cdx-proto
    Preparing search index...

    Type Alias Bom

    Bom: Message<"cyclonedx.v1_7.Bom"> & {
        annotations: Annotation[];
        citations: Citation[];
        components: Component[];
        compositions: Composition[];
        declarations: Declarations[];
        definitions: Definition[];
        dependencies: Dependency[];
        externalReferences: ExternalReference[];
        formulation: Formula[];
        metadata?: Metadata;
        properties: Property[];
        serialNumber?: string;
        services: Service[];
        specVersion: string;
        version?: number;
        vulnerabilities: Vulnerability[];
    }

    Type Declaration

    • annotations: Annotation[]

      Comments made by people, organizations, or tools about any object with a bom_ref, such as components, services, vulnerabilities, or the BOM itself. Unlike inventory information, annotations may contain opinion or commentary from various stakeholders.

      from field: repeated cyclonedx.v1_7.Annotation annotations = 11;

    • citations: Citation[]

      A collection of attributions indicating which entity supplied information for specific fields within the BOM.

      from field: repeated cyclonedx.v1_7.Citation citations = 16;

    • components: Component[]

      Provides the ability to document a list of components.

      from field: repeated cyclonedx.v1_7.Component components = 5;

    • compositions: Composition[]

      Compositions describe constituent parts (including components, services, and dependency relationships) and their completeness. The completeness of vulnerabilities expressed in a BOM may also be described.

      from field: repeated cyclonedx.v1_7.Composition compositions = 9;

    • declarations: Declarations[]

      The list of declarations which describe the conformance to standards. Each declaration may include attestations, claims, and evidence.

      from field: repeated cyclonedx.v1_7.Declarations declarations = 14;

    • definitions: Definition[]

      A collection of reusable objects that are defined and may be used elsewhere in the BOM.

      from field: repeated cyclonedx.v1_7.Definition definitions = 15;

    • dependencies: Dependency[]

      Provides the ability to document dependency relationships.

      from field: repeated cyclonedx.v1_7.Dependency dependencies = 8;

    • externalReferences: ExternalReference[]

      Provides the ability to document external references related to the BOM or to the project the BOM describes.

      from field: repeated cyclonedx.v1_7.ExternalReference external_references = 7;

    • formulation: Formula[]

      Describes the formulation of any referencable object within the BOM, including components, services, metadata, declarations, or the BOM itself. This may encompass how the object was created, assembled, deployed, tested, certified, or otherwise brought into its present form. Common examples include software build pipelines, deployment processes, AI/ML model training, cryptographic key generation or certification, and third-party audits. Processes are modeled using declared and observed formulas, composed of workflows, tasks, and individual steps.

      from field: repeated cyclonedx.v1_7.Formula formulation = 13;

    • Optionalmetadata?: Metadata

      Provides additional information about a BOM.

      from field: optional cyclonedx.v1_7.Metadata metadata = 4;

    • properties: Property[]

      Specifies custom properties.

      from field: repeated cyclonedx.v1_7.Property properties = 12;

    • OptionalserialNumber?: string

      Every BOM generated should have a unique serial number, even if the contents of the BOM being generated have not changed over time. The process or tool responsible for creating the BOM should create random UUID's for every BOM generated.

      from field: optional string serial_number = 3;

    • services: Service[]

      Provides the ability to document a list of external services.

      from field: repeated cyclonedx.v1_7.Service services = 6;

    • specVersion: string

      The version of the CycloneDX specification a BOM is written to (starting at version 1.3)

      from field: string spec_version = 1;

    • Optionalversion?: number

      The version allows component publishers/authors to make changes to existing BOMs to update various aspects of the document such as description or licenses. When a system is presented with multiple BOMs for the same component, the system should use the most recent version of the BOM. The default version is '1' and should be incremented for each version of the BOM that is published. Each version of a component should have a unique BOM and if no changes are made to the BOMs, then each BOM will have a version of '1'.

      from field: optional int32 version = 2;

    • vulnerabilities: Vulnerability[]

      Vulnerabilities identified in components or services.

      from field: repeated cyclonedx.v1_7.Vulnerability vulnerabilities = 10;

    from message cyclonedx.v1_7.Bom

    Settings

    Member Visibility