Skip to content

feat: Add OWASP Threat Model Library parity - #1034

Merged
stevespringett merged 8 commits into
CycloneDX:2.0-devfrom
P3tra-WP:2.0-dev-threatmodeling-library-parity
Oct 15, 2026
Merged

feat: Add OWASP Threat Model Library parity#1034
stevespringett merged 8 commits into
CycloneDX:2.0-devfrom
P3tra-WP:2.0-dev-threatmodeling-library-parity

Conversation

@P3tra-WP

@P3tra-WP P3tra-WP commented Aug 21, 2026

Copy link
Copy Markdown

Summary

  • add document scope and threat-model lifecycle metadata
  • add threat events, persona context, and reusable qualitative risk matrices
  • document OWASP Threat Model Library control-status conversion and add fixtures
  • leave generated bundled schemas unchanged

Validation

  • direct Ajv validation of the updated 2.0 fixtures
  • git diff --check
  • schema-v2 2.0 validation suite is currently blocked by an upstream strict-mode error in cyclonedx-common-2.0.schema.json preDefinedLifecyclePhase

@P3tra-WP
P3tra-WP requested a review from a team as a code owner August 21, 2026 10:34
jkowalleck
jkowalleck reviewed Aug 21, 2026
View reviewed changes
Comment thread schema/2.0/model/cyclonedx-common-2.0.schema.json Outdated
@jkowalleck jkowalleck added this to the 2.0 milestone Aug 21, 2026
@jkowalleck jkowalleck added the CDX 2.0 related to release v2.0 label Aug 21, 2026
jkowalleck
jkowalleck reviewed Aug 24, 2026
View reviewed changes
Comment thread schema/2.0/model/cyclonedx-metadata-2.0.schema.json Outdated
Comment thread schema/2.0/model/cyclonedx-metadata-2.0.schema.json Outdated
Comment thread schema/2.0/model/cyclonedx-metadata-2.0.schema.json Outdated
@jkowalleck

jkowalleck commented Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

re: #1034 (comment)

the scope of this PR seams off - at least to me.

this adds features all over the place, without considering the CycloneDX 2.0 philosophy or architecture.

Lets take this PR as a basis for further discussions.
Marking as "draft" for this reason.

@jkowalleck
jkowalleck marked this pull request as draft August 24, 2026 12:57
@jkowalleck

jkowalleck commented Aug 24, 2026

Copy link
Copy Markdown
Member

I'd recommend opening a new discussion, if you want to get community feedback on your general ideas.

discussing the exact proposed implementation may happen in this PR< still.

@jkowalleck jkowalleck changed the title Add OWASP Threat Model Library parity [IDEA] Add OWASP Threat Model Library parity Aug 24, 2026
jkowalleck
jkowalleck reviewed Aug 24, 2026
View reviewed changes
Comment thread schema/2.0/THREAT-MODEL-MAPPING.md Outdated
@P3tra-WP

P3tra-WP commented Aug 24, 2026

Copy link
Copy Markdown
Author

I opened a Discussion to gather architectural feedback before continuing implementation: #1039

stevespringett
stevespringett requested changes Sep 3, 2026
View reviewed changes
Comment thread schema/2.0/model/cyclonedx-blueprint-2.0.schema.json Outdated
Comment thread schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
Comment thread schema/2.0/model/cyclonedx-common-2.0.schema.json Outdated
Comment thread schema/2.0/model/cyclonedx-metadata-2.0.schema.json Outdated
Comment thread schema/2.0/model/cyclonedx-metadata-2.0.schema.json Outdated
Comment thread schema/2.0/model/cyclonedx-metadata-2.0.schema.json Outdated
Comment thread schema/2.0/model/cyclonedx-metadata-2.0.schema.json Outdated
Comment thread schema/2.0/model/cyclonedx-metadata-2.0.schema.json Outdated
Comment thread schema/2.0/model/cyclonedx-risk-2.0.schema.json Outdated
@vikram-s-narayan vikram-s-narayan mentioned this pull request Sep 8, 2026
Open
@stevespringett stevespringett self-assigned this Sep 11, 2026
@stevespringett
Added inScope to dataset, zone, and boundary objects, as per today's …
7973584 
…working group call. The default is already true. No changes required for default.

Signed-off-by: Steve Springett <steve@springett.us>
@stevespringett
stevespringett marked this pull request as ready for review September 16, 2026 17:40
@stevespringett stevespringett added request for comment RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration labels Sep 16, 2026
@stevespringett
stevespringett self-requested a review September 16, 2026 18:07
stevespringett
stevespringett approved these changes Sep 16, 2026
View reviewed changes

@stevespringett stevespringett left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@P3tra-WP Thanks for taking all the feedback. This PR looks good to me.

@jkowalleck jkowalleck changed the title [IDEA] Add OWASP Threat Model Library parity feat: Add OWASP Threat Model Library parity Sep 16, 2026
@jkowalleck
jkowalleck self-requested a review September 16, 2026 19:26
@jkowalleck

jkowalleck commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

could you rebase onto 2.0-devbranch? you will find theschema/2.0/modelfolder renamed tomodules.`

@stevespringett stevespringett added RFC vote accepted promote to tc54 Promote to Ecma Technical Committee 54 labels Oct 14, 2026
@jkowalleck

jkowalleck commented Oct 15, 2026

Copy link
Copy Markdown
Member

TIL: frozen means - dont change this thing, even if you increase the CycloneDX document's version and issue a new one.

@stevespringett stevespringett added tc54 reviewed Ecma TC54 has reviewed the feature candidate tc54 accepted Ecma TC54 has accepted the feature candidate labels Oct 15, 2026
@stevespringett
stevespringett merged commit d3a045d into CycloneDX:2.0-dev Oct 15, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jkowalleck jkowalleck jkowalleck approved these changes
@stevespringett stevespringett stevespringett approved these changes
@mrutkows mrutkows Awaiting requested review from mrutkows

Assignees

@stevespringett stevespringett

Labels

CDX 2.0 related to release v2.0 promote to tc54 Promote to Ecma Technical Committee 54 request for comment RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration RFC vote accepted tc54 accepted Ecma TC54 has accepted the feature candidate tc54 reviewed Ecma TC54 has reviewed the feature candidate

Projects

None yet

Milestone

2.0

Development

Successfully merging this pull request may close these issues.

4 participants

@P3tra-WP @jkowalleck @stevespringett @petra-dv