1.6 dev attestations

schema/bom-1.6.proto

@@ -39,6 +39,10 @@ message Bom {
   repeated Property properties = 12;
   // Describes how a component or service was manufactured or deployed. This is achieved through the use of formulas, workflows, tasks, and steps, which declare the precise steps to reproduce along with the observed formulas describing the steps which transpired in the manufacturing process.
   repeated Formula formulation = 13;
+  // The list of declarations which describe the conformance to standards. Each declaration may include attestations, claims, and evidence.
+  repeated Declarations declarations = 14;
+  // A collection of reusable objects that are defined and may be used elsewhere in the BOM.
+  repeated Definition definitions = 15;
 }
 
 enum Classification {
@@ -265,6 +269,10 @@ enum ExternalReferenceType {
   EXTERNAL_REFERENCE_TYPE_FORMULATION = 37;
   // URL to a source archive.
   EXTERNAL_REFERENCE_TYPE_SOURCE_DISTRIBUTION = 38;
+  // An e-signature is commonly a scanned representation of a written signature or a stylized script of the persons name.
+  EXTERNAL_REFERENCE_TYPE_ELECTRONIC_SIGNATURE = 39;
+  // A signature that leverages cryptography, typically public/private key pairs, which provides strong authenticity verification.
+  EXTERNAL_REFERENCE_TYPE_DIGITAL_SIGNATURE = 40;
 }
 
 enum HashAlg {
@@ -1488,3 +1496,192 @@ message EnvironmentVars {
     string value = 2;
   }
 }
+
+message Declarations {
+  message Assessor {
+    // An optional identifier which can be used to reference the component elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
+    optional string bom_ref = 1;
+    // The boolean indicating if the assessor is outside the organization generating claims. A value of false indicates a self assessor.
+    optional bool thirdParty = 2;
+    // The entity issuing the assessment.
+    optional OrganizationalEntity organization = 3;
+  }
+  message Attestation {
+    message AttestationMap {
+      message AttestationConformance {
+        // The conformance of the claim between and inclusive of 0 and 1, where 1 is 100% conformance.
+        optional double score = 1;
+        // The rationale for the conformance score.
+        optional string rationale = 2;
+        // The list of  `bom-ref` to the evidence provided describing the mitigation strategies.
+        repeated string mitigationStrategies = 3;
+      }
+      message AttestationConfidence {
+        // The confidence of the claim between and inclusive of 0 and 1, where 1 is 100% confidence.
+        optional double score = 1;
+        // The rationale for the confidence score.
+        optional string rationale = 2;
+      }
+      // The `bom-ref` to the requirement being attested to.
+      optional string requirement = 1;
+      // The list of `bom-ref` to the claims being attested to.
+      repeated string claims = 2;
+      // The list of  `bom-ref` to the counter claims being attested to.
+      repeated string counterClaims = 3;
+      // The conformance of the claim meeting a requirement.
+      optional AttestationConformance conformance = 4;
+      // The confidence of the claim meeting the requirement.
+      optional AttestationConfidence confidence = 5;
+    }
+    // The short description explaining the main points of the attestation.
+    optional string summary = 1;
+    // The `bom-ref` to the assessor asserting the attestation.
+    optional string assessor = 2;
+    // The grouping of requirements to claims and the attestors declared conformance and confidence thereof.
+    repeated AttestationMap map = 3;
+  }
+  message Claim {
+    // An optional identifier which can be used to reference the component elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
+    optional string bom_ref = 1;
+    // The `bom-ref` to a target representing a specific system, application, API, module, team, person, process, business unit, company, etc...  that this claim is being applied to.
+    optional string target = 2;
+    // The specific statement or assertion about the target.
+    optional string predicate = 3;
+    // The list of  `bom-ref` to the evidence provided describing the mitigation strategies. Each mitigation strategy should include an explanation of how any weaknesses in the evidence will be mitigated.
+    repeated string mitigationStrategies = 4;
+    // The written explanation of why the evidence provided substantiates the claim.
+    optional string reasoning = 5;
+    // The list of `bom-ref` to evidence that supports this claim.
+    repeated string evidence = 6;
+    // The list of `bom-ref` to counterEvidence that supports this claim.
+    repeated string counterEvidence = 7;
+    // External references provide a way to document systems, sites, and information that may be relevant, but are not included with the BOM. They may also establish specific relationships within or external to the BOM.
+    repeated ExternalReference externalReferences = 8;
+  }
+  message Evidence {
+    message Data {
+      message Contents {
+        // An optional way to include textual or encoded data.
+        optional AttachedText attachment = 1;
+        // The URL to where the data can be retrieved.
+        optional string url = 2;
+      }
+      // The name of the data.
+      optional string name = 1;
+      // The contents or references to the contents of the data being described.
+      optional Contents contents = 2;
+      // Data classification tags data according to its type, sensitivity, and value if altered, stolen, or destroyed.
+      optional string classification = 3;
+      // A description of any sensitive data included.
+      repeated string sensitiveData = 4;
+      // Data Governance
+      optional DataGovernance governance = 5;
+    }
+    // An optional identifier which can be used to reference the component elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
+    optional string bom_ref = 1;
+    // The reference to the property name as defined in the CycloneDX Property Taxonomy: https://github.com/CycloneDX/cyclonedx-property-taxonomy/.
+    optional string propertyName = 2;
+    // The written description of what this evidence is and how it was created.
+    optional string description = 3;
+    // The output or analysis that supports claims.
+    repeated Data data = 4;
+    // The date and time (timestamp) when the evidence was created.
+    optional google.protobuf.Timestamp created = 5;
+    // The optional date and time (timestamp) when the evidence is no longer valid.
+    optional google.protobuf.Timestamp expires = 6;
+    // The author of the evidence.
+    optional OrganizationalContact author = 7;
+    // The reviewer of the evidence.
+    optional OrganizationalContact reviewer = 8;
+  }
+  message Targets {
+    // The list of organizations which claims are made against.
+    repeated OrganizationalEntity organizations = 1;
+    // The list of components which claims are made against.
+    repeated Component components = 2;
+    // The list of services which claims are made against.
+    repeated Service services = 3;
+  }
+  message Affirmation {
+    message Signatory {
+      // The signatory's name.
+      optional string name = 1;
+      // The signatory's role within an organization.
+      optional string role = 2;
+      // The signatory's organization.
+      optional OrganizationalEntity organization = 3;
+      // An External reference provide a way to document systems, sites, and information that may be relevant, but are not included with the BOM. They may also establish specific relationships within or external to the BOM.
+      optional ExternalReference externalReference = 4;
+    }
+    // The brief statement affirmed by an individual regarding all declarations. Notes: This could be an affirmation of acceptance by a third-party auditor or receiving individual of a file.
+    optional string statement = 1;
+    // The list of signatories authorized on behalf of an organization to assert validity of this document.
+    repeated Signatory signatories = 2;
+  }
+  // The list of assessors evaluating claims and determining conformance to requirements and confidence in that assessment.
+  repeated Assessor assessors = 1;
+  // The list of attestations asserted by an assessor that maps requirements to claims.
+  repeated Attestation attestations = 2;
+  // The list of claims.
+  repeated Claim claims = 3;
+  // The list of evidence
+  repeated Evidence evidence = 4;
+  // The list of targets which claims are made against.
+  optional Targets targets = 5;
+  // affirmation
+  optional Affirmation affirmation = 6;
+}
+
+message Definition {
+  message Standard {
+    message Requirement {
+      // An optional identifier which can be used to reference the component elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
+      optional string bom_ref = 1;
+      // The unique identifier used in the standard to identify a specific requirement. This should match what is in the standard and should not be the requirements bom-ref.
+      optional string identifier = 2;
+      // The title of the requirement.
+      optional string title = 3;
+      // The textual content of the requirement.
+      optional string text = 4;
+      // The supplemental text that provides additional guidance or context to the requirement, but is not directly part of the requirement.
+      repeated string descriptions = 5;
+      // The Common Requirements Enumeration (CRE) identifier(s). CRE is a structured and standardized framework for uniting security standards and guidelines. CRE links each section of a resource to a shared topic identifier (a Common Requirement). Through this shared topic link, all resources map to each other. Use of CRE promotes clear and unambiguous communication among stakeholders.
+      repeated string openCre = 6;
+      // The optional `bom-ref` to a parent requirement. This establishes a hierarchy of requirements. Top-level requirements must not define a parent. Only child requirements should define parents.
+      optional string parent = 7;
+      // Specifies optional, custom, properties
+      repeated Property properties = 8;
+      // External references provide a way to document systems, sites, and information that may be relevant, but are not included with the BOM. They may also establish specific relationships within or external to the BOM.
+      repeated ExternalReference externalReferences = 9;
+    }
+    message Level {
+      // An optional identifier which can be used to reference the component elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
+      optional string bom_ref = 1;
+      // The identifier used in the standard to identify a specific level.
+      optional string identifier = 2;
+      // The title of the level.
+      optional string title = 3;
+      // The description of the level.
+      optional string description = 4;
+      // The list of requirement `bom-ref`s that comprise the level.
+      repeated string requirements = 5;
+    }
+    // An optional identifier which can be used to reference the component elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
+    optional string bom_ref = 1;
+    // The name of the standard. This will often be a shortened, single name of the standard.
+    optional string name = 2;
+    // The version of the standard.
+    optional string version = 3;
+    // The description of the standard.
+    optional string description = 4;
+    // The owner of the standard, often the entity responsible for its release.
+    optional string owner = 5;
+    // The list of requirements comprising the standard.
+    repeated Requirement requirements = 6;
+    // The list of levels associated with the standard. Some standards have different levels of compliance.
+    repeated Level levels = 7;
+    // External references provide a way to document systems, sites, and information that may be relevant, but are not included with the BOM. They may also establish specific relationships within or external to the BOM.
+    repeated ExternalReference externalReferences = 8;
+  }
+  repeated Standard standards = 1;
+}