cyclonedx-declaration-2.0.schema.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://cyclonedx.org/schema/2.0/model/cyclonedx-declaration-2.0.schema.json",
  "type": "null",
  "title": "CycloneDX Declaration Model",
  "$comment" : "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.",
  "$defs": {
    "declarations": {
      "type": "object",
      "title": "Declarations",
      "description": "The list of declarations which describe the conformance to standards. Each declaration may include attestations, claims, and evidence.",
      "additionalProperties": false,
      "properties": {
        "assessors": {
          "type": "array",
          "title": "Assessors",
          "description": "The list of assessors evaluating claims and determining conformance to requirements and confidence in that assessment.",
          "items": {
            "type": "object",
            "title": "Assessor",
            "description": "The assessor who evaluates claims and determines conformance to requirements and confidence in that assessment.",
            "additionalProperties": false,
            "properties": {
              "bom-ref": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
                "title": "BOM Reference",
                "description": "An identifier which can be used to reference the object elsewhere in the BOM. Every `bom-ref` must be unique within the BOM."
              },
              "thirdParty": {
                "type": "boolean",
                "title": "Third Party",
                "description": "The boolean indicating if the assessor is outside the organization generating claims. A value of false indicates a self assessor."
              },
              "organization": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntity",
                "title": "Organization",
                "description": "The entity issuing the assessment."
              }
            }
          }
        },
        "attestations": {
          "type": "array",
          "title": "Attestations",
          "description": "The list of attestations asserted by an assessor that maps requirements to claims.",
          "items": {
            "type": "object",
            "title": "Attestation",
            "additionalProperties": false,
            "properties": {
              "summary":  {
                "type": "string",
                "title": "Summary",
                "description": "The short description explaining the main points of the attestation."
              },
              "assessor": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
                "title": "Assessor",
                "description": "The `bom-ref` to the assessor asserting the attestation."
              },
              "map": {
                "type": "array",
                "title": "Map",
                "description": "The grouping of requirements to claims and the attestors declared conformance and confidence thereof.",
                "items": {
                  "type": "object",
                  "title": "Map",
                  "additionalProperties": false,
                  "properties": {
                    "requirement": {
                      "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
                      "title": "Requirement",
                      "description": "The `bom-ref` to the requirement being attested to."
                    },
                    "claims": {
                      "type": "array",
                      "title": "Claims",
                      "description": "The list of `bom-ref` to the claims being attested to.",
                      "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }
                    },
                    "counterClaims": {
                      "type": "array",
                      "title": "Counter Claims",
                      "description": "The list of  `bom-ref` to the counter claims being attested to.",
                      "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }
                    },
                    "conformance": {
                      "type": "object",
                      "title": "Conformance",
                      "description": "The conformance of the claim meeting a requirement.",
                      "additionalProperties": false,
                      "properties": {
                        "score": {
                          "type": "number",
                          "minimum": 0,
                          "maximum": 1,
                          "title": "Score",
                          "description": "The conformance of the claim between and inclusive of 0 and 1, where 1 is 100% conformance."
                        },
                        "rationale": {
                          "type": "string",
                          "title": "Rationale",
                          "description": "The rationale for the conformance score."
                        },
                        "mitigationStrategies": {
                          "type": "array",
                          "title": "Mitigation Strategies",
                          "description": "The list of  `bom-ref` to the evidence provided describing the mitigation strategies.",
                          "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }
                        }
                      }
                    },
                    "confidence": {
                      "type": "object",
                      "title": "Confidence",
                      "description": "The confidence of the claim meeting the requirement.",
                      "additionalProperties": false,
                      "properties": {
                        "score": {
                          "type": "number",
                          "minimum": 0,
                          "maximum": 1,
                          "title": "Score",
                          "description": "The confidence of the claim between and inclusive of 0 and 1, where 1 is 100% confidence."
                        },
                        "rationale": {
                          "type": "string",
                          "title": "Rationale",
                          "description": "The rationale for the confidence score."
                        }
                      }
                    }
                  }
                }
              },
              "signatures": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures",
                "title": "Signature",
                "description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
              }
            }
          }
        },
        "claims": {
          "type": "array",
          "title": "Claims",
          "description": "The list of claims.",
          "items": {
            "type": "object",
            "title": "Claim",
            "additionalProperties": false,
            "properties": {
              "bom-ref": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
                "title": "BOM Reference",
                "description": "An identifier which can be used to reference the object elsewhere in the BOM. Every `bom-ref` must be unique within the BOM."
              },
              "target": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
                "title": "Target",
                "description": "The `bom-ref` to a target representing a specific system, application, API, module, team, person, process, business unit, company, etc...  that this claim is being applied to."
              },
              "predicate": {
                "type": "string",
                "title": "Predicate",
                "description": "The specific statement or assertion about the target."
              },
              "mitigationStrategies": {
                "type": "array",
                "title": "Mitigation Strategies",
                "description": "The list of  `bom-ref` to the evidence provided describing the mitigation strategies. Each mitigation strategy should include an explanation of how any weaknesses in the evidence will be mitigated.",
                "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }
              },
              "reasoning": {
                "type": "string",
                "title": "Reasoning",
                "description": "The written explanation of why the evidence provided substantiates the claim."
              },
              "evidence": {
                "type": "array",
                "title": "Evidence",
                "description": "The list of `bom-ref` to evidence that supports this claim.",
                "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }
              },
              "counterEvidence": {
                "type": "array",
                "title": "Counter Evidence",
                "description": "The list of `bom-ref` to counterEvidence that supports this claim.",
                "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType" }
              },
              "externalReferences": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReferences"
              },
              "signatures": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures",
                "title": "Signature",
                "description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
              }
            }
          }
        },
        "evidence": {
          "type": "array",
          "title": "Evidence",
          "description": "The list of evidence",
          "items": {
            "type": "object",
            "title": "Evidence",
            "additionalProperties": false,
            "properties": {
              "bom-ref": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
                "title": "BOM Reference",
                "description": "An identifier which can be used to reference the object elsewhere in the BOM. Every `bom-ref` must be unique within the BOM."
              },
              "propertyName": {
                "type": "string",
                "title": "Property Name",
                "description": "The reference to the property name as defined in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy/)."
              },
              "description": {
                "type": "string",
                "title": "Description",
                "description": "The written description of what this evidence is and how it was created."
              },
              "data": {
                "type": "array",
                "title": "Data",
                "description": "The output or analysis that supports claims.",
                "items": {
                  "type": "object",
                  "title": "Data",
                  "additionalProperties": false,
                  "properties": {
                    "name": {
                      "title": "Data Name",
                      "description": "The name of the data.",
                      "type": "string"
                    },
                    "contents": {
                      "type": "object",
                      "title": "Data Contents",
                      "description": "The contents or references to the contents of the data being described.",
                      "additionalProperties": false,
                      "properties": {
                        "attachment": {
                          "title": "Data Attachment",
                          "description": "A way to include textual or encoded data.",
                          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment"
                        },
                        "url": {
                          "type": "string",
                          "title": "Data URL",
                          "description": "The URL to where the data can be retrieved.",
                          "format": "iri-reference"
                        }
                      }
                    },
                    "classification": {
                      "$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataClassification"
                    },
                    "sensitiveData": {
                      "type": "array",
                      "title": "Sensitive Data",
                      "description": "A description of any sensitive data included.",
                      "items": {
                        "type": "string"
                      }
                    },
                    "governance": {
                      "title": "Data Governance",
                      "$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataGovernance"
                    }
                  }
                }
              },
              "created": {
                "type": "string",
                "format": "date-time",
                "title": "Created",
                "description": "The date and time (timestamp) when the evidence was created."
              },
              "expires": {
                "type": "string",
                "format": "date-time",
                "title": "Expires",
                "description": "The date and time (timestamp) when the evidence is no longer valid."
              },
              "author": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalContact",
                "title": "Author",
                "description": "The author of the evidence."
              },
              "reviewer": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalContact",
                "title": "Reviewer",
                "description": "The reviewer of the evidence."
              },
              "signatures": {
                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures",
                "title": "Signature",
                "description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
              }
            }
          }
        },
        "targets": {
          "type": "object",
          "title": "Targets",
          "description": "The list of targets which claims are made against.",
          "additionalProperties": false,
          "properties": {
            "organizations": {
              "type": "array",
              "title": "Organizations",
              "description": "The list of organizations which claims are made against.",
              "items": {"$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntity"}
            },
            "components": {
              "type": "array",
              "title": "Components",
              "description": "The list of components which claims are made against.",
              "items": {"$ref": "cyclonedx-component-2.0.schema.json#/$defs/component"}
            },
            "services": {
              "type": "array",
              "title": "Services",
              "description": "The list of services which claims are made against.",
              "items": {"$ref": "cyclonedx-service-2.0.schema.json#/$defs/service"}
            }
          }
        },
        "affirmation": {
          "type": "object",
          "title": "Affirmation",
          "description": "A concise statement affirmed by an individual regarding all declarations, often used for third-party auditor acceptance or recipient acknowledgment. It includes a list of authorized signatories who assert the validity of the document on behalf of the organization.",
          "additionalProperties": false,
          "properties": {
            "statement": {
              "type": "string",
              "title": "Statement",
              "description": "The brief statement affirmed by an individual regarding all declarations.\n*- Notes This could be an affirmation of acceptance by a third-party auditor or receiving individual of a file.",
              "examples": [ "I certify, to the best of my knowledge, that all information is correct." ]
            },
            "signatories": {
              "type": "array",
              "title": "Signatories",
              "description": "The list of signatories authorized on behalf of an organization to assert validity of this document.",
              "items": {
                "type": "object",
                "title": "Signatory",
                "additionalProperties": false,
                "oneOf": [
                  {
                    "required": ["signature"]
                  },
                  {
                    "required": ["externalReference", "organization"]
                  }
                ],
                "properties": {
                  "name": {
                    "type": "string",
                    "title": "Name",
                    "description": "The signatory's name."
                  },
                  "role": {
                    "type": "string",
                    "title": "Role",
                    "description": "The signatory's role within an organization."
                  },
                  "signatures": {
                    "$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures",
                    "title": "Signature",
                    "description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
                  },
                  "organization": {
                    "$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntity",
                    "title": "Organization",
                    "description": "The signatory's organization."
                  },
                  "externalReference": {
                    "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReference"
                  }
                }
              }
            },
            "signatures": {
              "$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures",
              "title": "Signature",
              "description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
            }
          }
        },
        "signatures": {
          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/signatures",
          "title": "Signature",
          "description": "Enveloped signature in [JSON Signature Format (JSF)](https://cyberphone.github.io/doc/security/jsf.html)."
        }
      }
    }
  }
}