[2.0]: Harmonize BOM metadata authorship with the party model
@jkowalleck is already working on this.
Since Sep 10, 2026.
Assessment
This issue has not been assessed yet.
Description
Describe the feature
The 2.0 draft currently has two parallel representations of "who made this":
- Components use the new party model —
components[].parties[]with
roles[](manufacturer,author,supplier, …) and an
organization/person/system/personaidentity
(cyclonedx-party-2.0.schema.json, introduced in #930). - BOM metadata still uses the 1.x discrete fields —
metadata.manufacturer(organizationalEntity),metadata.authors[]
(organizationalContact), andmetadata.supplier
(cyclonedx-metadata-2.0.schema.json).
Possible solutions
Replace metadata.manufacturer / metadata.authors / metadata.supplier
with metadata.parties[].
- Dominant language
- XSLT
- Stars
- 551
- Forks
- 93
- Avg merge
- 4h 51m
- Merged PRs (30d)
- 42
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from CycloneDX/specification
-
Response vs Responce Open
Difficulty 1/5 Under an hour Newbie friendliness 68/100
CycloneDX/specification#1121 ·
-
defect documentation
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
CycloneDX/specification#1115 ·
-
cap: cryptography-registry
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
CycloneDX/specification#1098 ·
-
defect
Difficulty 1/5 Under an hour Newbie friendliness 91/100
CycloneDX/specification#1045 · 2 comments ·
-
CDX 2.0 documentation ready for review
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
CycloneDX/specification#1035 ·