Skip to content

WIP: Develop 2.0 schema for AI/ML BOM#948

Draft
mrutkows wants to merge 167 commits into
CycloneDX:masterfrom
mrutkows:2.0-dev-ai-ml
Draft

WIP: Develop 2.0 schema for AI/ML BOM#948
mrutkows wants to merge 167 commits into
CycloneDX:masterfrom
mrutkows:2.0-dev-ai-ml

Conversation

@mrutkows

@mrutkows mrutkows commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

No description provided.

stevespringett and others added 30 commits June 14, 2025 20:17
Signed-off-by: Steve Springett <steve@springett.us>
Syncing with master to incoporate v1.7 spec
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
…ment patterns.

Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Steve Springett <steve@springett.us>
Mehrn0ush and others added 28 commits June 22, 2026 14:31
Fixes CycloneDX#884

Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
Fixes CycloneDX#856

Signed-off-by: Joachim Vandersmissen <git@jvdsn.com>
Fixes CycloneDX#878

Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
The official name of the hash algorithms does not contain the dash.

Signed-off-by: Joachim Vandersmissen <git@jvdsn.com>
According to RFC8032, the names are Ed25519ph, Ed25519ctx, and Ed448ph. There is no dash.

Signed-off-by: Joachim Vandersmissen <git@jvdsn.com>
fixes CycloneDX#872 

Also changes primitive to "kdf" since this is a KDF, not a key agreement function.

Signed-off-by: Joachim Vandersmissen <git@jvdsn.com>
Signed-off-by: Steve Springett <steve@springett.us>
Signed-off-by: Joachim Vandersmissen <git@jvdsn.com>
…ial handling (CycloneDX#925)

This PR adds a [zizmor](https://github.com/woodruffw/zizmor)
security-scanning workflow and hardens the existing GitHub Actions
workflows against credential-leakage risks.

Changes include:
- New `.github/workflows/zizmor.yml` that runs the zizmor
static-analysis tool on every push and pull-request, and on
`dependabot.yml` changes.
- All `actions/checkout` steps now use `persist-credentials: false` to
avoid leaving GitHub tokens in the workspace.
- All third-party Actions are pinned to their full commit SHA (with a
human-readable version comment) so supply-chain substitutions are
detectable.
- A cooldown configuration block added to `dependabot.yml` to reduce
noise from automated updates.

fixes CycloneDX#924

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: jkowalleck <2765863+jkowalleck@users.noreply.github.com>
Co-authored-by: Jan Kowalleck <jan.kowalleck@owasp.org>
Co-authored-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
… (so it matches the json spec)

Signed-off-by: wievdndr <wiebe.vandendriessche@ugent.be>
performanceTradeoffs in valid-machine-learning-*.xml test files to
verify the schema correctly validates multiple entries for these fields.

Signed-off-by: wievdndr <wiebe.vandendriessche@ugent.be>
Signed-off-by: wievdndr <wiebe.vandendriessche@ugent.be>
Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.37.0 to 2.37.1.
- [Release notes](https://github.com/shivammathur/setup-php/releases)
- [Commits](shivammathur/setup-php@accd612...7c071df)

---
updated-dependencies:
- dependency-name: shivammathur/setup-php
  dependency-version: 2.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.5.3 to 0.5.6.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@b1d7e1f...5f14fd0)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>
Signed-off-by: Matt Rutkowski <mrutkows@us.ibm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cap: ai/ml Capability: AI/ML CDX 2.0 related to release v2.0 draft format: JSON

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants