Merge remote-tracking branch 'origin/1.6-dev' into 1.6-dev

CycloneDX · Feb 21, 2024 · 472d4c2 · 472d4c2
2 parents 23066d5 + d9e703f
commit 472d4c2
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 4 deletions.
diff --git a/schema/bom-1.6.proto b/schema/bom-1.6.proto
@@ -228,7 +228,7 @@ enum ExternalReferenceType {
   EXTERNAL_REFERENCE_TYPE_BUILD_META = 13;
   // URL to an automated build system
   EXTERNAL_REFERENCE_TYPE_BUILD_SYSTEM = 14;
-  // Specifies a way to contact the maintainer, supplier, or provider in the event of a security incident. Common URIs include links to a disclosure procedure, a mailto (RFC-2368) that specifies an email address, a tel (RFC-3966) that specifies a phone number, or dns (RFC-4501]) that specifies the records containing DNS Security TXT.
+  // Specifies a way to contact the maintainer, supplier, or provider in the event of a security incident. Common URIs include links to a disclosure procedure, a mailto (RFC-2368) that specifies an email address, a tel (RFC-3966) that specifies a phone number, or dns (RFC-4501) that specifies the records containing DNS Security TXT.
   EXTERNAL_REFERENCE_TYPE_SECURITY_CONTACT = 15;
   // Human or machine-readable statements containing facts, evidence, or testimony
   EXTERNAL_REFERENCE_TYPE_ATTESTATION = 16;
@@ -448,7 +448,7 @@ message Metadata {
   optional OrganizationalEntity manufacture = 5;
   // The organization that supplied the component that the BOM describes. The supplier may often be the manufacture, but may also be a distributor or repackager.
   optional OrganizationalEntity supplier = 6;
-  // The license information for the BOM document
+  // The license information for the BOM document. This may be different from the license(s) of the component that the BOM describes.
   optional LicenseChoice licenses = 7;
   // Specifies optional, custom, properties
   repeated Property properties = 8;

diff --git a/schema/bom-1.6.schema.json b/schema/bom-1.6.schema.json
@@ -691,6 +691,7 @@
         },
         "licenses": {
           "title": "BOM License(s)",
+          "description": "The license information for the BOM document.\nThis may be different from the license(s) of the component that the BOM describes.",
           "$ref": "#/definitions/licenseChoice"
         },
         "properties": {

diff --git a/schema/bom-1.6.xsd b/schema/bom-1.6.xsd
@@ -223,7 +223,14 @@ limitations under the License.
                         supplier may often be the manufacturer, but may also be a distributor or repackager.</xs:documentation>
                 </xs:annotation>
             </xs:element>
-            <xs:element name="licenses" type="bom:licenseChoiceType" minOccurs="0" maxOccurs="1"/>
+            <xs:element name="licenses" type="bom:licenseChoiceType" minOccurs="0" maxOccurs="1">
+                <xs:annotation>
+                    <xs:documentation>
+                        The license information for the BOM document.
+                        This may be different from the license(s) of the component that the BOM describes.
+                    </xs:documentation>
+                </xs:annotation>
+            </xs:element>
             <xs:element name="properties" type="bom:propertiesType" minOccurs="0" maxOccurs="1">
                 <xs:annotation>
                     <xs:documentation>Provides the ability to document properties in a name/value store.
@@ -1314,7 +1321,7 @@ limitations under the License.
             </xs:enumeration>
             <xs:enumeration value="security-contact">
                 <xs:annotation>
-                    <xs:documentation>Specifies a way to contact the maintainer, supplier, or provider in the event of a security incident. Common URIs include links to a disclosure procedure, a mailto (RFC-2368) that specifies an email address, a tel (RFC-3966) that specifies a phone number, or dns (RFC-4501]) that specifies the records containing DNS Security TXT.</xs:documentation>
+                    <xs:documentation>Specifies a way to contact the maintainer, supplier, or provider in the event of a security incident. Common URIs include links to a disclosure procedure, a mailto (RFC-2368) that specifies an email address, a tel (RFC-3966) that specifies a phone number, or dns (RFC-4501) that specifies the records containing DNS Security TXT.</xs:documentation>
                 </xs:annotation>
             </xs:enumeration>
             <xs:enumeration value="model-card">