Describe the defect
The CycloneDX 1.7 JSON schema defines
cryptoProperties.protocolProperties.relatedCryptographicAssets and marks the
older cryptoRefArray property as deprecated in favor of it. The 1.7 XML
schema, however, only allows repeated cryptoRef children under
protocolProperties; it does not define relatedCryptographicAssets there.
This makes the JSON and XML representations inconsistent. A 1.7 document with
one protocol-related cryptographic asset passes the JSON schema, but the
equivalent XML is rejected with:
Element '{http://cyclonedx.org/schema/bom/1.7}relatedCryptographicAssets':
This element is not expected. Expected is (... cryptoRef).
Expected behavior: the 1.7 XSD should permit the preferred
relatedCryptographicAssets representation for protocol properties, matching
the JSON schema and the corresponding certificate/material representations.
Additional context
- Current specification
master checked at commit
e02a34ae42a48239f54e04f75280b9000b29f1fb.
- The
protocolProperties section in the vendored XSD used by
cyclonedx-python-lib is byte-for-byte identical to the current
specification section and has the same omission.
- No open or closed specification issue/PR matching
relatedCryptographicAssets + protocolProperties was found before filing.
- This was found while reviewing
cyclonedx-python-lib#1016,
where the model can now round-trip the field but strict XML schema validation
exposes the specification mismatch.
Report prepared with OpenAI Codex assistance and independently reproduced by
the submitter.
Describe the defect
The CycloneDX 1.7 JSON schema defines
cryptoProperties.protocolProperties.relatedCryptographicAssetsand marks theolder
cryptoRefArrayproperty as deprecated in favor of it. The 1.7 XMLschema, however, only allows repeated
cryptoRefchildren underprotocolProperties; it does not definerelatedCryptographicAssetsthere.This makes the JSON and XML representations inconsistent. A 1.7 document with
one protocol-related cryptographic asset passes the JSON schema, but the
equivalent XML is rejected with:
Expected behavior: the 1.7 XSD should permit the preferred
relatedCryptographicAssetsrepresentation for protocol properties, matchingthe JSON schema and the corresponding certificate/material representations.
Additional context
masterchecked at commite02a34ae42a48239f54e04f75280b9000b29f1fb.protocolPropertiessection in the vendored XSD used bycyclonedx-python-libis byte-for-byte identical to the currentspecification section and has the same omission.
relatedCryptographicAssets+protocolPropertieswas found before filing.cyclonedx-python-lib#1016,
where the model can now round-trip the field but strict XML schema validation
exposes the specification mismatch.
Report prepared with OpenAI Codex assistance and independently reproduced by
the submitter.