Repository navigation
CycloneDX 2.0 #631
Description
CycloneDX 2.0 is a major version in active development, focused on cleaning up legacy constructs, enforcing semantic correctness, and enabling modern schema reuse and API integration. This issue tracks the scope, rationale, and technical direction of the 2.0 release.
Goals
- Modularize the specification into multiple schemas (e.g. bom, component, metadata, common, etc)
- Remove deprecated fields and legacy aliases
- Constrain properties to their correct types (e.g. cryptoProperties only on cryptographic assets)
- JSON-first focus supporting JSON Schema Draft 2020-12; potentially remove XML support
- Make the schema directly usable as a canonical model for the Ecma Transparency Exchange API
- Normalize naming and structural inconsistencies
- see milestone: https://github.com/CycloneDX/specification/milestone/2
- see release PR: [WIP] CycloneDX v2.0 Specification #652
Activity
jkowalleck commentedon May 5, 2025
same for protobuf support?
stevespringett commentedon May 6, 2025
There are so many systems that use protobuf for machine-to-machine communication, that I'd like to offer official support for it, but do so in a way where we can generate the .proto from the JSON Schema at release time. I already have a partially working Python script that does this and keeps track of enum order so that we can preserve enum ordering from release to release.
jkowalleck commentedon May 6, 2025
this is confusing to me.
the ticket says it will drop support for anything that is not JSON, esecially XML.
but then it says it will also provide an (autogenerated) XML schema.
and it does not say anything about ProtoBuf.
please improve the ticket, and make clear what is to be expected.
will there be any XSD? will there be any ProtoBuf Schema?
stevespringett commentedon May 6, 2025
This ticket is essentially the "epic". Details will be provided in individual subtickets (the stories). There is too much detail to put into one ticket.
.protoSchema from JSON Schema in 2.0 #640stevespringett commentedon Dec 4, 2025
For those following this ticket, here's an update: