Skip to content

CBOM: add custom fingerprints#903

Open
bhess wants to merge 1 commit intoCycloneDX:2.0-devfrom
bhess:bhe-20-fingerprint
Open

CBOM: add custom fingerprints#903
bhess wants to merge 1 commit intoCycloneDX:2.0-devfrom
bhess:bhe-20-fingerprint

Conversation

@bhess
Copy link
Copy Markdown
Contributor

@bhess bhess commented Apr 2, 2026

Extend the fingerprint definition in cyclonedx-cryptography-2.0.schema.json to support custom fingerprint algorithms alongside standard hash algorithms.

Changes

  • Replace the flat $ref: hash on certificateProperties.fingerprint and relatedCryptoMaterialProperties.fingerprint with a single central $defs/fingerprint definition
  • $defs/fingerprint uses oneOf with two branches:
    • Standard Hashalg + content (refs to existing hashAlgorithm / hashValue); fully backward compatible
    • Custom FingerprintcustomAlg + customContent for non-standard algorithms

Backward Compatibility

Existing documents with {"alg": "SHA-256", "content": "..."} satisfy the Standard Hash branch unchanged.

Signed-off-by: Basil Hess <[email protected]>
@bhess bhess requested a review from a team as a code owner April 2, 2026 15:23
@bhess bhess added the cap: cryptography Capability: Cryptography (CBOM) label Apr 2, 2026
@stevespringett stevespringett added request for comment RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration proposed core enhancement labels Apr 16, 2026
@stevespringett stevespringett added this to the 2.0 milestone Apr 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cap: cryptography Capability: Cryptography (CBOM) proposed core enhancement request for comment RFC notice sent A public RFC notice was distributed to the CycloneDX mailing list for consideration

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants