Skip to content

[pull] master from CycloneDX:master #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pull merged 2 commits into from
Sep 16, 2026
Merged

[pull] master from CycloneDX:master #59

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
968b901
chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#1103)
dependabot[bot] Sep 16, 2026
2872084
fix(xml): allow protocol cryptographic relationships (#1019)
qkaiser Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/zizmor.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
persist-credentials: false
- name: Run zizmor 🌈
# see https://github.com/zizmorcore/zizmor-action
uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
with:
# advanced-security: false => emit findings as workflow-command annotations (::error file=…) rather than
# uploading a SARIF report to GitHub's Security tab.
Expand Down
42 changes: 41 additions & 1 deletion schema/bom-1.7.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8295,8 +8295,48 @@ limitations under the License.
</xs:element>
<xs:element name="cryptoRef" type="bom:refType" minOccurs="0" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation>A protocol-related cryptographic assets</xs:documentation>
<xs:documentation>
DEPRECATED - DO NOT USE. This will be removed in a future version. Use `./relatedCryptographicAssets` instead.
A protocol-related cryptographic asset.
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="relatedCryptographicAssets" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation>
A list of cryptographic assets related to this component.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="relatedCryptographicAsset" minOccurs="0" maxOccurs="unbounded">
<xs:annotation>
<xs:documentation>
A cryptographic asset related to this component.
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:sequence>
<xs:element name="type" type="xs:string" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation>
Specifies the mechanism by which the cryptographic asset is secured by.
Examples: "publicKey", "privateKey", "algorithm"
</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element name="ref" type="bom:refType" minOccurs="0" maxOccurs="1">
<xs:annotation>
<xs:documentation>
The bom-ref to cryptographic asset.
</xs:documentation>
</xs:annotation>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:sequence>
</xs:complexType>
Expand Down
8 changes: 7 additions & 1 deletion tools/src/test/resources/1.7/valid-cryptography-full-1.7.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,7 +239,13 @@
"algorithm": "ecdsa_secp256r1_sha256"
}
]
}
},
"relatedCryptographicAssets": [
{
"type": "publicKey",
"ref": "asset-4"
}
]
},
"oid": "oid:1.3.6.1.5.5.7.3.1"
}
Expand Down
6 changes: 6 additions & 0 deletions tools/src/test/resources/1.7/valid-cryptography-full-1.7.textproto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,12 @@ components: {
algorithm: "ecdsa_secp256r1_sha256"
}
}
relatedCryptographicAssets: {
assets: {
type: "publicKey"
ref: "asset-4"
}
}
}
oid: "oid:1.3.6.1.5.5.7.3.1"
}
Expand Down
6 changes: 6 additions & 0 deletions tools/src/test/resources/1.7/valid-cryptography-full-1.7.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,12 @@
<algorithm>ecdsa_secp256r1_sha256</algorithm>
</auth>
</ikev2TransformTypes>
<relatedCryptographicAssets>
<relatedCryptographicAsset>
<type>publicKey</type>
<ref>asset-4</ref>
</relatedCryptographicAsset>
</relatedCryptographicAssets>
</protocolProperties>
<oid>oid:1.3.6.1.5.5.7.3.1</oid>
</cryptoProperties>
Expand Down