Skip to content

2.0 dev fix bundler result schema name - #1027

Open
jkowalleck wants to merge 2 commits into
2.0-devfrom
2.0-dev_fix-bundler-result-schema-name
Open

2.0 dev fix bundler result schema name#1027
jkowalleck wants to merge 2 commits into
2.0-devfrom
2.0-dev_fix-bundler-result-schema-name

Conversation

@jkowalleck

Copy link
Copy Markdown
Member

the bundler produced files

  • cyclonedx-2.0-bundled.min.schema.json
  • cyclonedx-2.0-bundled.schema.json

but it did not set the proper $id for these output files.
it kept them untouched. leading to possible errors downstream.

background:
the original schema cyclonedx-api-2.0.schema.json defined an id.
that one was reused in those bundled schemas which actually were not congruent, though they might have validated the same structure:

  • the bundled versions had those $defs/cyclonedx-...-2.0/ that the cyclonedx-api-2.0.schema.json did not have.
  • therefore when using the cyclonedx-api-2.0.schema.json for the original id, you could not access those $defs that were in a bundle.
  • since all schema files claimed to have the same id, they were functionally different for downstream usage.
  • they were not interchangeable.

since they were not interchangeable, the id must be different.

motivation:
i could write an own validator based on cyclonedx, where i would reuse the $devs provided by the schema.
if i switched from the minified/bundled version to the original one, it would break, even though both claim to be interchangeable since they have the same schema.

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
@jkowalleck jkowalleck added this to the 2.0 milestone Aug 16, 2026
@jkowalleck
jkowalleck requested a review from a team as a code owner August 16, 2026 11:22
@jkowalleck jkowalleck added defect chore: QA A chore related to Quality Assurance CDX 2.0 related to release v2.0 labels Aug 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CDX 2.0 related to release v2.0 chore: QA A chore related to Quality Assurance defect

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant