Unified evidence model addressing #278, #333 and other concerns.

schema/2.0/model/cyclonedx-data-2.0.schema.json

@@ -672,6 +672,39 @@
           "PCI-DSS"
         ]
       },
+      "title": "Data flow direction",
+      "description": "Specifies the flow direction of the data. Direction is relative to the service."
+    },
+    "dataContents": {
+      "type": "object",
+      "title": "Data Contents",
+      "description": "The contents of the data, either embedded as an attachment or referenced by URL, optionally with integrity hashes and configuration properties.",
+      "additionalProperties": false,
+      "properties": {
+        "attachment": {
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment",
+          "title": "Data Attachment",
+          "description": "A way to include textual or encoded data."
+        },
+        "url": {
+          "type": "string",
+          "title": "Data URL",
+          "description": "The URL to where the data can be retrieved.",
+          "format": "iri-reference"
+        },
+        "hashes": {
+          "type": "array",
+          "title": "Hashes",
+          "description": "Cryptographic hashes of the referenced or attached data, so that a consumer can verify it is the same data recorded.",
+          "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/hash" }
+        },
+        "properties": {
+          "type": "array",
+          "title": "Configuration Properties",
+          "description": "Name-value parameters that describe or configure the data.",
+          "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/property" }
+        }
+      }
       "examples": [
         [
           "GDPR",

schema/2.0/model/cyclonedx-declaration-2.0.schema.json

@@ -234,23 +234,9 @@
                       "type": "string"
                     },
                     "contents": {
-                      "type": "object",
+                      "$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataContents",
                       "title": "Data Contents",
-                      "description": "The contents or references to the contents of the data being described.",
-                      "additionalProperties": false,
-                      "properties": {
-                        "attachment": {
-                          "title": "Data Attachment",
-                          "description": "A way to include textual or encoded data.",
-                          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment"
-                        },
-                        "url": {
-                          "type": "string",
-                          "title": "Data URL",
-                          "description": "The URL to where the data can be retrieved.",
-                          "format": "iri-reference"
-                        }
-                      }
+                      "description": "The contents or references to the contents of the data being described."
                     },
                     "classification": {
                       "$ref": "cyclonedx-data-2.0.schema.json#/$defs/dataClassification"