[2.0] fixes on schema and test resources by jkowalleck · Pull Request #1001 · CycloneDX/specification

jkowalleck · 2026-08-04T15:31:42Z

fixes or related to

besides those fixes above, this is in the PR:

made the refLinkType inherit explicit
fixes the array nesting of extensibleProerties
consolidated milisecond timestamp for JSS
adds $comments
enhanced some docs
added test cases
- for extensibleProperties
fixed valid test data
- all test data that was just carried over from CDX 1.x was transferred to CDX 2.0schema
fixed invalid test data
- removed invalid-component-choice-missing-name-2.0.json - as the name was optional or did not exist.
  ❓ was this intentional/correct

tests for the things are based on:

2.0 tests init #1000

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

- [x] Java tests - functional - [x] JS tests - functional - WIP - found some false-positives/false-negatives - due to errors in test resources - [x] JS tests - schema validate - includes #996 - includes #992 - JS tests - semantics - [x] #998 - [x] #995 - [x] PHP tests - functional added tests only, no schema/res fixes - they are prepared in - #997 - #1001 --------- Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck · 2026-08-05T16:55:54Z

added new test file

jkowalleck · 2026-08-05T16:56:09Z

added new test file

jkowalleck · 2026-08-05T17:48:55Z

+          "$ref": "#/$defs/timestamp/$defs/withMilliseconds",
          "title": "Created Timestamp",
          "description": "The time at which this signature was originally created. The creator can use any time it deems most appropriate as the time the signature was created, but it MUST be precise to the nearest millisecond (exactly three digits after the decimal place in seconds). The created property MUST NOT be changed when creating a new version of the signature.",
-          "$comment": "Normative source: ITU-T X.590 clause 6.3.1",


consolidated to #/$defs/timestamp/$defs/withMilliseconds

jkowalleck · 2026-08-05T17:49:02Z

          "title": "Modified Timestamp",
          "description": "The time that this particular version of the signature was last modified. The creator can use any time it deems most appropriate as the time that this version of the signature was modified, but it MUST be precise to the nearest millisecond (exactly three digits after the decimal place in seconds). The modified property MUST be later than or equal to the value of the created property. If the created and modified properties are the same, then this is the first version of the signature.",
-          "$comment": "Normative source: ITU-T X.590 clause 6.3.1. Cross-field invariant: 'modified' MUST be greater than or equal to 'created'. JSON Schema 2020-12 cannot compare two sibling property values, so this constraint is NOT enforced by this schema and MUST be validated by the consuming tool or conformance suite.",
-          "pattern": "^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\\.[0-9]{3}Z$"


consolidated to #/$defs/timestamp/$defs/withMilliseconds

jkowalleck · 2026-08-05T18:28:36Z

file was removed, since the relevant test case did not exist.
the componentCHoice does not require/have a name

❓ was this intentional/correct

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Copilot

Pull request overview

Updates the CycloneDX 2.0 JSON schemas and test fixtures to align with recent model changes (notably parties, signatures, extensible properties, and stricter schema semantics), and extends the JS semantic test suite to enforce additional schema invariants.

Changes:

Refactors many 2.0 test resources from legacy fields (e.g., publisher, supplier, manufacturer, authors, signature) to 2.0 structures (parties, signatures), and corrects cryptography-related shapes.
Tightens/clarifies schema semantics (e.g., additionalProperties: false in more places, explicit property presence in oneOf/anyOf branches, refLinkType usage).
Adds extensible-properties valid/invalid fixtures and adjusts JS semantic tests for the updated schema patterns.

Reviewed changes

Copilot reviewed 49 out of 49 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/src/test/resources/2.0/valid-standard-2.0.json	Updates signature fixture to `signatures[]` and new JSS field names.
tools/src/test/resources/2.0/valid-service-2.0.json	Migrates `publisher` to `parties` role-based representation.
tools/src/test/resources/2.0/valid-perspective-2.0.json	Migrates `supplier` to `parties` role-based representation.
tools/src/test/resources/2.0/valid-patent-2.0.json	Migrates `manufacturer` to `parties` and updates organization URL structure.
tools/src/test/resources/2.0/valid-machine-learning-considerations-env-2.0.json	Migrates `supplier`/`publisher` to `parties`.
tools/src/test/resources/2.0/valid-machine-learning-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-license-name-with-text-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-license-name-with-licensing-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-license-name-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-license-id-with-text-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-license-id-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-license-expression-with-licensing-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-license-expression-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-license-choice-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-formulation-2.0.json	Migrates `publisher` to `parties`.
tools/src/test/resources/2.0/valid-external-reference-2.0.json	Migrates `publisher` to `parties` and adds new externalReference types.
tools/src/test/resources/2.0/valid-extensible-properties.json	Adds a valid extensible-properties fixture (new file).
tools/src/test/resources/2.0/valid-cryptography-implementation-2.0.json	Updates cryptography fixtures to match schema (e.g., arrays where required).
tools/src/test/resources/2.0/valid-cryptography-full-2.0.json	Updates cryptography fixtures (e.g., arrays for refs/platform).
tools/src/test/resources/2.0/valid-cryptography-certificate-advanced-2.0.json	Updates certificate fixtures and adds algorithm asset + algorithmRef arrays.
tools/src/test/resources/2.0/valid-cryptography-certificate-2.0.json	Fixes ref and expands crypto assets; updates platform arrays.
tools/src/test/resources/2.0/valid-component-swid-full-2.0.json	Migrates `authors` to `parties` with `author` role.
tools/src/test/resources/2.0/valid-component-swid-2.0.json	Migrates `authors` to `parties` with `author` role.
tools/src/test/resources/2.0/valid-component-choice-xor-2.0.json	Migrates `supplier` to `parties` for component-choice samples.
tools/src/test/resources/2.0/valid-component-choice-or-2.0.json	Migrates `supplier` to `parties` for component-choice samples.
tools/src/test/resources/2.0/valid-component-choice-nested-2.0.json	Migrates nested `supplier` to nested `parties`.
tools/src/test/resources/2.0/valid-component-choice-in-nested-components-2.0.json	Migrates nested `supplier` to nested `parties`.
tools/src/test/resources/2.0/valid-component-choice-and-2.0.json	Migrates `supplier` to `parties` for AND operator sample.
tools/src/test/resources/2.0/valid-bom-2.0.json	Broad migration of manufacturer/supplier/authors/publisher to `parties`, including contacts and URLs.
tools/src/test/resources/2.0/valid-attestation-2.0.json	Migrates multiple `signature` objects to `signatures[]` throughout.
tools/src/test/resources/2.0/invalid-extensible-properties.json	Adds invalid extensible-properties fixture (new file).
tools/src/test/resources/2.0/invalid-component-choice-missing-name-2.0.json	Removes an invalid test resource fixture.
tools/src/test/js/schema-v2/json-schema-semantic-tests.js	Updates semantic tests for `refLinkType` exception and additionalProperties handling.
schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json	Adds `additionalProperties: false` and fixes `required`-property existence assertions.
schema/2.0/model/cyclonedx-patent-2.0.schema.json	Switches certain refs from `refType` to `refLinkType`.
schema/2.0/model/cyclonedx-party-2.0.schema.json	Makes `oneOf` branches explicitly assert the required property exists.
schema/2.0/model/cyclonedx-metadata-2.0.schema.json	Adds `additionalProperties: false` to an object schema.
schema/2.0/model/cyclonedx-license-2.0.schema.json	Makes `oneOf` branches explicitly assert the required property exists.
schema/2.0/model/cyclonedx-jss_X590_2023_10-2.0.schema.json	Consolidates millisecond timestamp handling and adds explicit property presence in `anyOf`.
schema/2.0/model/cyclonedx-formulation-2.0.schema.json	Makes `oneOf` branches explicitly assert the required property exists.
schema/2.0/model/cyclonedx-declaration-2.0.schema.json	Adjusts required fields in a `oneOf` branch (e.g., `signatures`).
schema/2.0/model/cyclonedx-data-2.0.schema.json	Makes `oneOf` branches explicitly assert the required property exists.
schema/2.0/model/cyclonedx-cryptography-2.0.schema.json	Refactors some `oneOf` branches/types and shifts refs to `refLinkType`.
schema/2.0/model/cyclonedx-component-2.0.schema.json	Improves mutual-exclusion logic annotation and adds property presence to `not`.
schema/2.0/model/cyclonedx-common-2.0.schema.json	Makes `refLinkType` inheritance explicit; refactors extensible-properties schema; adjusts base mixins; adds placeholder for organizationalEntityOrContact.
schema/2.0/model/cyclonedx-citation-2.0.schema.json	Makes `anyOf`/`oneOf` branches explicitly assert required property exists.
schema/2.0/model/cyclonedx-annotation-2.0.schema.json	Makes `oneOf` branches explicitly assert required property exists.
schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json	Removes redundant `type` alongside `$ref`.
schema/2.0/cyclonedx-2.0.schema.json	Replaces root `additionalProperties: false` with `unevaluatedProperties: false` to support extensibility mixins.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck mentioned this pull request Aug 4, 2026

2.0 tests init #1000

Merged

4 tasks

jkowalleck changed the title ~~2.0 tests init fixes~~ 2.0 fixes Aug 4, 2026

jkowalleck added defect CDX 2.0 related to release v2.0 labels Aug 4, 2026

fix

905e58a

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck force-pushed the 2.0-tests-init-fixes branch from a03e560 to 905e58a Compare August 4, 2026 15:36

jkowalleck and others added 23 commits August 4, 2026 19:00

Merge branch '2.0-dev' into 2.0-tests-init-fixes

f4829e5

Merge branch '2.0-dev' into 2.0-tests-init-fixes

faaa42d

Merge branch '2.0-dev' into 2.0-tests-init-fixes

bda8d96

Merge branch '2.0-dev' into 2.0-tests-init-fixes

9ac7ae3

fix

3ff7b2e

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

fix

377fd52

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

compiled

73b22de

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

fix

ec1d783

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

fix

cf92dc7

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

revert-bundle

2927d0b

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Merge branch '2.0-dev' into 2.0-tests-init-fixes

2c793a2

fixes

bbcfa55

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

3b9cfbb

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

b6325bf

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

35b417b

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

schema

4adea67

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

af0a8c4

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

640944f

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

schema

7717285

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

test/validator

4e8c558

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

schema

897d033

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

17582a7

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

8803aa7

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck added 2 commits August 5, 2026 18:21

tests

f4b3642

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

schema

079bc5c

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck added 5 commits August 5, 2026 18:40

tests

f4407ff

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

bb38682

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

schema

828bb86

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

helpers

1e5410e

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Merge remote-tracking branch 'origin/2.0-dev' into 2.0-tests-init-fixes

3caad90

jkowalleck added the chore: QA A chore related to Quality Assurance label Aug 5, 2026

jkowalleck added this to the 2.0 milestone Aug 5, 2026

jkowalleck marked this pull request as ready for review August 5, 2026 17:45

jkowalleck requested a review from a team as a code owner August 5, 2026 17:45

jkowalleck commented Aug 5, 2026

View reviewed changes

refLinkType inheritance

0d22d5e

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

jkowalleck requested review from stevespringett and a lite review from Copilot August 5, 2026 18:48

jkowalleck changed the title ~~2.0 fixes~~ 2.0 fixes on schema and test resources Aug 5, 2026

Copilot started reviewing on behalf of jkowalleck August 5, 2026 18:49 View session

jkowalleck changed the title ~~2.0 fixes on schema and test resources~~ [2.0] fixes on schema and test resources Aug 5, 2026

Copilot AI reviewed Aug 5, 2026

View reviewed changes

Comment thread schema/2.0/model/cyclonedx-common-2.0.schema.json

Comment thread tools/src/test/js/schema-v2/json-schema-semantic-tests.js

Comment thread schema/2.0/model/cyclonedx-component-2.0.schema.json Outdated

jkowalleck added 6 commits August 5, 2026 20:59

test-runner

046eb69

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

test-runner

35fff9e

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

docs

687815e

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

bdd29d3

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

9e4a414

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

tests

913f603

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Navigation Menu

Uh oh!

Uh oh!

[2.0] fixes on schema and test resources - #1001

[2.0] fixes on schema and test resources#1001
jkowalleck wants to merge 38 commits into
2.0-devfrom
2.0-tests-init-fixes

jkowalleck commented Aug 4, 2026 •

edited

Loading

Uh oh!

jkowalleck Aug 5, 2026

Uh oh!

jkowalleck Aug 5, 2026

Uh oh!

jkowalleck Aug 5, 2026

Uh oh!

jkowalleck Aug 5, 2026

Uh oh!

jkowalleck Aug 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

jkowalleck commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

jkowalleck Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

jkowalleck Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

jkowalleck Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

jkowalleck Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jkowalleck commented Aug 4, 2026 •

edited

Loading