[2.0] fixes on schema and test resources

schema/2.0/cyclonedx-2.0.schema.json

@@ -8,7 +8,6 @@
     "specFormat",
     "specVersion"
   ],
-  "additionalProperties": false,
   "properties": {
     "$schema": {
       "type": "string"
@@ -94,5 +93,6 @@
   },
   "allOf": [
     { "$ref": "model/cyclonedx-common-2.0.schema.json#/$defs/extensibleProperties" }
-  ]
+  ],
+  "unevaluatedProperties": false
 }

schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json

@@ -373,7 +373,6 @@
           "description": "A description of the energy provider."
         },
         "organization": {
-          "type": "object",
           "title": "Organization",
           "description": "The organization that provides energy.",
           "$ref": "cyclonedx-common-2.0.schema.json#/$defs/organizationalEntity"

schema/2.0/model/cyclonedx-annotation-2.0.schema.json

@@ -53,24 +53,20 @@
           "description": "The organization, person, component, or service which created the textual content of the annotation.",
           "oneOf": [
             {
-              "required": [
-                "organization"
-              ]
+              "properties": { "organization": true },
+              "required": [ "organization" ]
             },
             {
-              "required": [
-                "individual"
-              ]
+              "properties": { "individual": true },
+              "required": [ "individual" ]
             },
             {
-              "required": [
-                "component"
-              ]
+              "properties": { "component": true },
+              "required": [ "component" ]
             },
             {
-              "required": [
-                "service"
-              ]
+              "properties": { "service": true },
+              "required": ["service"]
             }
           ],
           "additionalProperties": false,

schema/2.0/model/cyclonedx-citation-2.0.schema.json

@@ -73,12 +73,24 @@
       },
       "required": ["timestamp"],
       "anyOf": [
-        { "required": ["attributedTo"] },
-        { "required": ["process"] }
+        {
+          "properties": { "attributedTo": true },
+          "required": ["attributedTo"]
+        },
+        {
+          "properties": { "process": true },
+          "required": ["process"]
+        }
       ],
       "oneOf": [
-        { "required": ["pointers"] },
-        { "required": ["expressions"] }
+        {
+          "properties": { "pointers": true },
+          "required": ["pointers"]
+        },
+        {
+          "properties": { "expressions": true },
+          "required": ["expressions"]
+        }
       ]
     }
   }

schema/2.0/model/cyclonedx-common-2.0.schema.json

@@ -13,7 +13,8 @@
     },
     "refLinkType": {
       "description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.",
-      "$ref": "#/$defs/refType"
+      "allOf": [{ "$ref": "#/$defs/refType" }],
+      "$comment": "value-range is same as 'refType'"
     },
     "bomLinkDocumentType": {
       "title": "BOM-Link Document",
@@ -414,7 +415,7 @@
       }
     },
     "organizationalEntityOrContact": {
-
+        "$comment": "TODO"
     },
     "properties": {
       "type": "array",
@@ -448,43 +449,70 @@
     "extensibleProperties": {
       "type": "object",
       "title": "Extensible Properties",
+      "$comment": "This is a mixin. It intentionally does NOT restrict additional/unevaluated properties itself; schemas composing it via `allOf` are expected to close themselves with `unevaluatedProperties: false` so that both their own defined properties and these patternProperties remain usable.",
       "patternProperties": {
         "^ext:[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}:.+$": {
-          "description": "CycloneDX supports a structured and namespace-aware mechanism for extensibility through the use of extensible properties. This mechanism enables organizations, ecosystems, and tool vendors to safely introduce custom properties without conflicting with the core schema or other extensions.\n\nExtensible properties are defined as a JSON object whose keys must conform to a strict pattern that resembles a reverse domain name structure, prefixed with ext:. This pattern provides a namespacing convention that aligns with well-established practices in other structured formats (e.g., XML namespaces).",
+          "description": "CycloneDX supports a structured and namespace-aware mechanism for extensibility through the use of extensible properties. This mechanism enables organizations, ecosystems, and tool vendors to safely introduce custom properties without conflicting with the core schema or other extensions.\n\nExtensible properties are defined as a JSON object whose keys must conform to a strict pattern that resembles a reverse domain name structure, prefixed with ext:. This pattern provides a namespacing convention that aligns with well-established practices in other structured formats (e.g., XML namespaces).\n\nValues that are objects must declare the schema they conform to via `$schema`. This requirement applies recursively to objects contained in arrays, at any nesting depth.",
           "examples": [
             "ext:<domain>:<name>",
             "ext:example.org:myExtension"
           ],
+          "$ref": "#/$defs/extensibleProperties/$defs/propertyValue"
+        }
+      },
+      "$defs": {
+        "propertyObject": {
+          "type": "object",
+          "title": "Extensible Property Object",
+          "$comment": "Internal helper for extensibleProperties. Not part of the public schema API — do not reference externally; may change without notice.\n\nadditionalProperties explicitly allowed for extensibility reasons.",
+          "required": ["$schema"],
+          "properties": {
+            "$schema": {
+              "type": "string",
+              "format": "uri"
+            }
+          },
+          "additionalProperties": true
+        },
+        "propertyValue": {
+          "title": "Extensible Property Value",
+          "$comment": "Internal helper for extensibleProperties. Not part of the public schema API — do not reference externally; may change without notice.\nRecursive: objects must declare a `$schema`, arrays may nest arbitrarily deep with the same rule applied to every item, all other values are plain scalars.",
           "if": {
-            "type": ["object", "array"]
+            "type": "object"
           },
           "then": {
-            "type": "object",
-            "required": ["$schema"],
-            "properties": {
-              "$schema": {
-                "type": "string",
-                "format": "uri"
-              }
-            }
+            "$ref": "#/$defs/extensibleProperties/$defs/propertyObject"
           },
           "else": {
-            "type": ["string", "number", "boolean", "null"]
+            "if": {
+              "type": "array"
+            },
+            "then": {
+              "type": "array",
+              "items": {
+                "$ref": "#/$defs/extensibleProperties/$defs/propertyValue"
+              }
+            },
+            "else": {
+              "type": ["string", "number", "boolean", "null"]
+            }
           }
         }
       }
     },
     "baseObject": {
+      "type": "object",
       "description": "Base object for all CycloneDX entities. Automatically includes support for extensible properties.",
+      "$comment": "This is a mixin. It intentionally does NOT set `unevaluatedProperties: false` — that keyword cannot see properties defined by schemas composing this one via `allOf`, and would reject them. Concrete (leaf) schemas composing this mixin must close themselves with `unevaluatedProperties: false`.",
       "allOf": [
-        { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/extensibleProperties" }
+        { "$ref": "#/$defs/extensibleProperties" }
       ],
       "properties": {
         "properties": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
+          "$ref": "#/$defs/properties"
         },
         "externalReferences": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/externalReferences"
+          "$ref": "#/$defs/externalReferences"
         }
       }
     },
@@ -496,14 +524,14 @@
       "description": "An RFC 3339-compliant UTC timestamp using Zulu time (i.e., ending with 'Z'). The format must be 'YYYY-MM-DDTHH:MM:SSZ' or include optional fractional seconds, e.g., 'YYYY-MM-DDTHH:MM:SS.sssZ'. Offsets such as '+00:00' are not allowed."
     },
     "lifecycle": {
-      "type": "object",
       "title": "Lifecycle",
       "description": "The product lifecycle(s) that this BOM represents.",
       "oneOf": [
         {
           "$ref": "#/$defs/preDefinedLifecyclePhase"
         },
         {
+          "type": "object",
           "title": "Custom Lifecycle Phase",
           "required": ["name"],
           "additionalProperties": false,
@@ -529,6 +557,7 @@
       "items": { "$ref":  "#/$defs/lifecycle"}
     },
     "preDefinedLifecyclePhase": {
+      "type": "object",
       "title": "Pre-Defined Phase",
       "required": ["phase"],
       "additionalProperties": false,
@@ -777,4 +806,4 @@
       "description": "Enveloped signatures in [JSON Signature Scheme (JSS/ITU-T X.590)](https://www.itu.int/epublications/publication/itu-t-x-590-2023-10-json-signature-scheme-jss)."
     }
   }
-}
+}

schema/2.0/model/cyclonedx-component-2.0.schema.json

@@ -230,8 +230,9 @@
       },
       "allOf": [
         {
-          "description": "Requirement: ensure that `version` and `versionRange` are not present simultaneously.",
+          "description": "Requirement: ensure that `version` and `versionRange` are mutually exclusive.",
           "not": {
+            "properties": { "version": true, "versionRange": true },
             "required": ["version", "versionRange"]
           }
         },

schema/2.0/model/cyclonedx-cryptography-2.0.schema.json

@@ -425,11 +425,11 @@
               "title": "Certificate Lifecycle State",
               "description": "The certificate lifecycle is a comprehensive process that manages digital certificates from their initial creation to eventual expiration or revocation. It typically involves several stages.",
               "items": {
-                "type": "object",
                 "title": "State",
                 "description": "The state of the certificate.",
                 "oneOf": [
                   {
+                    "type": "object",
                     "title": "Pre-Defined State",
                     "required": [
                       "state"
@@ -465,6 +465,7 @@
                     }
                   },
                   {
+                    "type": "object",
                     "title": "Custom State",
                     "required": [
                       "name"
@@ -526,11 +527,11 @@
               "title": "Certificate Extensions",
               "description": "A certificate extension is a field that provides additional information about the certificate or its use. Extensions are used to convey additional information beyond the standard fields.",
               "items": {
-                "type": "object",
                 "title": "Extension",
                 "description": "",
                 "oneOf": [
                   {
+                    "type": "object",
                     "title": "Common Extensions",
                     "required": [
                       "commonExtensionName",
@@ -575,6 +576,7 @@
                     }
                   },
                   {
+                    "type": "object",
                     "title": "Custom Extensions",
                     "description": "Custom extensions may convey application-specific or vendor-specific data not covered by standard extensions. The structure and semantics of custom extensions are typically defined outside of public standards. CycloneDX leverages properties to support this capability.",
                     "required": [
@@ -885,7 +887,7 @@
           "title": "Related Algorithms",
           "description": "A list of algorithms related to the cipher suite.",
           "items": {
-            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
             "title": "Algorithm reference",
             "description": "The bom-ref to algorithm cryptographic asset."
           }
@@ -955,7 +957,7 @@
           "description": "The key length of the encryption algorithm."
         },
         "algorithm": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
           "title": "Algorithm reference",
           "description": "The bom-ref to algorithm cryptographic asset."
         }
@@ -976,7 +978,7 @@
           ]
         },
         "algorithm": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
           "title": "Algorithm reference",
           "description": "The bom-ref to algorithm cryptographic asset."
         }
@@ -997,7 +999,7 @@
           ]
         },
         "algorithm": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
           "title": "Algorithm reference",
           "description": "The bom-ref to algorithm cryptographic asset."
         }
@@ -1015,7 +1017,7 @@
           "description": "A group identifier for the key exchange algorithm."
         },
         "algorithm": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
           "title": "Algorithm reference",
           "description": "The bom-ref to algorithm cryptographic asset."
         }
@@ -1033,7 +1035,7 @@
           "description": "A name for the authentication method."
         },
         "algorithm": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
           "title": "Algorithm reference",
           "description": "The bom-ref to algorithm cryptographic asset."
         }
@@ -1111,18 +1113,18 @@
           ]
         },
         "ref": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
           "title": "Reference to cryptographic asset",
           "description": "The bom-ref to cryptographic asset."
         }
       }
     },
     "fingerprint": {
-      "type": "object",
       "title": "Fingerprint",
       "description": "The fingerprint is a cryptographic hash of the asset.",
       "oneOf": [
         {
+          "type": "object",
           "title": "Standard Hash",
           "description": "A fingerprint computed using a standard, well-known hash algorithm.",
           "required": ["alg", "content"],
@@ -1137,6 +1139,7 @@
           }
         },
         {
+          "type": "object",
           "title": "Custom Fingerprint",
           "description": "A fingerprint computed with a custom or non-standard algorithm not covered by the standard hash algorithms.",
           "required": ["customAlg", "customContent"],
@@ -1179,7 +1182,7 @@
           "title": "References",
           "description": "The bom-refs to the assets securing this asset (e.g., algorithms, hardware, keys).",
           "items": {
-            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
           }
         }
       }

schema/2.0/model/cyclonedx-data-2.0.schema.json

@@ -53,9 +53,11 @@
       },
       "oneOf":[
         {
+          "properties": { "organization": true },
           "required": ["organization"]
         },
         {
+          "properties": { "contact": true },
           "required": ["contact"]
         }
       ]

schema/2.0/model/cyclonedx-declaration-2.0.schema.json

@@ -346,9 +346,11 @@
                 "additionalProperties": false,
                 "oneOf": [
                   {
-                    "required": ["signature"]
+                    "properties": { "signatures": true },
+                    "required": ["signatures"]
                   },
                   {
+                    "properties": { "externalReference": true, "organization": true },
                     "required": ["externalReference", "organization"]
                   }
                 ],