diff --git a/schema/bom-1.7.proto b/schema/bom-1.7.proto
index 6541354e..44d2ea74 100644
--- a/schema/bom-1.7.proto
+++ b/schema/bom-1.7.proto
@@ -37,12 +37,14 @@ message Bom {
repeated Annotation annotations = 11;
// Specifies optional, custom, properties
repeated Property properties = 12;
- // Describes how a component or service was manufactured or deployed. This is achieved through the use of formulas, workflows, tasks, and steps, which declare the precise steps to reproduce along with the observed formulas describing the steps which transpired in the manufacturing process.
+ // Describes the formulation of any referencable object within the BOM, including components, services, metadata, declarations, or the BOM itself. This may encompass how the object was created, assembled, deployed, tested, certified, or otherwise brought into its present form. Common examples include software build pipelines, deployment processes, AI/ML model training, cryptographic key generation or certification, and third-party audits. Processes are modeled using declared and observed formulas, composed of workflows, tasks, and individual steps.
repeated Formula formulation = 13;
// The list of declarations which describe the conformance to standards. Each declaration may include attestations, claims, and evidence.
repeated Declarations declarations = 14;
// A collection of reusable objects that are defined and may be used elsewhere in the BOM.
repeated Definition definitions = 15;
+ // A collection of attributions indicating which entity supplied information for specific fields within the BOM.
+ repeated Citation citations = 16;
}
enum Classification {
@@ -313,7 +315,7 @@ enum ExternalReferenceType {
EXTERNAL_REFERENCE_TYPE_CONFIGURATION = 35;
// Information used to substantiate a claim.
EXTERNAL_REFERENCE_TYPE_EVIDENCE = 36;
- // Describes how a component or service was manufactured or deployed.
+ // Describes the formulation of any referencable object within the BOM, including components, services, metadata, declarations, or the BOM itself.
EXTERNAL_REFERENCE_TYPE_FORMULATION = 37;
// The location where the source code distributable can be obtained. This is often an archive format such as zip or tar.gz. The source-distribution type complements the use of the version control (vcs) type.
EXTERNAL_REFERENCE_TYPE_SOURCE_DISTRIBUTION = 38;
@@ -331,6 +333,8 @@ enum ExternalReferenceType {
EXTERNAL_REFERENCE_TYPE_PATENT_FAMILY = 44;
// References assertions made regarding patents associated with a component or service. Assertions distinguish between ownership, licensing, and other relevant interactions with patents.
EXTERNAL_REFERENCE_TYPE_PATENT_ASSERTION = 45;
+ // A reference to external citations applicable to the object identified by this BOM entry or the BOM itself. When used with a BOM-Link, this allows offloading citations into a separate CycloneDX BOM.
+ EXTERNAL_REFERENCE_TYPE_CITATION = 46;
}
enum HashAlg {
@@ -2613,3 +2617,39 @@ enum PatentAssertionType {
// The patent or patent family is being used under a research or evaluation license.
PATENT_ASSERTION_TYPE_RESEARCH_OR_EVALUATION = 8;
}
+
+// Details a specific attribution of data within the BOM to a contributing entity or process.
+message Citation {
+ message Pointers {
+ // Users of other serialisation formats (e.g. XML) shall use the JSON Pointer format to ensure consistent field referencing across representations.
+ // Must contain at least 1 item.
+ repeated string pointer = 1;
+ }
+ message Expressions {
+ // Specifies a path expression used to locate a value within a BOM. The expression syntax shall conform to the format of the BOM's serialisation.
+ // Use [JSONPath](https://datatracker.ietf.org/doc/html/rfc9535) for JSON, [XPath](https://www.w3.org/TR/xpath/) for XML, and default to JSONPath for Protocol Buffers unless otherwise specified.
+ // Implementers shall ensure the expression is valid within the context of the applicable serialisation format. Use either "pointer" or "expression" but not both in this object.
+ // Must contain at least 1 item.
+ repeated string expression = 1;
+ }
+
+ // Optional unique identifier for the citation
+ optional string bom_ref = 1;
+ // Exactly one of the "pointers" or "expressions" elements must be present.
+ oneof target {
+ // One or more JSON Pointers(https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM fields to which the attribution applies.
+ Pointers pointers = 2;
+ // One or more path expressions used to locate values within a BOM.
+ Expressions expressions = 3;
+ }
+ // Timestamp when the attribution was made or the information was supplied.
+ google.protobuf.Timestamp timestamp = 4;
+ // The `bom-ref` of an object, such as a component, service, tool, organisational entity, or person that supplied the cited information.
+ // At least one of the "attributed_to" or "process" elements must be present.
+ optional string attributed_to = 5;
+ // The `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.
+ // At least one of the "attributed_to" or "process" elements must be present.
+ optional string process = 6;
+ // An optional description or comment about the context or quality of the data attribution.
+ optional string note = 7;
+}
diff --git a/schema/bom-1.7.schema.json b/schema/bom-1.7.schema.json
index af102f0b..a682e76c 100644
--- a/schema/bom-1.7.schema.json
+++ b/schema/bom-1.7.schema.json
@@ -100,7 +100,7 @@
"items": {"$ref": "#/definitions/formula"},
"uniqueItems": true,
"title": "Formulation",
- "description": "Describes how a component or service was manufactured or deployed. This is achieved through the use of formulas, workflows, tasks, and steps, which declare the precise steps to reproduce along with the observed formulas describing the steps which transpired in the manufacturing process."
+ "description": "Describes the formulation of any referencable object within the BOM, including components, services, metadata, declarations, or the BOM itself. This may encompass how the object was created, assembled, deployed, tested, certified, or otherwise brought into its present form. Common examples include software build pipelines, deployment processes, AI/ML model training, cryptographic key generation or certification, and third-party audits. Processes are modeled using declared and observed formulas, composed of workflows, tasks, and individual steps."
},
"declarations": {
"type": "object",
@@ -527,6 +527,13 @@
}
}
},
+ "citations": {
+ "type": "array",
+ "items": {"$ref": "#/definitions/citation"},
+ "uniqueItems": true,
+ "title": "Citations",
+ "description": "A collection of attributions indicating which entity supplied information for specific fields within the BOM."
+ },
"properties": {
"type": "array",
"title": "Properties",
@@ -1900,6 +1907,7 @@
"patent",
"patent-family",
"patent-assertion",
+ "citation",
"other"
],
"meta:enum": {
@@ -1925,7 +1933,7 @@
"log": "A record of events that occurred in a computer system or application, such as problems, errors, or information on current operations.",
"configuration": "Parameters or settings that may be used by other components or services.",
"evidence": "Information used to substantiate a claim.",
- "formulation": "Describes how a component or service was manufactured or deployed.",
+ "formulation": "Describes the formulation of any referencable object within the BOM, including components, services, metadata, declarations, or the BOM itself.",
"attestation": "Human or machine-readable statements containing facts, evidence, or testimony.",
"threat-model": "An enumeration of identified weaknesses, threats, and countermeasures, dataflow diagram (DFD), attack tree, and other supporting documentation in human-readable or machine-readable format.",
"adversary-model": "The defined assumptions, goals, and capabilities of an adversary.",
@@ -1948,6 +1956,7 @@
"patent": "References information about patents which may be defined in human-readable documents or in machine-readable formats such as CycloneDX or ST.96. For detailed patent information or to reference the information provided directly by patent offices, it is recommended to leverage standards from the World Intellectual Property Organization (WIPO) such as [ST.96](https://www.wipo.int/standards/en/st96).",
"patent-family": "References information about a patent family which may be defined in human-readable documents or in machine-readable formats such as CycloneDX or ST.96. A patent family is a group of related patent applications or granted patents that cover the same or similar invention. For detailed patent family information or to reference the information provided directly by patent offices, it is recommended to leverage standards from the World Intellectual Property Organization (WIPO) such as [ST.96](https://www.wipo.int/standards/en/st96).",
"patent-assertion" : "References assertions made regarding patents associated with a component or service. Assertions distinguish between ownership, licensing, and other relevant interactions with patents.",
+ "citation": "A reference to external citations applicable to the object identified by this BOM entry or the BOM itself. When used with a BOM-Link, this allows offloading citations into a separate CycloneDX BOM.",
"other": "Use this if no other types accurately describe the purpose of the external reference."
}
},
@@ -6105,6 +6114,75 @@
"$ref": "#/definitions/patentFilingDate"
}
}
+ },
+ "citation": {
+ "type": "object",
+ "title": "Citation",
+ "description": "Details a specific attribution of data within the BOM to a contributing entity or process.",
+ "additionalProperties": false,
+ "properties": {
+ "bom-ref": {
+ "$ref": "#/definitions/refType",
+ "title": "BOM Reference"
+ },
+ "pointers": {
+ "type": "array",
+ "items": {
+ "type": "string",
+ "title": "Field Reference",
+ "description": "A [JSON Pointer](https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM field to which the attribution applies.\nUsers of other serialisation formats (e.g. XML) shall use the JSON Pointer format to ensure consistent field referencing across representations."
+ },
+ "minItems": 1,
+ "title": "Field References",
+ "description": "One or more [JSON Pointers](https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM fields to which the attribution applies.\nExactly one of the \"pointers\" or \"expressions\" elements must be present."
+ },
+ "expressions": {
+ "type": "array",
+ "items": {
+ "type": "string",
+ "title": "Path Expression",
+ "description": "Specifies a path expression used to locate a value within a BOM. The expression syntax shall conform to the format of the BOM's serialisation.\nUse [JSONPath](https://datatracker.ietf.org/doc/html/rfc9535) for JSON, [XPath](https://www.w3.org/TR/xpath/) for XML, and default to JSONPath for Protocol Buffers unless otherwise specified.\nImplementers shall ensure the expression is valid within the context of the applicable serialisation format."
+ },
+ "minItems": 1,
+ "title": "Path Expressions",
+ "description": "One or more path expressions used to locate values within a BOM.\nExactly one of the \"pointers\" or \"expressions\" elements must be present."
+ },
+ "timestamp": {
+ "type": "string",
+ "format": "date-time",
+ "title": "Timestamp",
+ "description": "The date and time when the attribution was made or the information was supplied."
+ },
+ "attributedTo": {
+ "$ref": "#/definitions/refLinkType",
+ "title": "Attributed To",
+ "description": "The `bom-ref` of an object, such as a component, service, tool, organisational entity, or person that supplied the cited information.\nAt least one of the \"attributedTo\" or \"process\" elements must be present."
+ },
+ "process": {
+ "$ref": "#/definitions/refLinkType",
+ "title": "Process Reference",
+ "description": "The `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.\nAt least one of the \"attributedTo\" or \"process\" elements must be present."
+ },
+ "note": {
+ "type": "string",
+ "title": "Note",
+ "description": "An optional description or comment about the context or quality of the data attribution."
+ },
+ "signature": {
+ "$ref": "#/definitions/signature",
+ "title": "Signature",
+ "description": "An optional digital signature verifying the authenticity or integrity of the attribution."
+ }
+ },
+ "required": ["timestamp"],
+ "anyOf": [
+ { "required": ["attributedTo"] },
+ { "required": ["process"] }
+ ],
+ "oneOf": [
+ { "required": ["pointers"] },
+ { "required": ["expressions"] }
+ ]
}
}
}
diff --git a/schema/bom-1.7.xsd b/schema/bom-1.7.xsd
index ae0112a2..9f8682c9 100644
--- a/schema/bom-1.7.xsd
+++ b/schema/bom-1.7.xsd
@@ -1669,7 +1669,7 @@ limitations under the License.
- Describes how a component or service was manufactured or deployed.
+ Describes the formulation of any referencable object within the BOM, including components, services, metadata, declarations, or the BOM itself.
@@ -1782,6 +1782,11 @@ limitations under the License.
References assertions made regarding patents associated with a component or service. Assertions distinguish between ownership, licensing, and other relevant interactions with patents.
+
+
+ A reference to external citations applicable to the object identified by this BOM entry or the BOM itself. When used with a BOM-Link, this allows offloading citations into a separate CycloneDX BOM.
+
+
Use this if no other types accurately describe the purpose of the external reference
@@ -5216,9 +5221,13 @@ limitations under the License.
- Describes how a component or service was manufactured or deployed. This is achieved through the use
- of formulas, workflows, tasks, and steps, which declare the precise steps to reproduce along with the
- observed formulas describing the steps which transpired in the manufacturing process.
+ Describes the formulation of any referencable object within the BOM,
+ including components, services, metadata, declarations, or the BOM itself. This may
+ encompass how the object was created, assembled, deployed, tested, certified, or otherwise
+ brought into its present form. Common examples include software build pipelines,
+ deployment processes, AI/ML model training, cryptographic key generation or certification,
+ and third-party audits. Processes are modeled using declared and observed formulas,
+ composed of workflows, tasks, and individual steps.
@@ -8859,6 +8868,133 @@ limitations under the License.
+
+
+
+
+
+ Details a specific attribution of data within the BOM to a contributing entity or process.
+
+
+
+
+
+
+
+
+
+ Details a specific attribution of data within the BOM to a contributing entity or process.
+
+
+
+
+
+ Exactly one of the "pointers" or "expressions" elements must be present.
+
+
+
+
+
+
+ One or more JSON Pointers(https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM fields to which the attribution applies.
+
+
+
+
+
+
+
+ A JSON Pointer(https://datatracker.ietf.org/doc/html/rfc6901) identifying the BOM field to which the attribution applies.
+ Users of other serialisation formats (e.g. XML) shall use the JSON Pointer format to ensure consistent field referencing across representations.
+
+
+
+
+
+
+
+
+
+ One or more path expressions used to locate values within a BOM.
+
+
+
+
+
+
+
+ Specifies a path expression used to locate a value within a BOM. The expression syntax shall conform to the format of the BOM's serialisation.
+ Use [JSONPath](https://datatracker.ietf.org/doc/html/rfc9535) for JSON, [XPath](https://www.w3.org/TR/xpath/) for XML, and default to JSONPath for Protocol Buffers unless otherwise specified.
+ Implementers shall ensure the expression is valid within the context of the applicable serialisation format.
+
+
+
+
+
+
+
+
+
+
+ The date and time when the attribution was made or the information was supplied.
+
+
+
+
+
+
+ The `bom-ref` of an object, such as a component, service, tool, organisational entity, or person that supplied the cited information.
+ At least one of the "attributedTo" or "process" elements must be present.
+
+
+
+
+
+
+ The `bom-ref` to a process (such as a formula, workflow, task, or step) defined in the `formulation` section that executed or generated the attributed data.
+ At least one of the "attributedTo" or "process" elements must be present.
+
+
+
+
+
+
+ An optional description or comment about the context or quality of the data attribution.
+
+
+
+
+
+
+ Allows any undeclared elements as long as the elements are placed in a different namespace.
+
+
+
+
+
+
+
+
+ An optional identifier which can be used to reference the object elsewhere in the BOM.
+ Uniqueness is enforced within all elements and children of the root-level bom element.
+
+
+
+
+
+ User-defined attributes may be used on this element as long as they
+ do not have the same name as an existing attribute used by the schema.
+
+
+
+
@@ -8919,10 +9055,13 @@ limitations under the License.
- Describes how a component or service was manufactured or deployed. This is
- achieved through the use of formulas, workflows, tasks, and steps, which declare the precise
- steps to reproduce along with the observed formulas describing the steps which transpired
- in the manufacturing process.
+ Describes the formulation of any referencable object within the BOM,
+ including components, services, metadata, declarations, or the BOM itself. This may
+ encompass how the object was created, assembled, deployed, tested, certified, or otherwise
+ brought into its present form. Common examples include software build pipelines,
+ deployment processes, AI/ML model training, cryptographic key generation or certification,
+ and third-party audits. Processes are modeled using declared and observed formulas,
+ composed of workflows, tasks, and individual steps.
@@ -8940,6 +9079,11 @@ limitations under the License.
+
+
+ A collection of attributions indicating which entity supplied information for specific fields within the BOM.
+
+
diff --git a/tools/src/test/resources/1.7/invalid-citations-1.7.json b/tools/src/test/resources/1.7/invalid-citations-1.7.json
new file mode 100644
index 00000000..d93cb908
--- /dev/null
+++ b/tools/src/test/resources/1.7/invalid-citations-1.7.json
@@ -0,0 +1,40 @@
+{
+ "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
+ "bomFormat": "CycloneDX",
+ "specVersion": "1.7",
+ "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
+ "version": 1,
+ "metadata": {
+ "timestamp": "2025-05-01T14:23:00Z"
+ },
+ "components": [
+ {
+ "type": "library",
+ "bom-ref": "component-1",
+ "name": "example-lib",
+ "version": "1.2.3",
+ "licenses": [
+ {
+ "license": {
+ "id": "Apache-2.0"
+ }
+ }
+ ]
+ }
+ ],
+ "citations": [
+ {
+ "bom-ref": "citation-1",
+ "pointers": [ "/components/0/name" ],
+ "timestamp": "2025-05-01T14:00:00Z",
+ "note": "Should have at least one of the following property sets: property 'attributedTo' or property 'process'"
+ },
+ {
+ "bom-ref": "citation-1",
+ "pointers": [ "/components/0/name" ],
+ "expressions": [ "$..[?(@.bom-ref=='component-1')].version" ],
+ "timestamp": "2025-05-01T14:00:00Z",
+ "note": "Should not have both a pointer and expression."
+ }
+ ]
+}
diff --git a/tools/src/test/resources/1.7/invalid-citations-1.7.textproto b/tools/src/test/resources/1.7/invalid-citations-1.7.textproto
new file mode 100644
index 00000000..4617b8f0
--- /dev/null
+++ b/tools/src/test/resources/1.7/invalid-citations-1.7.textproto
@@ -0,0 +1,48 @@
+# proto-file: schema/bom-1.7.proto
+# proto-message: Bom
+
+spec_version: "1.7"
+serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
+version: 1
+
+metadata {
+ timestamp {
+ seconds: 1754424907
+ nanos: 0
+ }
+}
+
+components {
+ type: CLASSIFICATION_LIBRARY
+ bom_ref: "component-1"
+ name: "example-lib"
+ version: "1.2.3"
+ licenses {
+ license {
+ id: "Apache-2.0"
+ }
+ }
+}
+
+## !! NO formal check possible
+#citations {
+# bom_ref: "citation-1"
+# pointers: { pointer: "/components/0/name" }
+# timestamp {
+# seconds: 1746108000
+# nanos: 0
+# }
+# note: "Should have at least one of the following property sets: property 'attributedTo' or property 'process'"
+#}
+
+
+citations {
+ bom_ref: "citation-1"
+ pointers: { pointer: "/components/0/name" }
+ expressions: { expression: "$..[?(bom_ref=='component-1')].version" }
+ timestamp {
+ seconds: 1746108000
+ nanos: 0
+ }
+ note: "Should not have both a pointer and expression."
+}
diff --git a/tools/src/test/resources/1.7/invalid-citations-1.7.xml b/tools/src/test/resources/1.7/invalid-citations-1.7.xml
new file mode 100644
index 00000000..55962ab3
--- /dev/null
+++ b/tools/src/test/resources/1.7/invalid-citations-1.7.xml
@@ -0,0 +1,99 @@
+
+
+
+ 2025-05-01T14:23:00Z
+
+
+ Alice Example
+ alice@example.com
+
+
+
+
+
+ example-lib
+ 1.2.3
+
+
+ Apache-2.0
+
+
+
+
+
+
+
+
+ My Scan Tool
+
+
+
+
+ 259bae74-5ec4-4de8-9386-c91b1f7719b8
+ My workflow
+
+
+ 6d75f8d6-a008-41cf-8b65-c4129fc249f9
+ License scan of the source files using OpenSourceScanner v2.1
+
+ scan
+
+
+
+ dfc0268a-89cb-4823-bb88-84115a06b64d
+ License scan of the source files using [REDACTED]
+
+ scan
+
+
+
+
+ scan
+
+
+
+
+
+
+
+
+
+ /components/0/licenses/0/license/id
+
+ 2025-05-01T14:05:00Z
+ person-1
+ scan-tool-1
+ Should have at max one 'attributedTo'
+
+
+
+ /components/0/licenses/0/license/id
+
+ 2025-05-01T14:05:00Z
+ task-license-scan
+ task-license-scan-2
+ Should have at max one 'process'
+
+
+
+ /components/0/licenses/0/license/id
+
+
+ //*[@bom-ref='component-1']/version
+
+ 2025-05-01T14:05:00Z
+ task-license-scan
+ Should not have both a pointer and expression.
+
+
+
diff --git a/tools/src/test/resources/1.7/valid-citations-1.7.json b/tools/src/test/resources/1.7/valid-citations-1.7.json
new file mode 100644
index 00000000..50a1dddf
--- /dev/null
+++ b/tools/src/test/resources/1.7/valid-citations-1.7.json
@@ -0,0 +1,91 @@
+{
+ "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
+ "bomFormat": "CycloneDX",
+ "specVersion": "1.7",
+ "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
+ "version": 1,
+ "metadata": {
+ "timestamp": "2025-05-01T14:23:00Z",
+ "authors": [
+ {
+ "bom-ref": "person-1",
+ "name": "Alice Example",
+ "email": "alice@example.com"
+ }
+ ]
+ },
+ "components": [
+ {
+ "type": "library",
+ "bom-ref": "component-1",
+ "name": "example-lib",
+ "version": "1.2.3",
+ "licenses": [
+ {
+ "license": {
+ "id": "Apache-2.0"
+ }
+ }
+ ]
+ }
+ ],
+ "citations": [
+ {
+ "bom-ref": "citation-1",
+ "pointers": [ "/components/0/name" ],
+ "timestamp": "2025-05-01T14:00:00Z",
+ "attributedTo": "person-1",
+ "note": "Manually entered by Alice Example - with `attributedTo`"
+ },
+ {
+ "bom-ref": "citation-2",
+ "pointers": [ "/components/0/name" ],
+ "timestamp": "2025-05-01T14:00:00Z",
+ "process": "task-license-scan",
+ "note": "Semi-manually entered by Alice Example - with `process`"
+ },
+ {
+ "bom-ref": "citation-3",
+ "expressions": [ "$..[?(@.bom-ref=='component-1')].version" ],
+ "timestamp": "2025-05-01T14:00:00Z",
+ "process": "task-license-scan",
+ "note": "Semi-manually entered by Alice Example - with `process`"
+ },
+ {
+ "bom-ref": "citation-4",
+ "expressions": [ "$.components[*].licenses[*].license.id" ],
+ "timestamp": "2025-05-01T14:05:00Z",
+ "attributedTo": "scan-tool-1",
+ "process": "task-license-scan",
+ "note": "Auto-detected by license scanner tool - with both, 'attributedTo' and 'process'"
+ }
+ ],
+ "formulation": [
+ {
+ "components": [
+ {
+ "bom-ref": "scan-tool-1",
+ "type": "application",
+ "name": "My Scan Tool"
+ }
+ ],
+ "bom-ref": "workflow-1",
+ "workflows": [
+ {
+ "bom-ref": "workflow-1",
+ "uid": "259bae74-5ec4-4de8-9386-c91b1f7719b8",
+ "name": "My workflow",
+ "tasks": [
+ {
+ "bom-ref": "task-license-scan",
+ "uid": "6d75f8d6-a008-41cf-8b65-c4129fc249f9",
+ "taskTypes": [ "scan" ],
+ "description": "License scan of the source files using OpenSourceScanner v2.1"
+ }
+ ],
+ "taskTypes": [ "scan" ]
+ }
+ ]
+ }
+ ]
+}
diff --git a/tools/src/test/resources/1.7/valid-citations-1.7.textproto b/tools/src/test/resources/1.7/valid-citations-1.7.textproto
new file mode 100644
index 00000000..09d7c072
--- /dev/null
+++ b/tools/src/test/resources/1.7/valid-citations-1.7.textproto
@@ -0,0 +1,95 @@
+# proto-file: schema/bom-1.7.proto
+# proto-message: Bom
+
+spec_version: "1.7"
+version: 1
+serial_number: "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
+
+metadata {
+ timestamp {
+ seconds: 1746118980
+ nanos: 0
+ }
+ authors {
+ bom_ref: "person-1"
+ name: "Alice Example"
+ email: "alice@example.com"
+ }
+}
+
+components {
+ bom_ref: "component-1"
+ type: CLASSIFICATION_LIBRARY
+ name: "example-lib"
+ version: "1.2.3"
+ licenses {
+ license {
+ id: "Apache-2.0"
+ }
+ }
+}
+
+citations [
+ {
+ bom_ref: "citation-1"
+ pointers: { pointer: "/components/0/name" }
+ timestamp: {
+ seconds: 1746108000
+ nanos: 0
+ }
+ attributed_to: "person-1"
+ note: "Manually entered by Alice Example"
+ },
+ {
+ bom_ref: "citation-2"
+ pointers: { pointer: "/components/0/name" }
+ timestamp: {
+ seconds: 1746108000
+ nanos: 0
+ }
+ process: "task-license-scan"
+ note: "Semi-manually entered by Alice Example - with `process`"
+ },
+ {
+ bom_ref: "citation-3"
+ expressions: { expression: "$..[?(bom_ref=='component-1')].version" }
+ timestamp: {
+ seconds: 1746108000
+ nanos: 0
+ }
+ process: "task-license-scan"
+ note: "Semi-manually entered by Alice Example - with `process`"
+ },
+ {
+ bom_ref: "citation-4"
+ expressions: { expression: "$.components[*].licenses[*].license.id" }
+ timestamp: {
+ seconds: 1746108000
+ nanos: 0
+ }
+ attributed_to: "scan-tool-1"
+ process: "task-license-scan"
+ note: "Auto-detected by license scanner tool"
+ }
+]
+
+formulation {
+ bom_ref: "workflow-1"
+ components {
+ bom_ref: "scan-tool-1"
+ type: CLASSIFICATION_APPLICATION
+ name: "My Scan Tool"
+ }
+ workflows {
+ bom_ref: "workflow-1"
+ uid: "259bae74-5ec4-4de8-9386-c91b1f7719b8"
+ name: "My workflow"
+ taskTypes: TASK_TYPE_SCAN
+ tasks {
+ bom_ref: "task-license-scan"
+ uid: "6d75f8d6-a008-41cf-8b65-c4129fc249f9"
+ taskTypes: TASK_TYPE_SCAN
+ description: "License scan of the source files using OpenSourceScanner v2.1"
+ }
+ }
+}
diff --git a/tools/src/test/resources/1.7/valid-citations-1.7.xml b/tools/src/test/resources/1.7/valid-citations-1.7.xml
new file mode 100644
index 00000000..599784ba
--- /dev/null
+++ b/tools/src/test/resources/1.7/valid-citations-1.7.xml
@@ -0,0 +1,87 @@
+
+
+
+ 2025-05-01T14:23:00Z
+
+
+ Alice Example
+ alice@example.com
+
+
+
+
+
+ example-lib
+ 1.2.3
+
+
+ Apache-2.0
+
+
+
+
+
+
+
+
+ My Scan Tool
+
+
+
+
+ 259bae74-5ec4-4de8-9386-c91b1f7719b8
+ My workflow
+
+
+ 6d75f8d6-a008-41cf-8b65-c4129fc249f9
+ License scan of the source files using OpenSourceScanner v2.1
+
+ scan
+
+
+
+
+ scan
+
+
+
+
+
+
+
+
+ /components/0/name
+
+ 2025-05-01T14:00:00Z
+ person-1
+ Manually entered by Alice Example - with `attributedTo`
+
+
+
+ /components/0/name
+
+ 2025-05-01T14:00:00Z
+ person-1
+ Semi-manually entered by Alice Example - with `process`
+
+
+
+ //*[@bom-ref='component-1']/version
+
+ 2025-05-01T14:00:00Z
+ person-1
+ Semi-manually entered by Alice Example - with `process`
+
+
+
+ /components/component/licenses/license/id
+
+ 2025-05-01T14:05:00Z
+ scan-tool-1
+ task-license-scan
+ Auto-detected by license scanner tool - with both, 'attributedTo' and 'process'
+
+
+