[2.0] enforce refType/refLinkType non-conflicting with BOM-Link

schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json

@@ -81,16 +81,7 @@
                     "additionalProperties": false,
                     "properties": {
                       "ref": {
-                        "anyOf": [
-                          {
-                            "title": "Ref",
-                            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
-                          },
-                          {
-                            "title": "BOM-Link Element",
-                            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType"
-                          }
-                        ],
+                        "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink",
                         "title": "Reference",
                         "type": "string",
                         "description": "References a data component by the components bom-ref attribute"

schema/2.0/model/cyclonedx-annotation-2.0.schema.json

@@ -33,16 +33,7 @@
           "type": "array",
           "uniqueItems": true,
           "items": {
-            "anyOf": [
-              {
-                "title": "Ref",
-                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
-              },
-              {
-                "title": "BOM-Link Element",
-                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType"
-              }
-            ]
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink"
           },
           "title": "Subjects",
           "description": "The object in the BOM identified by its bom-ref. This is often a component or service, but may be any object type supporting bom-refs."

schema/2.0/model/cyclonedx-common-2.0.schema.json

@@ -6,10 +6,10 @@
   "$comment" : "OWASP CycloneDX is an Ecma International standard (ECMA-424) developed in collaboration between the OWASP Foundation and Ecma Technical Committee 54 (TC54). The standard is published under a royalty-free patent policy. This JSON schema is the reference implementation and is licensed under the Apache License 2.0.",
   "$defs": {
     "refType": {
-      "description": "Identifier for referable and therefore interlinkable elements.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.",
+      "description": "Identifier for referable and therefore interlinkable elements.\nValue shall not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links.",
       "type": "string",
       "minLength": 1,
-      "$comment": "TODO (breaking change): add a format constraint that prevents the value from staring with 'urn:cdx:'"
+      "pattern": "^(?!urn:cdx:)"
     },
     "refLinkType": {
       "description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.",
@@ -45,6 +45,20 @@
         }
       ]
     },
+    "elementLink": {
+      "title": "Referenced Element",
+      "description": "Reference using bom-link or bom-ref to an element.",
+      "anyOf": [
+        {
+          "title": "Ref",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
+        },
+        {
+          "title": "BOM-Link Element",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType"
+        }
+      ]
+    },
     "hash": {
       "type": "object",
       "title": "Hash",

schema/2.0/model/cyclonedx-component-2.0.schema.json

@@ -692,16 +692,7 @@
           "type": "array",
           "uniqueItems": true,
           "items": {
-            "anyOf": [
-              {
-                "title": "Ref",
-                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
-              },
-              {
-                "title": "BOM-Link Element",
-                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType"
-              }
-            ]
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink"
           },
           "title": "BOM References",
           "description": "The object in the BOM identified by its bom-ref. This is often a component or service but may be any object type supporting bom-refs. Tools used for analysis should already be defined in the BOM, either in the metadata/tools, components, or formulation."

schema/2.0/model/cyclonedx-composition-2.0.schema.json

@@ -34,16 +34,7 @@
           "type": "array",
           "uniqueItems": true,
           "items": {
-            "anyOf": [
-              {
-                "title": "Ref",
-                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
-              },
-              {
-                "title": "BOM-Link Element",
-                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType"
-              }
-            ]
+            "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink"
           },
           "title": "BOM references",
           "description": "The bom-ref identifiers of the components or services being described. Assemblies refer to nested relationships whereby a constituent part may include other constituent parts. References do not cascade to child parts. References are explicit for the specified constituent part only."

schema/2.0/model/cyclonedx-formulation-2.0.schema.json

@@ -802,16 +802,7 @@
         "ref": {
           "title": "BOM Reference",
           "description": "References an object by its bom-ref attribute",
-          "anyOf": [
-            {
-              "title": "Ref",
-              "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
-            },
-            {
-              "title": "BOM-Link Element",
-              "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType"
-            }
-          ]
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink"
         },
         "externalReference": {
           "title": "External reference",

schema/2.0/model/cyclonedx-party-2.0.schema.json

@@ -492,7 +492,7 @@
           "title": "Address"
         },
         "affiliation": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink",
           "title": "Affiliation",
           "description": "Reference using bom-link or bom-ref to an organization party with which the person is affiliated."
         }
@@ -836,7 +836,7 @@
           "title": "Expiration Date"
         },
         "issuer": {
-          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
+          "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink",
           "title": "Issuer",
           "description": "Reference using bom-link or bom-ref to the party that issued the identifier."
         }

schema/2.0/model/cyclonedx-vulnerability-2.0.schema.json

@@ -271,16 +271,7 @@
             "additionalProperties": false,
             "properties": {
               "ref": {
-                "anyOf": [
-                  {
-                    "title": "Ref",
-                    "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
-                  },
-                  {
-                    "title": "BOM-Link Element",
-                    "$ref": "cyclonedx-common-2.0.schema.json#/$defs/bomLinkElementType"
-                  }
-                ],
+                "$ref": "cyclonedx-common-2.0.schema.json#/$defs/elementLink",
                 "title": "Reference",
                 "description": "References a component or service by the objects bom-ref"
               },

tools/src/test/resources/1.7/valid-refType-1.7.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json",
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.7",
+  "serialNumber": "urn:uuid:3e9eb9b0-9577-4116-ac17-fad73a27b572",
+  "version": 1,
+  "components": [
+    {
+      "type": "library",
+      "name": "example",
+      "description": "`bom-ref` should not start with 'urn:uuid:' - but it does, what is quite valid",
+      "bom-ref": "urn:uuid:313ec7e9-a6bb-4274-8749-e6fa8559afab"
+    }
+  ]
+}

tools/src/test/resources/2.0/invalid-refType-2.0.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://cyclonedx.org/schema/2.0/cyclonedx-2.0.schema.json",
+  "specFormat": "CycloneDX",
+  "specVersion": "2.0",
+  "serialNumber": "urn:uuid:3e9eb9b0-9577-4116-ac17-fad73a27b572",
+  "version": "1",
+  "components": [
+    {
+      "type": "library",
+      "name": "example",
+      "description": "`bom-ref` must not start with 'urn:uuid:'",
+      "bom-ref": "urn:uuid:313ec7e9-a6bb-4274-8749-e6fa8559afab"
+    }
+  ]
+}