support cdx 1.6

[mtsfoni]

No description provided.

[andreas-hilti]

@mtsfoni Do you have an understanding which features/changes still need to be added to support 1.6 (https://github.com/CycloneDX/specification/releases/tag/1.6)?
From what I can see your changes are mostly related to general revisioning and CBOM.
This means we are missing at least:

• Attestation
• Several smaller features (like tags, swhid, etc.)
• Json and Protobuf tests

[mtsfoni]

• The CBOM part probably still needs adaption for JSON. It seems to be a good idea to start with JSON and add XML after - unfortunately I did it the other way. This will be my next step.

• Attestation is missing.

• Smaller Features might or might not be added, needs checking.

• I added the test. But many tests were generated outputting an empty BOM, so before releasing the round-trip-test have to be reviewed, that in- and output are actually equal. (For example the Attestation tests)

I hope we managed to fix or at least work around the already existing problem enough now. Those quite threw me off, when I started implementing this months ago. Thank you for your help with those!

[mtsfoni]

@andreas-hilti

On another note, why did you introduce additional fields like CipherSuite.Algorithms_XML?

I think, that was my first attempt to solve the extra nesting level of lists in xml.
It seems to also work with XmlArray/XmlArrayItem - I willl change it.

One issue which fails several of the tests is that Evidence.Identity can now also be an array of EvidenceIdentities.

Looking into that now.

[mtsfoni]

Looks like you already fixed Evidence.Identity?

[andreas-hilti]

Looks like you already fixed Evidence.Identity?

Yes, at least I tried.