed.</xs:documentation> 8230 </xs:annotation> 8231 </xs:element> 8232 <xs:element name="formulation" type="bom:formulationType" minOccurs="0" maxOccurs="1"> 8233 <xs:annotation> 8234 <xs:documentation>Describes how a component or service was manufactured or deployed. This is 8235 achieved through the use of formulas, workflows, tasks, and steps, which declare the precise 8236 steps to reproduce along with the observed formulas describing the steps which transpired 8237 in the manufacturing process.</xs:documentation> 8238 </xs:annotation> 8239 </xs:element> 8240 <xs:element name="declarations" type="bom:declarationsType" minOccurs="0" maxOccurs="1"> 8241 <xs:annotation> 8242 <xs:documentation> 8243 The list of declarations which describe the conformance to standards. Each declaration may 8244 include attestations, claims, and evidence. 8245 </xs:documentation> 8246 </xs:annotation> 8247 </xs:element> 8248 <xs:element name="definitions" type="bom:definitionsType" minOccurs="0" maxOccurs="1"> 8249 <xs:annotation> 8250 <xs:documentation> 8251 A collection of reusable objects that are defined and may be used elsewhere in the BOM. 8252 </xs:documentation> 8253 </xs:annotation> 8254 </xs:element> 8255 <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"> 8256 <xs:annotation> 8257 <xs:documentation> 8258 Allows any undeclared elements as long as the elements are placed in a different namespace. 8259 </xs:documentation> 8260 </xs:annotation> 8261 </xs:any> 8262 </xs:sequence> 8263 <xs:attribute name="version" type="xs:positiveInteger" default="1"> 8264 <xs:annotation> 8265 <xs:documentation>Whenever an existing BOM is modified, either manually or through automated 8266 processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with 8267 multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM. 8268 The default version is '1'.</xs:documentation> 8269 </xs:annotation> 8270 </xs:attribute> 8271 <xs:attribute name="serialNumber" type="bom:urnUuid"> 8272 <xs:annotation> 8273 <xs:documentation>Every BOM generated SHOULD have a unique serial number, even if the contents of 8274 the BOM have not changed over time. If specified, the serial number MUST conform to RFC-4122. 8275 Use of serial numbers are RECOMMENDED.</xs:documentation> 8276 </xs:annotation> 8277 </xs:attribute> 8278 <xs:anyAttribute namespace="##any" processContents="lax"> 8279 <xs:annotation> 8280 <xs:documentation>User-defined attributes may be used on this element as long as they 8281 do not have the same name as an existing attribute used by the schema.</xs:documentation> 8282 </xs:annotation> 8283 </xs:anyAttribute> 8284 </xs:complexType> 8285 <xs:unique name="bom-ref"> 8286 <xs:selector xpath=".//*"/> 8287 <xs:field xpath="@bom-ref"/> 8288 </xs:unique> 8289 </xs:element> 8290 </xs:schema>