feat: decouple metadata from its component #379
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- add `component.manufacturer` - add `component.authors` - deprecate `component.author` in favour of `component.authors` and `component.manufacturer` - deprecate `metatada.manufature` in favour of `metadata.component.manufacturer` - deprecate `metadata.supplier` in favour of `metadata.component.supplier` Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
jkowalleck
changed the title
This was referenced Feb 14, 2024
This was
linked to
issues
Feb 14, 2024
jkowalleck
changed the title
|
originally i had planned
in a discussion with members of the CoreWorkingGroup, they told to do the following instead:
the proposal would cause breaking semantic changes. I do not want to bring any breaking change into the spec. |
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Are you referring to the original proposal, the proposal of the |
The latter one. The idea from the CWG would include breaking changes, literally. |
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
jkowalleck
changed the title
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
stevespringett
approved these changes
Feb 21, 2024
stevespringett
added
promote to tc54
This was referenced Feb 22, 2024
Merged
stevespringett
added a commit
that referenced
this pull request
Apr 9, 2024
## Added * Core enhancement: Attestation ([#192](#192) via [#348](#348)) * Core enhancement: Cryptography Bill of Materials — CBOM ([#171](#171), [#291](#291) via [#347](#347)) * Feature to express the URL to source distribution ([#98](#98) via [#269](#269)) * Feature to express the URL to RFC 9116 compliant documents ([#380](#380) via [#381](#381)) * Feature to express tags/keywords for services and components (via [#383](#383)) * Feature to express details for component authors ([#335](#335) via [#379](#379)) * Feature to express details for component and BOM manufacturer ([#346](#346) via [#379](#379)) * Feature to express communicate concluded values from observed evidences ([#411](#411) via [#412](#412)) * Features to express license acknowledgement ([#407](#407) via [#408](#408)) * Feature to express environmental consideration information for model cards ([#396](#396) via [#395](#395)) * Feature to express the address of organizational entities (via [#395](#395)) * Feature to express additional component identifiers: Universal Bill Of Receipts Identifier and Software Heritage persistent IDs ([#413](#413) via [#414](#414)) ## Fixed * Allow multiple evidence identities by XML/JSON schema ([#272](#272) via [#359](#359)) This was already correct via ProtoBuff schema. * Prevent empty `license` entities by XML schema ([#288](#288) via [#292](#292)) This was already correct in JSON/ProtoBuff schema. * Prevent empty or malformed `property` entities by JSON schema ([#371](#371) via [#375](#375)) This was already correct in XML/ProtoBuff schema. * Allow multiple `licenses` in `Metadata` by ProtoBuff schema ([#264](#264) via [#401](#401)) This was already correct in XML/JSON schema. ## Changed * Allow arbitrary `$schema` values by JSON schema ([#402](#402) via [#403](#403)) * Increased max length of `versionRange` (via [`3e01ce6`](3e01ce6)) * Harmonized length of `version` (via [#417](#417)) ## Deprecated * Data model "Component"'s field `author` was deprecated. (via [#379](#379)) Use field `authors` or field `manufacturer` instead. * Data model "Metadata"'s field `manufacture` was deprecated. ([#346](#346) via [#379](#379)) Use "Metadata"'s field `component`'s field `manufacturer` instead. - for XML: `/bom/metadata/component/manufacturer` - for JSON: `$.metadata.component.manufacturer` - for ProtoBuf: `Bom:metadata.component.manufacturer` ## Documentation * Centralize version and version-range (via [#322](#322)) * Streamlined SPDX expression related descriptions (via [#327](#327)) * Enhanced descriptions of `bom-ref`/`refType` ([#336](#336) via [#344](#344)) * Enhanced readability of enum documentation in JSON schema ([#361](#361) via [#362](#362)) * Fixed typo "compliment" -> "complement" (via [#369](#369)) * Added documentation for enum "ComponentScope"'s values in JSON schema ([#293](#293) via [`d92e58e`](d92e58e)) Texts were a taken from the existing ones in XML/ProtoBuff schema. * Added documentation for enum "TaskType"'s values ([#245](#245) via [#377](#377)) * Improve documentation for data model "Metadata"'s field `licenses` ([#273](#273) via [#378](#378)) * Added documentation for enum "MachineLearningApproachType"'s values ([#351](#351) via [#416](#416)) * Rephrased some texts here and there. ## Test data * Added test data for newly added use cases * Added quality assurance for our ProtoBuf schemas ([#384](#384) via [#385](#385))
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The following changes were made with the intent to not introduce breaking changes,
neither syntactic nor semantic(!)
Changes
component.manufactureras "OrganizationalEntity"-- fixes Should
manufacturebe a property ofcomponent, rather thanmetadata? #346component.authorsas list of "OrganizationalContact"-- fixes feat: multiple component authors #335
component.authorin favour ofcomponent.authorsandcomponent.manufacturerSo let's introduce dedicated fields for both of these:
Organizations are represented by the new
@.manufacturer&persons are represented by the new
@.authors.metatada.manufactureras "OrganizationalEntity"-- fixes Rename "manufacture" to "manufacturer"? #57
metatada.manufacturein favour ofmetadata.component.manufacturer-- fixes Should
manufacturebe a property ofcomponent, rather thanmetadata? #346TODO
Follow up tasks
component.author&component.manufacturerguides#19metadata.manufacturer&metadata.component.manufacturerguides#20metadata.manufacturesee BC: remove deprecated
metadata.manufacture#386component.authorsee BC: remove deprecated
component.author#387