Skip to content

CBOM: add custom fingerprints#903

Open
bhess wants to merge 2 commits into
CycloneDX:2.0-devfrom
bhess:bhe-20-fingerprint
Open

CBOM: add custom fingerprints#903
bhess wants to merge 2 commits into
CycloneDX:2.0-devfrom
bhess:bhe-20-fingerprint

Conversation

@bhess
Copy link
Copy Markdown
Contributor

@bhess bhess commented Apr 2, 2026

Extend the fingerprint definition in cyclonedx-cryptography-2.0.schema.json to support custom fingerprint algorithms alongside standard hash algorithms.

Changes

  • Replace the flat $ref: hash on certificateProperties.fingerprint and relatedCryptoMaterialProperties.fingerprint with a single central $defs/fingerprint definition
  • $defs/fingerprint uses oneOf with two branches:
    • Standard Hash — alg + content (refs to existing hashAlgorithm / hashValue); fully backward compatible
    • Custom Fingerprint — customAlg + customContent for non-standard algorithms

Backward Compatibility

Existing documents with {"alg": "SHA-256", "content": "..."} satisfy the Standard Hash branch unchanged.

@bhess
Adds custom fingerprints
ebcf4c2 
Signed-off-by: Basil Hess <bhe@zurich.ibm.com>
@bhess bhess requested a review from a team as a code owner April 2, 2026 15:23
@bhess bhess added the cap: cryptography Capability: Cryptography (CBOM) label Apr 2, 2026
@stevespringett stevespringett added request for comment RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration proposed core enhancement labels Apr 16, 2026
@stevespringett stevespringett added this to the 2.0 milestone Apr 16, 2026
@jkowalleck
Copy link
Copy Markdown
Member

jkowalleck commented Apr 16, 2026 •
edited
Loading

RFC notice sent on May 04, 2026

Public RFC period ends June 01, 2026

jkowalleck
jkowalleck requested changes May 12, 2026
View reviewed changes
Comment thread schema/2.0/model/cyclonedx-cryptography-2.0.schema.json
Comment thread schema/2.0/model/cyclonedx-cryptography-2.0.schema.json
jkowalleck
jkowalleck reviewed May 12, 2026
View reviewed changes
Comment thread schema/2.0/model/cyclonedx-cryptography-2.0.schema.json
@jkowalleck
Copy link
Copy Markdown
Member

jkowalleck commented May 15, 2026 •
edited
Loading

just some remarks on the schema docs.
Technically, this looks solid. 👍

PS: schema docs were altered as needed. all good now.

@stevespringett stevespringett added RFC vote accepted promote to tc54 Promote to Ecma Technical Committee 54 labels May 15, 2026
@bhess
Add title/description to hash in common schema
d54f9a0 
Signed-off-by: Basil Hess <bhe@zurich.ibm.com>
@stevespringett stevespringett added tc54 reviewed Ecma TC54 has reviewed the feature candidate tc54 accepted Ecma TC54 has accepted the feature candidate labels May 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jkowalleck jkowalleck jkowalleck approved these changes

@coderpatros coderpatros Awaiting requested review from coderpatros

@stevespringett stevespringett Awaiting requested review from stevespringett

@DarthHater DarthHater Awaiting requested review from DarthHater

@mrutkows mrutkows Awaiting requested review from mrutkows

+1 more reviewer

@Mehrn0ush Mehrn0ush Mehrn0ush approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@stevespringett stevespringett

Labels

cap: cryptography Capability: Cryptography (CBOM) promote to tc54 Promote to Ecma Technical Committee 54 proposed core enhancement request for comment RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration RFC vote accepted tc54 accepted Ecma TC54 has accepted the feature candidate tc54 reviewed Ecma TC54 has reviewed the feature candidate

Projects

None yet

Milestone

2.0

Development

Successfully merging this pull request may close these issues.

4 participants

@bhess @jkowalleck @stevespringett @Mehrn0ush