Unified evidence model addressing #278, #333 and other concerns.

[stevespringett]

• Closes Unified evidence model #979
• Closes Add support for array of callstack frames #278
• Closes Request: Evidence for Vulnerabilities #333

changes

• removes component's /$defs/copyright
• removes component's /$defs/copyrightObject
• add component's /$defs/componentEvidence/properties/callStacks
• add component's /$defs/componentEvidence/properties/licenses
• add component's /$defs/componentEvidence/properties/copyright
• add component's /$defs/licenseEvidence
• add component's /$defs/occurrence
• add component's /$defs/copyrightEvidence
• add component's /$defs/componentIdentityEvidence/properties/assertion
• add data's /$defs/dataContents
• add evidence's /$defs/identificationMethod
• add evidence's /$defs/vulnerabilityEvidence

[jkowalleck]

RFC notice sent on July 20, 2026

• https://groups.io/g/CycloneDX/topic/120352781
• https://cyclonedx.slack.com/archives/CVA0G10FN/p1784506598160339

Public RFC period ends August 17, 2026

[planetlevel]

@stevespringett - in reviewing all this, it occurs to me that we do a good job of capturing evidence of vulnerability. But to really understand a risk, it's important to understand any compensating controls. It's like evidence against vulnerability - that it doesn't exist or isn't as dangerous as it might be. Like VEX sort of. I'm wondering if we should add something in the standard to model these controls so that you can take them into account. Is this already handled somehow? Or is this somewhere else in the standard that I missed?

If we dd this, we could distinguish inherent and residual ratings and allow the residual rating to reference the mitigation assertion.

[jkowalleck]

cyclonedx-license-2.0.schema.json#/$defs/license is a very complex object.

I'd rather go with the following, here:
inherit only the properties "id" and "name" from cyclonedx-license-2.0.schema.json#/$defs/license

{
  "license": {
      "allOf": [
        { "$ref": "cyclonedx-license-2.0.schema.json#/$defs/license" },
        {
          "type": "object",
          "properties": {
            "id": true,
            "name": true
          },
          "additionalProperties": false
        }
      ]
    }
}

[jkowalleck]

can the components' /$defs/componentIdentityEvidence
be moved to evidence's /$defs/identityEvidence ?

this way, we would not keep this special evidence thing in the component module and have it for reusability.