=begin pod

=head1 NAME

SBOM::CycloneDX - Software Bill Of Materials, CycloneDX style

=head1 SYNOPSIS

=begin code :lang<raku>
use SBOM::CycloneDX;

# Reading an existing file
my $from-path = SBOM::CycloneDX.new($path);  # read from path

my $from-io = SBOM::CycloneDX.new($io);      # read from IO object

# create from scratch
my %sbom := SBOM::CycloneDX.Hash;  # create Hash with minimal keys
%sbom<components>.push: {
  name => "My first library",
  type => "library",
}
my $first = SBOM::CycloneDX.new(|%sbom);

"new.json".IO.spurt: $first.JSON;  # write to file
=end code

=head1 DESCRIPTION

C<SBOM::CycloneDX> provides a distribution for the implementation of
the Software Bill Of Materials standard provided by CycloneDX using
the L<JSON Reference version 1.6|https://cyclonedx.org/docs/1.6/json/>.

=head1 SCRIPTS

=head2 cyclonedx

=begin output
$ cyclonedx t/valid/valid-metadata-tool-1.6.json
't/valid/valid-metadata-tool-1.6.json' is a valid CycloneDX SBOM
=end output

The C<cyclonedx> script takes B<one> positional argument: the
path of a CycloneDX file.  It will attempt to load the file and
report on any errors seen (if possible).  Sets C<$!> to C<1> if
an error occurred, or C<0> if all is ok.

Accepts the following optional named arguments:
=table
parameter    | description
-------------+------------
--raw        | show first raw error only
--silent     | be silent on success
--json       | show SBOM as JSON if valid
--yaml       | show SBOM as YAML if valid
--raku       | show SBOM as Raku code if valid
--components | only show components
--services   | only show services
--purls      | only Package URLs

=begin output
$ cyclonedx t/valid/valid-metadata-tool-1.6.json --silent
$ echo $!
0
=end output

=begin output
$ cyclonedx t/invalid/invalid-missing-component-type-1.6.json
Found 1 build error:
  CycloneDX/Component	The attribute '$!type' is required, but you did not provide a value for it.
=end output

=head2 cyclonedx-enums

=begin output
$ cyclonedx-enums
All possible enum classes:

AccessMode
Acknowledgement
...

$ cyclonedx-enums AccessMode
All possible values in the 'AccessMode' enum:

read-only
read-write
...
=end output

The C<cyclonedx-enums> script takes B<two> optional positional arguments:
the name of the enum class to display information for, and the value
for which to display information.  It defaults to C<all> for the first
positional argument, in which case all possible enum classes will be
displayed.

If no second positional argument is specified, then all possible values
of the given enum will be shown.

Accepts the following optional named arguments:
=table
parameter | description
----------+------------
--verbose | whether to also show the associated WHY info
--silent  | whether to not show headers

=head1 INSTANTIATION

Any C<SBOM::> object can be instantiated in 2 ways: either the standard
way using named arguments, or by passing a path (either as a string or
as an C<IO::Path> object) as a single positional argument.

If the extension of the path is C<.yml> or C<.yaml>, then its contents
will be considered to be valid YAML.  Otherwise the contents will be
assumed to be valid JSON.

=head1 INTROSPECTION METHODS

A number of introspection methods are provided, making it easier to
search for certain conditions in a given SBOM.  Suggestions for types
of introspection are very welcome.

=head1 CLASSES PROVIDED

All classes can be instantiated by calling the C<.new> method with
named arguments.  Each named argument can either be a C<SBOM::> object,
or a hash containing named arguments.

All C<SBOM::> classes also provide the following methods on instances:

=item .build-errors

Returns a list of C<Pair>s indicating any elements that were for some
reason incorrect, and where thus not added to the object.  Should be
empty for a completely succesful creation of an instance of a C<SBOM::>
class.

The key contains the crumb trail of where in the object the problem
occurred (e.g. "CycloneDX/Component"), and the value is the
C<Exception> object that was caught.  Usually one is only interested
in the C<.message> on that object, but during development the complete
stack trace provided by the C<Exception> object may also be of
interest.

=item .bom-refs

Returns a C<Map> of the bom-refs that have been seen in the instance,
with the bom-ref as key, and the associated C<SBOM> object as its
value.  If a bom-ref was only mentioned, but not identified, the
value will be C<Nil>.

=item .JSON

Returns a JSON representation of the instance.

=item .Map

Returns a C<Map> representation of the instance, which can be used as
an input to C<.new> when flattened.

=item .Hash

Returns a C<Hash> representation of the instance, which can be used as
an input to C<.new> when flattened.  This is the mutable version of
C<.Map>, intended to be used for creation / updates by modifying the
returned hash, and using that to create a new object with.

=item .raku

Returns a string representation of the instance, which can be used in
an C<EVAL>.

=item .YAML

Returns a YAML representation of the instance.

=head2 SBOM::CycloneDX

Providing the CycloneDX v1.6 JSON specification in Raku. Accepts these
named arguments:

=item BOMFormat C<:$bomFormat> (required)

Specifies the format of the BOM. This helps to identify the file as
CycloneDX since BOMs do not have a filename convention, nor does JSON
schema support namespaces.

=item Str C<:$specVersion> (required)

The version of the CycloneDX specification the BOM conforms to.

=item serialNumber C<:$serialNumber>

Every BOM generated SHOULD have a unique serial number, even if the
contents of the BOM have not changed over time. If specified, the serial
number must conform to RFC 4122. Use of serial numbers is recommended.

=item PositiveInt C<:$version>

Whenever an existing BOM is modified, either manually or through
automated processes, the version of the BOM SHOULD be incremented by 1.
When a system is presented with multiple BOMs with identical serial
numbers, the system SHOULD use the most recent version of the BOM. The
default version is '1'.

=item SBOM::Metadata C<:$metadata>

Provides additional information about a BOM.

=item SBOM::Component C<:@components>

A list of software and hardware components. All items must be unique.

=item SBOM::Service C<:@services>

A list of services. This may include microservices,
function-as-a-service, and other types of network or intra-process
services. All items must be unique.

=item SBOM::Reference C<:@externalReferences>

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.

=item SBOM::Dependency C<:@dependencies>

Provides the ability to document dependency relationships including
provided & implemented components. All items must be unique.

=item SBOM::Composition C<:@compositions>

Compositions describe constituent parts (including components,
services, and dependency relationships) and their completeness. The
completeness of vulnerabilities expressed in a BOM may also be
described.

=item SBOM::Vulnerability C<:@vulnerabilities>

Vulnerabilities identified in components or services. All items must be
unique.

=item SBOM::Annotation C<:@annotations>

Comments made by people, organizations, or tools about any object with
a bom-ref, such as components, services, vulnerabilities, or the BOM
itself. Unlike inventory information, annotations may contain opinions
or commentary from various stakeholders. Annotations may be inline (with
inventory) or externalized viai BOM-Link and may optionally be signed.
All items must be unique.

=item SBOM::Formulation C<:@formulation>

Describes how a component or service was manufactured or deployed. This
is achieved through the use of formulas, workflows, tasks, and steps,
which declare the precise steps to reproduce along with the observed
formulas describing the steps which transpired in the manufacturing
process. All items must be unique.

=item SBOM::Declarations C<:$declarations>

The list of declarations which describe the conformance to standards.
Each declaration may include attestations, claims, and evidence.

=item SBOM::Definition C<:@definitions>

A collection of reusable objects that are defined and may be used
elsewhere in the BOM.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 ADDITIONAL METHODS

=head3 all-components

Returns all C<SBOM::Component> objects that can be found.

=head3 all-purls

Returns all L<C<PURL>|https://raku.land/zef:lizmat/PURL> objects that
can be found.

=head3 all-verses

Returns all L<C<VERS>|https://raku.land/zef:lizmat/VERS> objects that
can be found.

=head3 all-services

Returns all C<SBOM::Service> objects that can be found.

=head3 .Hash

=begin code :lang<raku>
use SBOM::CycloneDX;

my %sbom := SBOM::CycloneDX.Hash;
%sbom<components>.push: {
  type => "library",
  name => "My first library",
}

say SBOM::CycloneDX.new(|%sbom).JSON;
# {
#   "bomFormat": "CycloneDX",
#   "specVersion": "1.6",
#   "version": 1,
#   "components": [
#     {
#       "type": "library",
#       "name": "My first library"
#     }
#   ]
# }
=end code

The C<.Hash> method called on the C<SBOM::CycloneDX> type object
returns a C<Hash> with the information to create a minimally
viable C<SBOM::CycloneDX> object.

=head2 SBOM::Address

The physical address (location) of the organization. Accepts these
named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the address
elsewhere in the BOM.

=item Str C<:$country>

The country name or the two-letter ISO 3166-1 country code.

=item Str C<:$region>

The region or state in the country.

=item Str C<:$locality>

The locality or city within the country.

=item Str C<:$postOfficeBoxNumber>

The post office box number.

=item Str C<:$postalCode>

The postal code.

=item Str C<:$streetAddress>

The street address.

=head2 SBOM::Advisory

An advisory of a vulnerability. Accepts these named arguments:

=item Str C<:$title>

An optional name of the advisory.

=item URL C<:$url> (required)

Location where the advisory can be obtained.

=head2 SBOM::AffectedVersion

A version or range of versions and their status. Accepts these named
arguments:

=item versionString C<:$version>

A single version of a component or service.

=item versionRange C<:$range>

A version range specified in Package URL Version Range syntax

=item VersionAffection C<:$status>

The vulnerability status for the version or range of versions.

=head2 SBOM::Affects

The components or services that are affected by the vulnerability.
Accepts these named arguments:

=item bom-refOrLink C<:$ref> (required)

References a component or service by the objects bom-ref.

=item SBOM::AffectedVersion C<:@versions>

Zero or more individual versions or range of versions.

=head2 SBOM::Affirmation

A concise statement affirmed by an individual regarding all
declarations, often used for third-party auditor acceptance or recipient
acknowledgment. It includes a list of authorizedi signatories who assert
the validity of the document on behalf of the organization. Accepts
these named arguments:

=item Str C<:$statement>

The brief statement affirmed by an individual regarding all
declarations. This could be an affirmation of acceptance by a
third-party auditor or receiving individual of a file.

=item SBOM::Signatory C<:@signatories>

The list of signatories authorized on behalf of an organization to
assert validity of this document.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::AlgorithmProperties

Properties specific to a cryptographic algorithm. Accepts these named
arguments:

=item AlgorithmPrimitive C<:$primitive>

Cryptographic building blocks used in higher-level cryptographic
systems and protocols.

=item Str C<:$parameterSetIdentifier>

An identifier for the parameter set of the cryptographic algorithm.
Examples: in AES128, '128' identifies the key length in bits, in SHA256,
'256' identifies the digest length, '128' in SHAKE128 identifies its
maximum security level in bits, and 'SHA2-128s' identifies a parameter
set used in SLH-DSA (FIPS205).

=item Str C<:$curve>

The specific underlying Elliptic Curve (EC) definition employed which
is an indicator of the level of security strength, performance and
complexity. Absent an authoritative source of curve names, CycloneDX
recommends using curve names as defined at https://neuromancer.sk/std/,
the source of which can be found at https://github.com/J08nY/std-curves.

=item ExecutionEnvironment C<:$executionEnvironment>

The target and execution environment in which the algorithm is
implemented in.

=item Platform C<:$implementationPlatform>

The target platform for which the algorithm is implemented. The
implementation can be 'generic', running on any platform or for a
specific platform.

=item Certification C<:@certificationLevel>

The certification that the implementation of the cryptographic
algorithm has received, if any. Certifications include revisions and
levels of FIPS 140 or Common Criteria of different Extended Assurance
Levels (CC-EAL).

=item CertificationMode C<:$mode>

The mode of operation in which the cryptographic algorithm (block
cipher) is used.

=item CertificationPadding C<:$padding>

The padding scheme that is used for the cryptographic algorithm.

=item CryptoFunction C<:@cryptoFunctions>

The cryptographic functions implemented by the cryptographic algorithm.

=item UInt C<:$classicalSecurityLevel>

The classical security level that a cryptographic algorithm provides
(in bits).

=item nistQuantumSecurityLevel C<:$nistQuantumSecurityLevel>

The NIST security strength category as defined in
https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria).
A value of 0 indicates that none of the categories are met.

=head2 SBOM::Analysis

An assessment of the impact and exploitability of a vulnerability.
Accepts these named arguments:

=item VulnerabilityState C<:$state>

Declares the current state of an occurrence of a vulnerability, after
automated or manual analysis.

=item Justification C<:$justification>

The rationale of why the impact analysis state was asserted.

=item Response C<:@response>

A response to the vulnerability by the manufacturer, supplier, or
project responsible for the affected component or service. More than one
response is allowed. Responses are strongly encouraged for
vulnerabilities where the analysis state is exploitable.

=item Str C<:$detail>

Detailed description of the impact including methods used during
assessment. If a vulnerability is not exploitable, this field should
include specific details on why the component or service is not impacted
by this vulnerability.

=item DateTime C<:$firstIssued>

The date and time (timestamp) when the analysis was first issued.

=item DateTime C<:$lastUpdated>

The date and time (timestamp) when the analysis was last updated.

=head2 SBOM::Annotation

Comments made by people, organizations, or tools about any object with
a bom-ref, such as components, services, vulnerabilities, or the BOM
itself. Unlike inventory information, annotations may contain opinions
or commentary from various stakeholders. Annotations may be inline (with
inventory) or externalized via BOM-Link and may optionally be signed.
Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the annotation
elsewhere in the BOM.

=item referenceURL C<:@subjects> (required)

The object in the BOM identified by its bom-ref. This is often a
component or service, but may be any object type supporting bom-refs.

=item SBOM::Annotator C<:$annotator> (required)

The organization, person, component, or service which created the
textual content of the annotation.

=item DateTime C<:$timestamp> (required)

The date and time (timestamp) when the annotation was created.

=item Str C<:$text> (required)

The textual content of the annotation.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::Annotator

Person, organization, component, service making an annotation Accepts
these named arguments:

=item SBOM::Contact C<:$individual>

The person that created the annotation.

=item SBOM::Organization C<:$organization>

The organization that created the annotation.

=item SBOM::Component C<:$component>

The tool or component that created the annotation.

=item SBOM::Service C<:$service>

The service that created the annotation.

=head2 SBOM::AnyLicense

Either a (modern) License object, or a legacy SPDX License object
Accepts these named arguments:

=head2 SBOM::Approach

The overall approach to learning used by the model for problem solving.
Accepts these named arguments:

=item Learning C<:$type>

Learning types describing the learning problem or hybrid learning
problem.

=head2 SBOM::Assessor

An assessor evaluating claims and determining conformance to
requirements and confidence in that assessment. Accepts these named
arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the object
elsewhere in the BOM.

=item Bool C<:$thirdParty>

The boolean indicating if the assessor is outside the organization
generating claims. A value of false indicates a self assessor.

=item SBOM::Organization C<:$organization>

The entity issuing the assessment.

=head2 SBOM::Attachment

Supporting material that helps in reproducing or understanding. This
may include screenshots, payloads, and PoC exploit code. Accepts these
named arguments:

=item mime-type C<:$contentType>

Specifies the format and nature of the data being attached, helping
systems correctly interpret and process the content. Common content type
examples include application/json for JSON data and text/plain for plan
text documents.

=item Encoding C<:$encoding>

Specifies the optional encoding the text is represented in.

=item Str C<:$content> (required)

The attachment data. Proactive controls such as input validation and
sanitization should be employed to prevent misuse of attachment text.

=head2 SBOM::Attestation

An attestations asserted by an assessor that maps requirements to
claims. Accepts these named arguments:

=item Str C<:$summary>

The short description explaining the main points of the attestation.

=item bom-ref C<:$assessor>

The bom-ref to the assessor asserting the attestation.

=item SBOM::RequirementGrouping C<:@map>

The grouping of requirements to claims and the attestors declared
conformance and confidence thereof.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::Callstack

Evidence of component use through the callstack. Accepts these named
arguments:

=item SBOM::Frame C<:@frames>

The frames seen in the callstack.

=head2 SBOM::CertificateProperties

Properties for cryptographic assets of asset type 'certificate' Accepts
these named arguments:

=item Str C<:$subjectName>

The subject name for the certificate.

=item Str C<:$issuerName>

The issuer name for the certificate.

=item DateTime C<:$notValidBefore>

The date and time according to ISO-8601 standard from which the
certificate is valid.

=item DateTime C<:$notValidAfter>

The date and time according to ISO-8601 standard from which the
certificate is not valid anymore.

=item Str C<:$signatureAlgorithmRef>

The bom-ref to signature algorithm used by the certificate.

=item Str C<:$subjectPublicKeyRef>

The bom-ref to the public key of the subject.

=item Str C<:$certificateFormat>

The format of the certificate.

=item Str C<:$certificateExtension>

The file extension of the certificate.

=head2 SBOM::CipherSuite

A cipher suite related to a protocol. Accepts these named arguments:

=item Str C<:$name>

A common name for the cipher suite.

=item Str C<:@algorithms>

A list of algorithms related to the cipher suite.

=item Str C<:@identifiers>

A list of common identifiers for the cipher suite.

=head2 SBOM::Claim

A claim. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the object
elsewhere in the BOM.

=item bom-ref C<:$target>

The bom-ref to a target representing a specific system, application,
API, module, team, person, process, business unit, company, etc... that
this claim is being applied to.

=item Str C<:$predicate>

The specific statement or assertion about the target.

=item bom-ref C<:@mitigationStrategies>

The list of bom-ref to the evidence provided describing the mitigation
strategies. Each mitigation strategy should include an explanation of
how any weaknesses in the evidence will be mitigated.

=item Str C<:$reasoning>

The written explanation of why the evidence provided substantiates the
claim.

=item bom-ref C<:@evidence>

The list of bom-ref to evidence that supports this claim.

=item bom-ref C<:@counterEvidence>

The list of bom-ref to counter evidence that supports this claim.

=item SBOM::Reference C<:@externalReferences>

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::CO2Cost

An expression of CO2 cost. Accepts these named arguments:

=item number C<:$value> (required)

Quantity of carbon dioxide (CO2).

=item CO2Cost C<:$unit> (required)

Unit of carbon dioxide (CO2).

=head2 SBOM::Command

Command or directive for a step Accepts these named arguments:

=item Str C<:$executed>

A text representation of the executed command.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::Commit

Specifies an individual commit. Accepts these named arguments:

=item Str C<:$uid>

A unique identifier of the commit. This may be version control
specific. For example, Subversion uses revision numbers whereas git uses
commit hashes.

=item URL C<:$url>

The URL to the commit. This URL will typically point to a commit in a
version control system.

=item SBOM::Development C<:$author>

The author who created the changes in the commit.

=item SBOM::Development C<:$committer>

The person who committed or pushed the commit.

=item Str C<:$message>

The text description of the contents of the commit.

=head2 SBOM::Component

A software or hardware component. Accepts these named arguments:

=item ComponentType C<:$type> (required)

Specifies the type of the component. For software components, classify
as application if no more specific appropriate classification is
available or cannot be determined for the component.

=item mime-type C<:$mime-type>

The optional mime-type of the component. When used on file components,
the mime-type can provide additional context about the kind of file
being represented, such as an image, font, or executable. Some library
or framework components may also have an associated mime-type.

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the component
elsewhere in the BOM. Every bom-ref must be unique within the BOM. Value
SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts
with BOM-Links.

=item SBOM::Organization C<:$supplier>

The organization that supplied the component. The supplier may often be
the manufacturer, but may also be a distributor or repackager.

=item SBOM::Organization C<:$manufacturer>

The organization that created the component. Manufacturer is common in
components created through automated processes. Components created
through manual means may have @.authors instead.

=item SBOM::Contact C<:@authors>

The person(s) who created the component. Authors are common in
components created through manual processes. Components created through
automated means may have @.manufacturer instead.

=item Str C<:$author>

=item Str C<:$publisher>

The person(s) or organization(s) that published the component.

=item Str C<:$group>

The grouping name or identifier. This will often be a shortened, single
name of the company or project that produced the component, or the
source package or domain name. Whitespace and special characters should
be avoided. Examples include: apache, org.apache.commons, and
apache.org.

=item Str C<:$name> (required)

The name of the component. This will often be a shortened, single name
of the component. Examples: commons-lang3 and jquery.

=item versionString C<:$version>

The component version. The version should ideally comply with semantic
versioning but is not enforced.

=item Str C<:$description>

Specifies a description for the component

=item Scope C<:$scope>

Specifies the scope of the component. If scope is not specified,
'required' scope SHOULD be assumed by the consumer of the BOM.

=item SBOM::HashedString C<:@hashes>

The hashes of the component.

=item SBOM::AnyLicense C<:@licenses>

EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one
SPDX License Expression)

=item Str C<:$copyright>

A copyright notice informing users of the underlying claims to
copyright ownership in a published work.

=item CPE C<:$cpe>

Asserts the identity of the component using CPE. The CPE must conform
to the CPE 2.2 or 2.3 specification. See
https://nvd.nist.gov/products/cpe. Refer to @.evidence.identity to
optionally provide evidence that substantiates the assertion of the
component's identity.

=item purl C<:$purl>

Asserts the identity of the component using package-url (purl). The
purl, if specified, must be valid and conform to the specification
defined at: https://github.com/package-url/purl-spec. Refer to
@.evidence.identity to optionally provide evidence that substantiates
the assertion of the component's identity.

=item omniborId C<:@omniborId>

Asserts the identity of the component using the OmniBOR Artifact ID.
The OmniBOR, if specified, must be valid and conform to the
specification defined at:
https://www.iana.org/assignments/uri-schemes/prov/gitoid. Refer to
@.evidence.identity to optionally provide evidence that substantiates
the assertion of the component's identity.

=item SWHID C<:@swhid>

Asserts the identity of the component using the Software Heritage
persistent identifier (SWHID). The SWHID, if specified, must be valid
and conform to the specification defined at:
https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html.
Refer to @.evidence.identity to optionally provide evidence that
substantiates the assertion of the component's identity.

=item SBOM::SWID C<:$swid>

Asserts the identity of the component using ISO-IEC 19770-2 Software
Identification (SWID) Tags. Refer to @.evidence.identity to optionally
provide evidence that substantiates the assertion of the component's
identity.

=item Bool C<:$modified>

[Deprecated] This will be removed in a future version. Use the pedigree
element instead to supply information on exactly how the component was
modified. A boolean value indicating if the component has been modified
from the original. A value of true indicates the component is a
derivative of the original. A value of false indicates the component has
not been modified from the original.

=item SBOM::Pedigree C<:$pedigree>

Component pedigree is a way to document complex supply chain scenarios
where components are created, distributed, modified, redistributed,
combined with other components, etc. Pedigree supports viewing this
complex chain from the beginning, the end, or anywhere in the middle. It
also provides a way to document variants where the exact relation may
not be known.

=item SBOM::Reference C<:@externalReferences>

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.

=item SBOM::Component C<:@components>

A list of software and hardware components included in the parent
component. This is not a dependency tree. It provides a way to specify a
hierarchical representation of component assemblies, similar to system →
subsystem → parts assembly in physical supply chains.

=item SBOM::ComponentEvidence C<:$evidence>

Provides the ability to document evidence collected through various
forms of extraction or analysis.

=item SBOM::ReleaseNotes C<:$releaseNotes>

Specifies optional release notes.

=item SBOM::ModelCard C<:$modelCard>

A model card describes the intended uses of a machine learning model
and potential limitations, including biases and ethical considerations.
Model cards typically contain the training parameters, which datasets
were used to train the model, performance metrics, and other relevant
data useful for ML transparency. This object SHOULD be specified for any
component of type machine-learning-model and must not be specified for
other component types.

=item SBOM::ComponentDataset C<:@data>

Data associated with a data component.

=item SBOM::CryptoProperties C<:$cryptoProperties>

Cryptographic assets have properties that uniquely define them and that
make them actionable for further reasoning. As an example, it makes a
difference if one knows the algorithm family (e.g. AES) or the specific
variant or instantiation (e.g. AES-128-GCM). This is because the
security level and the algorithm primitive (authenticated encryption)
are only defined by the definition of the algorithm variant. The
presence of a weak cryptographic algorithm like SHA1 vs. HMAC-SHA1 also
makes a difference.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=item Str C<:@tags>

Textual strings that aid in discovery, search, and retrieval of the
associated object. Tags often serve as a way to group or categorize
similar or related objects by various attributes.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::ComponentDataset

A dataset associated with a component. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the dataset
elsewhere in the BOM.

=item DataSource C<:$type> (required)

The general theme or subject matter of the data being specified.

=item Str C<:$name>

The name of the dataset.

=item SBOM::DataContents C<:$contents>

The contents or references to the contents of the data being described.

=item Str C<:$classification>

Data classification tags data according to its type, sensitivity, and
value if altered, stolen, or destroyed.

=item Str C<:@sensitiveData>

A description of any sensitive data in a dataset.

=item SBOM::Graphics C<:$graphics>

A collection of graphics that represent various measurements.

=item Str C<:$description>

A description of the dataset. Can describe size of dataset, whether
it's used for source code, training, testing, or validation, etc.

=item SBOM::Governance C<:$governance>

Data governance captures information regarding data ownership,
stewardship, and custodianship, providing insights into the individuals
or entities responsible for managing, overseeing, and safeguarding the
data throughout its lifecycle.

=head2 SBOM::ComponentEvidence

The ability to document evidence about a component, collected through
various forms of extraction or analysis. Accepts these named arguments:

=item SBOM::Occurrence C<:@occurrences>

Evidence of individual instances of a component spread across multiple
locations.

=item SBOM::Callstack C<:$callstack>

Evidence of the components use through the callstack.

=item SBOM::AnyLicense C<:@licenses>

EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one
SPDX License Expression).

=item SBOM::Copyright C<:@copyright>

A copyright notice informing users of the underlying claims to
copyright ownership in a published work.

=item SBOM::Identity C<:$identity>

[DEPRECATED] Evidence that substantiates the identity of a component.

=item SBOM::Identity C<:@identity>

Evidence that substantiates the identity of a component. The identity
may be an object or an array of identity objects. Support for specifying
identity as a single object was introduced in CycloneDX v1.5. Arrays
were introduced in v1.6. It is recommended that all implementations use
arrays, even if only one identity object is specified.

=head2 SBOM::Composition

Compositions describe constituent parts (including components,
services, and dependency relationships) and their completeness. The
completeness of vulnerabilities expressed in a BOM may also be
described. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the composition
elsewhere in the BOM.

=item Aggregate C<:$aggregate>

Specifies an aggregate type that describes how complete a relationship
is.

=item bom-refOrLink C<:@assemblies>

The bom-ref identifiers of the components or services being described.
Assemblies refer to nested relationships whereby a constituent part may
include other constituent parts. References do not cascade to child
parts. References are explicit for the specified constituent part only.

=item bom-ref C<:@dependencies>

The bom-ref identifiers of the components or services being described.
Dependencies refer to a relationship whereby an independent constituent
part requires another independent constituent part. References do not
cascade to transitive dependencies. References are explicit for the
specified dependency only.

=item bom-ref C<:@vulnerabilities>

The bom-ref identifiers of the vulnerabilities being described.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::Condition

A condition that was used to determine a trigger should be activated.
Accepts these named arguments:

=item Str C<:$description>

Describes the set of conditions which cause the trigger to activate.

=item Str C<:$expression>

The logical expression that was evaluated that determined the trigger
should be fired.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::Confidence

The confidence of the claim meeting the requirement. Accepts these
named arguments:

=item confidenceValue C<:$score>

The confidence of the claim between and inclusive of 0 and 1, where 1
is 100% confidence.

=item Str C<:$rationale>

The rationale for the confidence score.

=head2 SBOM::ConfidenceInterval

The confidence interval of a metric. Accepts these named arguments:

=item Str C<:$lowerBound>

The lower bound of the confidence interval.

=item Str C<:$upperBound>

The upper bound of the confidence interval.

=head2 SBOM::Conformance

The conformance of the claim meeting a requirement. Accepts these named
arguments:

=item conformanceValue C<:$score>

The conformance of the claim between and inclusive of 0 and 1, where 1
is 100% conformance.

=item Str C<:$rationale>

The rationale for the conformance score.

=item bom-ref C<:@mitigationStrategies>

The list of bom-ref to the evidence provided describing the mitigation
strategies.

=head2 SBOM::Considerations

What considerations should be taken into account regarding a model's
construction, training, and application? Accepts these named arguments:

=item Str C<:@users>

Who are the intended users of the model?

=item Str C<:@useCases>

What are the intended use cases of the model?

=item Str C<:@technicalLimitations>

What are the known technical limitations of the model? E.g. What
kind(s) of data should the model be expected not to perform well on?
What are the factors that might degrade model performance?

=item Str C<:@performanceTradeoffs>

What are the known tradeoffs in accuracy/performance of the model?

=item SBOM::EthicalConsideration C<:@ethicalConsiderations>

What are the ethical risks involved in the application of this model?

=item SBOM::EnvironmentalConsiderations C<:$environmentalConsiderations>

What are the various environmental impacts the corresponding machine
learning model has exhibited across its lifecycle?

=item SBOM::FairnessAssessment C<:@fairnessAssessments>

How does the model affect groups at risk of being systematically
disadvantaged? What are the harms and benefits to the various affected
groups?

=head2 SBOM::Contact

A person. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the person
elsewhere in the BOM.

=item Str C<:$name>

The name of a contact.

=item email C<:$email>

The email address of the contact.

=item Str C<:$phone>

The phone number of the contact.

=head2 SBOM::Copyright

Copyright evidence captures intellectual property assertions, providing
evidence of possible ownership and legal protection. Accepts these named
arguments:

=item Str C<:$text> (required)

The textual content of the copyright.

=head2 SBOM::Credits

Individuals or organizations credited with the discovery of a
vulnerability. Accepts these named arguments:

=item SBOM::Organization C<:@organizations>

The organizations credited with vulnerability discovery.

=item SBOM::Contact C<:@individuals>

The individuals, not associated with organizations, that are credited
with vulnerability discovery.

=head2 SBOM::CryptoMaterialProperties

Properties for cryptographic assets of asset type:
related-crypto-material Accepts these named arguments:

=item Crypto C<:$type>

The type for the related cryptographic material

=item Str C<:$id>

The optional unique identifier for the related cryptographic material.

=item CryptoState C<:$state>

The key state as defined by NIST SP 800-57.

=item Str C<:$algorithmRef>

The bom-ref to the algorithm used to generate the related cryptographic
material.

=item DateTime C<:$creationDate>

The date and time (timestamp) when the related cryptographic material
was created.

=item DateTime C<:$activationDate>

The date and time (timestamp) when the related cryptographic material
was activated.

=item DateTime C<:$updateDate>

The date and time (timestamp) when the related cryptographic material
was updated.

=item DateTime C<:$expirationDate>

The date and time (timestamp) when the related cryptographic material
expires.

=item Str C<:$value>

The associated value of the cryptographic material.

=item UInt C<:$size>

The size of the cryptographic asset (in bits).

=item Str C<:$format>

The format of the related cryptographic material (e.g. P8, PEM, DER).

=item SBOM::CryptoSecurity C<:$securedBy>

The mechanism by which the cryptographic asset is secured by.

=head2 SBOM::CryptoProperties

Cryptographic assets have properties that uniquely define them and that
make them actionable for further reasoning. As an example, it makes a
difference if one knows the algorithm family (e.g. AES) or the specific
variant or instantiation (e.g. AES-128-GCM). This is because the
security level and the algorithm primitive (authenticated encryption)
are only defined by the definition of the algorithm variant. The
presence of a weak cryptographic algorithm like SHA1 vs. HMAC-SHA1 also
makes a difference. Accepts these named arguments:

=item CryptoAsset C<:$assetType> (required)

Type of crypto asset.

=item SBOM::AlgorithmProperties C<:$algorithmProperties>

Additional properties specific to a cryptographic algorithm.

=item SBOM::CertificateProperties C<:$certificateProperties>

Properties for cryptographic assets of asset type 'certificate'.

=item SBOM::CryptoMaterialProperties C<:$relatedCryptoMaterialProperties>

Properties for cryptographic assets of asset type
'related-crypto-material'.

=item SBOM::CryptoProtocolProperties C<:$protocolProperties>

Properties specific to cryptographic assets of type: protocol.

=item Str C<:$oid>

The object identifier (OID) of the cryptographic asset.

=head2 SBOM::CryptoProtocolProperties

Properties specific to cryptographic assets of type: protocol. Accepts
these named arguments:

=item CryptoProtocol C<:$type>

The concrete protocol type.

=item versionString C<:$version>

The version of the protocol.

=item SBOM::CipherSuite C<:@cipherSuites>

A list of cipher suites related to the protocol.

=item SBOM::IKEv2TransformTypes C<:$ikev2TransformTypes>

The IKEv2 transform types supported (types 1-4), defined in RFC 7296
section 3.3.2, and additional properties.

=item IDnotbomLink C<:@cryptoRefArray>

A list of protocol-related cryptographic assets, Identifier for
referable and therefore interlinkable elements.

=head2 SBOM::CryptoSecurity

The mechanism by which a cryptographic asset is secured by. Accepts
these named arguments:

=item Str C<:$mechanism>

Specifies the mechanism by which the cryptographic asset is secured by.

=item Str C<:$algorithmRef>

The bom-ref to the algorithm.

=head2 SBOM::DataContents

The contents or references to the contents of data being described.
Accepts these named arguments:

=item SBOM::Attachment C<:$attachment>

An optional way to include textual or encoded data.

=item URL C<:$url>

The URL to where the data can be retrieved.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::DeclarationEvidence

Evidence used in a declaration. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the object
elsewhere in the BOM.

=item propertyName C<:$propertyName>

The reference to the property name as defined in the CycloneDX Property
Taxonomy.

=item Str C<:$description>

The written description of what this evidence is and how it was
created.

=item SBOM::EvidenceDataset C<:@data>

The output or analysis that supports claims.

=item DateTime C<:$created>

The date and time (timestamp) when the evidence was created.

=item DateTime C<:$expires>

The date and time (timestamp) when the evidence is no longer valid.

=item SBOM::Contact C<:$author>

The author of the evidence.

=item SBOM::Contact C<:$reviewer>

The reviewer of the evidence.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::Declarations

Describes the conformance to standards, may include attestations,
claims, and evidence. Accepts these named arguments:

=item SBOM::Assessor C<:@assessors>

The list of assessors evaluating claims and determining conformance to
requirements and confidence in that assessment.

=item SBOM::Attestation C<:@attestations>

The list of attestations asserted by an assessor that maps requirements
to claims.

=item SBOM::Claim C<:@claims>

The list of claims.

=item SBOM::DeclarationEvidence C<:@evidence>

The list of evidence.

=item SBOM::Target C<:@targets>

The list of targets which claims are made against.

=item SBOM::Affirmation C<:$affirmation>

A concise statement affirmed by an individual regarding all
declarations, often used for third-party auditor acceptance or recipient
acknowledgment. It includes a list of authorized signatories who assert
the validity of the document on behalf of the organization.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::Definition

Reusable object that may be used elsewhere in the BOM. Accepts these
named arguments:

=item SBOM::Standard C<:@standards>

The list of standards which may consist of regulations, industry or
organizational-specific standards, maturity models, best practices, or
any other requirements which can be evaluated against or attested to.

=head2 SBOM::Dependency

Defines the direct dependencies of a component, service, or the
components provided/implemented by a given component. Components or
services that do not have their own dependencies must be declared as
empty elements within the graph. Components or services that are not
represented in the dependency graph may have unknown dependencies. It is
recommended that implementations assume this to be opaque and not an
indicator of an object being dependency-free. It is recommended to
leverage compositions to indicate unknown dependency graphs. Accepts
these named arguments:

=item bom-ref C<:$ref>

References a component or service by its bom-ref attribute.

=item bom-ref C<:@dependsOn>

The bom-ref identifiers of the components or services that are
dependencies of this dependency object.

=item bom-ref C<:@provides>

The bom-ref identifiers of the components or services that define a
given specification or standard, which are provided or implemented by
this dependency object. For example, a cryptographic library which
implements a cryptographic algorithm. A component which implements
another component does not imply that the implementation is in use.

=head2 SBOM::Development

An action during development, such as a commit. Accepts these named
arguments:

=item DateTime C<:$timestamp>

The timestamp in which the action occurred.

=item Str C<:$name>

The name of the individual who performed the action.

=item email C<:$email>

The email address of the individual who performed the action.

=head2 SBOM::Diff

The patch file (or diff) that shows changes. Refer to
https://en.wikipedia.org/wiki/Diff Accepts these named arguments:

=item SBOM::Attachment C<:$text>

Specifies the optional text of the diff.

=item URL C<:$url>

Specifies the URL to the diff.

=head2 SBOM::EnergyConsumption

Describes energy consumption information incurred during a component's
lifecycle activities. Accepts these named arguments:

=item Activity C<:$activity> (required)

The type of activity that is part of a machine learning model
development or operational lifecycle.

=item SBOM::EnergyProvider C<:@energyProviders> (required)

The provider(s) of the energy consumed by the associated model
development lifecycle activity.

=item SBOM::EnergyCost C<:$activityEnergyCost> (required)

The total energy cost associated with the model lifecycle activity.

=item SBOM::CO2Cost C<:$co2CostEquivalent>

The CO2 cost (debit) equivalent to the total energy cost.

=item SBOM::CO2Cost C<:$co2CostOffset>

The CO2 offset (credit) for the CO2 equivalent cost.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::EnergyCost

The energy provided by the energy source for an associated activity.
Accepts these named arguments:

=item number C<:$value> (required)

Quantity of energy.

=item EnergyUnit C<:$unit> (required)

Unit of energy.

=head2 SBOM::EnergyProvider

The provider of the energy consumed by a model during its development
lifecycle activity. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the energy
provider elsewhere in the BOM.

=item Str C<:$description>

A description of the energy provider.

=item SBOM::Organization C<:$organization> (required)

The organization that provides energy.

=item Energy C<:$energySource> (required)

The energy source for the energy provider.

=item SBOM::EnergyCost C<:$energyProvided> (required)

The energy provided by the energy source for an associated activity.

=item SBOM::Reference C<:@externalReferences>

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.

=head2 SBOM::EnvironmentalConsiderations

What are the various environmental impacts a machine learning model has
exhibited across its lifecycle? Accepts these named arguments:

=item SBOM::EnergyConsumption C<:@energyConsumptions>

Describes energy consumption information incurred for one or more
component lifecycle activities.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::EthicalConsideration

What are the ethical risks involved in the application of a model?
Accepts these named arguments:

=item Str C<:$name>

The name of the risk.

=item Str C<:$mitigationStrategy>

Strategy used to address this risk.

=head2 SBOM::Event

The event data that caused the associated trigger to activate. Accepts
these named arguments:

=item Str C<:$uid>

The unique identifier of the event.

=item Str C<:$description>

A description of the event.

=item DateTime C<:$timeReceived>

The date and time (timestamp) when the event was received.

=item SBOM::Attachment C<:$data>

Encoding of the raw event data.

=item SBOM::ResourceReference C<:$source>

References the component or service that was the source of the event.

=item SBOM::ResourceReference C<:$target>

References the component or service that was the target of the event.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::EvidenceDataset

Data associated with evidence of a claim. Accepts these named
arguments:

=item Str C<:$name>

The name of the data.

=item SBOM::DataContents C<:$contents>

The contents or references to the contents of the data being described.

=item Str C<:$classification>

Data classification tags data according to its type, sensitivity, and
value if altered, stolen, or destroyed.

=item Str C<:@sensitiveData>

A description of any sensitive data included.

=item SBOM::Governance C<:$governance>

Data governance captures information regarding data ownership,
stewardship, and custodianship, providing insights into the individuals
or entities responsible for managing, overseeing, and safeguarding the
data throughout its lifecycle.

=head2 SBOM::EvidenceMethod

A method used to extract and/or analyze the evidence. Accepts these
named arguments:

=item Evidence C<:$technique> (required)

The technique used in this method of analysis.

=item confidenceValue C<:$confidence> (required)

The confidence of the evidence from 0 - 1, where 1 is 100% confidence.
Confidence is specific to the technique used. Each technique of analysis
can have independent confidence.

=item Str C<:$value>

The value or contents of the evidence.

=head2 SBOM::ExecutionStep

Executes specific commands or tools in order to accomplish its owning
task as part of a sequence. Accepts these named arguments:

=item Str C<:$name>

A name for the step.

=item Str C<:$description>

A description for the step.

=item SBOM::Command C<:@commands>

Ordered list of commands or directives for the step.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::FairnessAssessment

How does the model affect groups at risk of being systematically
disadvantaged? What are the harms and benefits to the various affected
groups? Accepts these named arguments:

=item Str C<:$groupAtRisk>

The groups or individuals at risk of being systematically disadvantaged
by the model.

=item Str C<:$benefits>

Expected benefits to the identified groups.

=item Str C<:$harms>

Expected harms to the identified groups.

=item Str C<:$mitigationStrategy>

With respect to the benefits and harms outlined, please describe any
mitigation strategy implemented.

=head2 SBOM::Formulation

Describes how a component or service was manufactured or deployed. This
is achieved through the use of formulas, workflows, tasks, and steps,
which declare the precise steps to reproduce along with the observed
formulas describing the steps which transpired in the manufacturing
process. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the formula
elsewhere in the BOM.

=item SBOM::Component C<:@components>

Transient components that are used in tasks that constitute one or more
of this formula's workflows.

=item SBOM::Service C<:@services>

Transient services that are used in tasks that constitute one or more
of this formula's workflows.

=item SBOM::Workflow C<:@workflows>

List of workflows that can be declared to accomplish specific
orchestrated goals and independently triggered.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::Frame

Within a call stack, a frame is a discrete unit that encapsulates an
execution context, including local variables, parameters, and the return
address. As function calls are made, frames are pushed onto the stack,
forming an array-like structure that orchestrates the flow of program
execution and manages the sequence of function invocations. Accepts
these named arguments:

=item Str C<:$package>

A package organizes modules into namespaces, providing a unique
namespace for each type it contains.

=item Str C<:$module> (required)

A module or class that encloses functions/methods and other code.

=item Str C<:$function>

A block of code designed to perform a particular task.

=item Str C<:@parameters>

Optional arguments that are passed to the module or function.

=item PositiveInt C<:$line>

The line number the code that is called resides on.

=item PositiveInt C<:$column>

The column the code that is called resides.

=item Str C<:$fullFilename>

The full path and filename of the module.

=head2 SBOM::Governance

Data governance captures information regarding data ownership,
stewardship, and custodianship, providing insights into the individuals
or entities responsible for managing, overseeing, and safeguarding the
data throughout its lifecycle. Accepts these named arguments:

=item SBOM::Governor C<:@custodians>

Data custodians are responsible for the safe custody, transport, and
storage of data.

=item SBOM::Governor C<:@stewards>

Data stewards are responsible for data content, context, and associated
business rules.

=item SBOM::Governor C<:@owners>

Data owners are concerned with risk and appropriate access to data.

=head2 SBOM::Governor

A person or organization governing data Accepts these named arguments:

=item SBOM::Organization C<:$organization>

A governing organization

=item SBOM::Contact C<:$contact>

A governing individual

=head2 SBOM::Graphic

A single graphic Accepts these named arguments:

=item Str C<:$name>

The name of the graphic.

=item SBOM::Attachment C<:$image>

The graphic (vector or raster).

=head2 SBOM::Graphics

A collection of graphics that represent various measurements. Accepts
these named arguments:

=item Str C<:$description>

A description of this collection of graphics.

=item SBOM::Graphic C<:@collection>

A collection of graphics.

=head2 SBOM::HashedString

A hashed representation of data Accepts these named arguments:

=item HashAlgorithm C<:$alg> (required)

The algorithm that generated the hash value.

=item contentHash C<:$content> (required)

The value of the hash.

=head2 SBOM::Identity

Evidence that substantiates the identity of a component. Accepts these
named arguments:

=item Field C<:$field> (required)

The identity field of the component which the evidence describes.

=item confidenceValue C<:$confidence>

The overall confidence of the evidence from 0 - 1, where 1 is 100%
confidence.

=item Str C<:$concludedValue>

The value of the field (cpe, purl, etc) that has been concluded based
on the aggregate of all methods (if available).

=item SBOM::EvidenceMethod C<:@methods>

The methods used to extract and/or analyze the evidence.

=item bom-refOrLink C<:@tools>

The object in the BOM identified by its bom-ref. This is often a
component or service but may be any object type supporting bom-refs.
Tools used for analysis should already be defined in the BOM, either in
the metadata/tools, components, or formulation.

=head2 SBOM::IKEv2TransformTypes

The IKEv2 transform types supported (types 1-4), defined in RFC 7296
section 3.3.2, and additional properties. Accepts these named arguments:

=item Str C<:@encr>

Transform Type 1: encryption algorithms.

=item Str C<:@prf>

Transform Type 2: pseudorandom functions.

=item Str C<:@integ>

Transform Type 3: integrity algorithms.

=item Str C<:@ke>

Transform Type 4: Key Exchange Method (KE) per RFC 9370, formerly
called Diffie-Hellman Group (D-H).

=item Bool C<:$esn>

Specifies if an Extended Sequence Number (ESN) is used.

=item IDnotbomLink C<:@auth>

IKEv2 Authentication methods: identifier for referable and therefore
interlinkable elements.

=head2 SBOM::Input

Type that represents various input data types and formats. Accepts
these named arguments:

=item SBOM::ResourceReference C<:$source>

A reference to the component or service that provided the input to the
task (e.g., reference to a service with data flow value of inbound)

=item SBOM::ResourceReference C<:$target>

A reference to the component or service that received or stored the
input if not the task itself (e.g., a local, named storage workspace)

=item SBOM::ResourceReference C<:$resource>

A reference to an independent resource provided as an input to a task
by the workflow runtime.

=item SBOM::Parameter C<:@parameters>

Inputs that have the form of parameters with names and values.

=item SBOM::Attachment C<:$data>

Inputs that have the form of data.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=item Mu C<:@environmentVars>

Inputs that have the form of parameters with names and values.

=head2 SBOM::LegacyTool

Legacy format of the description of a tool used to identify, confirm,
or score a vulnerability. Accepts these named arguments:

=item Str C<:$vendor>

The name of the vendor who created the tool.

=item Str C<:$name>

The name of the tool.

=item versionString C<:$version>

The version of the tool.

=item SBOM::HashedString C<:@hashes>

The hashes of the tool (if applicable).

=item SBOM::Reference C<:@externalReferences>

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.

=head2 SBOM::Lifecycle

Lifecycles communicate the stage(s) in which data in the BOM was
captured. Different types of data may be available at various phases of
a lifecycle, such as the Software Development Lifecycle (SDLC), IT Asset
Management (ITAM), and Software Asset Management (SAM). Thus, a BOM may
include data specific to or only obtainable in a given lifecycle.
Accepts these named arguments:

=item Phase C<:$phase>

A pre-defined phase in the product lifecycle.

=item Str C<:$name>

The name of the lifecycle phase.

=item Str C<:$description>

The description of the lifecycle phase.

=head2 SBOM::Metadata

Provides additional information about a BOM. Accepts these named
arguments:

=item DateTime C<:$timestamp>

The date and time (timestamp) when the BOM was created.

=item SBOM::Lifecycle C<:@lifecycles>

The product lifecycle(s) that this BOM represents.

=item SBOM::Organization C<:$manufacture>

[Deprecated] This will be removed in a future version. Use the
"manufacturer" instead. The organization that manufactured the component
that the BOM describes.

=item SBOM::Organization C<:$manufacturer>

The organization that created the BOM. Manufacturer is common in BOMs
created through automated processes. BOMs created through manual means
may have @.authors instead.

=item SBOM::Contact C<:@authors>

The person(s) who created the BOM. Authors are common in BOMs created
through manual processes. BOMs created through automated means may have
$.manufacturer instead.

=item SBOM::Component C<:$component>

The component that the BOM describes.

=item SBOM::Organization C<:$supplier>

The organization that supplied the component that the BOM describes.
The supplier may often be the manufacturer, but may also be a
distributor or repackager.

=item SBOM::AnyLicense C<:@licenses>

The license information for the BOM document. This may be different
from the license(s) of the component(s) that the BOM describes.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=item SBOM::LegacyTool C<:@tools>

The legacy tools used in the creation, enrichment, and validation the
BOM.

=item SBOM::Tool C<:$tools>

The tool used in the creation, enrichment, and validation of the BOM.

=head2 ADDITIONAL METHODS

=head3 update-component

Return new SBOM::Metadata object with the component specified

=head2 SBOM::ModelCard

A model card describes the intended uses of a machine learning model
and potential limitations, including biases and ethical considerations.
Model cards typically contain the training parameters, which datasets
were used to train the model, performance metrics, and other relevant
data useful for ML transparency. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the model card
elsewhere in the BOM.

=item SBOM::ModelParameters C<:$modelParameters>

Hyper-parameters for construction of the model.

=item SBOM::QuantitativeAnalysis C<:$quantitativeAnalysis>

A quantitative analysis of the model

=item SBOM::Considerations C<:$considerations>

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::ModelDataset

A dataset used to train and evaluate the model. Accepts these named
arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the dataset
elsewhere in the BOM.

=item DataSource C<:$type> (required)

The general theme or subject matter of the data being specified.

=item Str C<:$name>

The name of the dataset.

=item SBOM::DataContents C<:$contents>

The contents or references to the contents of the data being described.

=item Str C<:$classification>

Data classification tags data according to its type, sensitivity, and
value if altered, stolen, or destroyed.

=item Str C<:@sensitiveData>

A description of any sensitive data in a dataset.

=item SBOM::Graphics C<:$graphics>

A collection of graphics that represent various measurements.

=item Str C<:$description>

A description of the dataset. Can describe size of dataset, whether
it's used for source code, training, testing, or validation, etc.

=item SBOM::Governance C<:$governance>

Data governance captures information regarding data ownership,
stewardship, and custodianship, providing insights into the individuals
or entities responsible for managing, overseeing, and safeguarding the
data throughout its lifecycle.

=head2 SBOM::ModelFormat

The input / output format of a model Accepts these named arguments:

=item Str C<:$format>

The data format for input/output to the model, e.g. "string", "image",
"time-series".

=head2 SBOM::ModelParameters

Hyper-parameters for construction of the model. Accepts these named
arguments:

=item SBOM::Approach C<:$approach>

The overall approach to learning used by the model for problem solving.

=item Str C<:$task>

Directly influences the input and/or output. Examples include
classification, regression, clustering, etc.

=item Str C<:$architectureFamily>

The model architecture family such as transformer network,
convolutional neural network, residual neural network, LSTM neural
network, etc.

=item Str C<:$modelArchitecture>

The specific architecture of the model such as GPT-1, ResNet-50,
YOLOv3, etc.

=item SBOM::ModelDataset C<:@datasets>

The datasets used to train and evaluate the model.

=item SBOM::ModelFormat C<:@inputs>

The input format(s) of the model.

=item SBOM::ModelFormat C<:@outputs>

The output format(s) of the model.

=head2 SBOM::Note

A release note containing the locale and content. Accepts these named
arguments:

=item locale C<:$locale>

The ISO-639 (or higher) language code and optional ISO-3166 (or higher)
country code.

=item SBOM::Attachment C<:$text> (required)

Specifies the full content of the release note.

=head2 SBOM::Occurrence

Evidence of instance of a component spread across multiple locations.
Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the occurrence
elsewhere in the BOM

=item Str C<:$location> (required)

The location or path to where the component was found.

=item PositiveInt C<:$line>

The line number where the component was found.

=item PositiveInt C<:$offset>

The offset where the component was found.

=item Str C<:$symbol>

The symbol name that was found associated with the component.

=item Str C<:$additionalContext>

Any additional context of the detected component (e.g. a code snippet).

=head2 SBOM::Organization

An organization, as opposed to a person. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the object
elsewhere in the BOM.

=item Str C<:$name>

The name of the organization.

=item SBOM::Address C<:$address>

The physical address (location) of the organization.

=item URL C<:@url>

The URL of the organization. Multiple URLs are allowed.

=item SBOM::Contact C<:@contact>

A contact at the organization. Multiple contacts are allowed.

=head2 SBOM::Output

Represents resources and data output from a task at runtime by executor
or task commands. Accepts these named arguments:

=item OutputType C<:$type>

Describes the type of data output.

=item SBOM::ResourceReference C<:$source>

Component or service that generated or provided the output from a task
(e.g., a build tool)

=item SBOM::ResourceReference C<:$target>

Component or service that received the output from the task (e.g.,
reference to an artifactory service with data flow value of outbound).

=item SBOM::ResourceReference C<:$resource>

A reference to an independent resource generated as output by a task.

=item SBOM::Attachment C<:$data>

Outputs that have the form of data.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=item Mu C<:@environmentVars>

Outputs that have the form of environment variables.

=head2 SBOM::Parameter

A representation of a functional parameter. Accepts these named
arguments:

=item Str C<:$name>

The name of the parameter.

=item Str C<:$value>

The value of the parameter.

=item Str C<:$dataType>

The data type of the parameter.

=head2 SBOM::Patch

Specifies an individual patch Accepts these named arguments:

=item Patch C<:$type> (required)

Specifies the purpose for the patch including the resolution of
defects, security issues, or new behavior or functionality.

=item SBOM::Diff C<:$diff>

The patch file (or diff) that shows changes. Refer to
https://en.wikipedia.org/wiki/Diff

=item SBOM::Resolve C<:@resolves>

A collection of issues the patch resolves.

=head2 SBOM::Pedigree

Component pedigree is a way to document complex supply chain scenarios
where components are created, distributed, modified, redistributed,
combined with other components, etc. Pedigree supports viewing this
complex chain from the beginning, the end, or anywhere in the middle. It
also provides a way to document variants where the exact relation may
not be known. Accepts these named arguments:

=item SBOM::Component C<:@ancestors>

Describes zero or more components in which a component is derived from.
This is commonly used to describe forks from existing projects where the
forked version contains a ancestor node containing the original
component it was forked from. For example, Component A is the original
component. Component B is the component being used and documented in the
BOM. However, Component B contains a pedigree node with a single
ancestor documenting Component A - the original component from which
Component B is derived from.

=item SBOM::Component C<:@descendants>

Descendants are the exact opposite of ancestors. This provides a way to
document all forks (and their forks) of an original or root component.

=item SBOM::Component C<:@variants>

Variants describe relations where the relationship between the
components is not known. For example, if Component A contains nearly
identical code to Component B. They are both related, but it is unclear
if one is derived from the other, or if they share a common ancestor.

=item SBOM::Commit C<:@commits>

A list of zero or more commits which provide a trail describing how the
component deviates from an ancestor, descendant, or variant.

=item SBOM::Patch C<:@patches>

A list of zero or more patches describing how the component deviates
from an ancestor, descendant, or variant. Patches may be complementary
to commits or may be used in place of commits.

=item Str C<:$notes>

Notes, observations, and other non-structured commentary describing the
components pedigree.

=head2 SBOM::PerformanceMetric

The model performance metrics being reported. Examples may include
accuracy, F1 score, precision, top-3 error rates, MSC, etc. Accepts
these named arguments:

=item Str C<:$type>

The type of performance metric.

=item Str C<:$value>

The value of the performance metric.

=item Str C<:$slice>

The name of the slice this metric was computed on. By default, assume
this metric is not sliced.

=item SBOM::ConfidenceInterval C<:$confidenceInterval>

The confidence interval of the metric.

=head2 SBOM::ProofOfConcept

Evidence used to reproduce a vulnerability. Accepts these named
arguments:

=item Str C<:$reproductionSteps>

Precise steps to reproduce the vulnerability.

=item Str C<:$environment>

A description of the environment in which reproduction was possible.

=item SBOM::Attachment C<:@supportingMaterial>

Supporting material that helps in reproducing or understanding how
reproduction is possible. This may include screenshots, payloads, and
PoC exploit code.

=head2 SBOM::Property

Provides the ability to document properties in a name-value store. This
provides flexibility to include data not officially supported in the
standard without having to use additional namespaces or create
extensions. Unlike key-value stores, properties support duplicate names,
each potentially having different values. Property names of interest to
the general public are encouraged to be registered in the CycloneDX
Property Taxonomy. Formal registration is optional. Accepts these named
arguments:

=item Str C<:$name> (required)

The name of the property. Duplicate names are allowed.

=item Str C<:$value>

The value of the property.

=head2 SBOM::QuantitativeAnalysis

A quantitative analysis of a model Accepts these named arguments:

=item SBOM::PerformanceMetric C<:@performanceMetrics>

The model performance metrics being reported.

=item SBOM::Graphics C<:$graphics>

A collection of graphics that represent various measurements.

=head2 SBOM::Rating

Defines the severity or risk ratings of a vulnerability. Accepts these
named arguments:

=item SBOM::Source C<:$source>

The source that calculated the severity or risk rating of the
vulnerability.

=item number C<:$score>

The numerical score of the rating.

=item Severity C<:$severity>

Textual representation of the severity that corresponds to the
numerical score of the rating.

=item RiskMethodology C<:$method>

Specifies the severity or risk scoring methodology or standard used.

=item Str C<:$vector>

Textual representation of the metric values used to score the
vulnerability.

=item Str C<:$justification>

An optional reason for rating the vulnerability as it was.

=head2 SBOM::Reference

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.
Accepts these named arguments:

=item referenceURL C<:$url> (required)

The URI (URL or URN) to the external reference. External references are
URIs and therefore can accept any URL scheme including https (RFC-7230),
mailto (RFC-2368), tel (RFC-3966), and dns (RFC-4501). External
references may also include formally registered URNs such as CycloneDX
BOM-Link to reference CycloneDX BOMs or any object within a BOM.
BOM-Link transforms applicable external references into relationships
that can be expressed in a BOM or across BOMs.

=item Str C<:$comment>

An optional comment describing the external reference.

=item ReferenceSource C<:$type> (required)

Specifies the type of external reference.

=item SBOM::HashedString C<:@hashes>

The hashes of the external reference (if applicable).

=head2 SBOM::ReleaseNotes

=item ReleaseLevel C<:$type> (required)

The software versioning type the release note describes.

=item Str C<:$title>

The title of the release.

=item URL C<:$featuredImage>

The URL to an image that may be prominently displayed with the release
note.

=item URL C<:$socialImage>

The URL to an image that may be used in messaging on social media
platforms.

=item Str C<:$description>

A short description of the release.

=item DateTime C<:$timestamp>

The date and time (timestamp) when the release note was created.

=item Str C<:@aliases>

One or more alternate names the release may be referred to. This may
include unofficial terms used by development and marketing teams (e.g.
code names).

=item Str C<:@tags>

Textual strings that aid in discovery, search, and retrieval of the
associated object. Tags often serve as a way to group or categorize
similar or related objects by various attributes.

=item SBOM::Resolve C<:@resolves>

A collection of issues that have been resolved.

=item SBOM::Note C<:@notes>

Zero or more release notes containing the locale and content. Multiple
note objects may be specified to support release notes in a wide variety
of languages.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::Requirement

A requirement of a standard. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the object
elsewhere in the BOM.

=item Str C<:$identifier>

The unique identifier used in the standard to identify a specific
requirement. This should match what is in the standard and should not be
the requirements bom-ref.

=item Str C<:$title>

The title of the requirement.

=item Str C<:$text>

The textual content of the requirement.

=item Str C<:@descriptions>

The supplemental text that provides additional guidance or context to
the requirement, but is not directly part of the requirement.

=item CRE C<:@openCre>

The Common Requirements Enumeration (CRE) identifier(s).

=item bom-ref C<:$parent>

The optional bom-ref to a parent requirement. This establishes a
hierarchy of requirements. Top-level requirements must not define a
parent. Only child requirements should define parents.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=item SBOM::Reference C<:@externalReferences>

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.

=head2 SBOM::RequirementGrouping

The grouping of requirements to claims and the attestors declared
conformance and confidence thereof. Accepts these named arguments:

=item bom-ref C<:$requirement>

The bom-ref to the requirement being attested to.

=item bom-ref C<:@claims>

The list of bom-ref to the claims being attested to.

=item bom-ref C<:@counterClaims>

The list of bom-ref to the counter claims being attested to.

=item SBOM::Conformance C<:$conformance>

The conformance of the claim meeting a requirement.

=item SBOM::Confidence C<:$confidence>

The confidence of the claim meeting a requirement.

=head2 SBOM::RequirementLevel

The requirement level of a claim. Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the object
elsewhere in the BOM.

=item Str C<:$identifier>

The identifier used in the standard to identify a specific level.

=item Str C<:$title>

The title of the requirement.

=item Str C<:$description>

The description of the requirement.

=item bom-ref C<:@requirements>

The list of requirement bom-refs that comprise the level.

=head2 SBOM::Resolve

An issue that has been resolved. Accepts these named arguments:

=item ResolveType C<:$type> (required)

Specifies the type of issue.

=item Str C<:$id>

The identifier of the issue assigned by the source of the issue.

=item Str C<:$name>

The name of the issue.

=item Str C<:$description>

A description of the issue.

=item SBOM::Source C<:$source>

The source of the issue where it is documented.

=item URL C<:@references>

A collection of URL's for reference. Multiple URLs are allowed.

=head2 SBOM::ResourceReference

A reference to a locally defined resource (e.g., a bom-ref) or an
externally accessible resource. Accepts these named arguments:

=item bom-refOrLink C<:$ref>

References an object by its bom-ref attribute

=item SBOM::Reference C<:$externalReference>

Reference to an externally accessible resource.

=head2 SBOM::RuntimeTopology

Defines the direct dependencies of a component, service, or the
components provided/implemented by a given component. Components or
services that do not have their own dependencies must be declared as
empty elements within the graph. Components or services that are not
represented in the dependency graph may have unknown dependencies. It is
recommended that implementations assume this to be opaque and not an
indicator of an object being dependency-free. It is recommended to
leverage compositions to indicate unknown dependency graphs. Accepts
these named arguments:

=item Str C<:$ref> (required)

References a component or service by its bom-ref attribute

=item Str C<:@dependsOn>

The bom-ref identifiers of the components or services that are
dependencies of this dependency object.

=item Str C<:@provides>

The bom-ref identifiers of the components or services that define a
given specification or standard, which are provided or implemented by
this dependency object. For example, a cryptographic library which
implements a cryptographic algorithm. A component which implements
another component does not imply that the implementation is in use.

=head2 SBOM::Service

A service, which may include microservices, function-as-a-service, and
other types of network or intra-process services. Accepts these named
arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the service
elsewhere in the BOM. Every bom-ref must be unique within the BOM.

=item SBOM::Organization C<:$provider>

The organization that provides the service.

=item Str C<:$group>

The grouping name, namespace, or identifier. This will often be a
shortened, single name of the company or project that produced the
service or domain name. Whitespace and special characters should be
avoided.

=item Str C<:$name> (required)

The name of the service. This will often be a shortened, single name of
the service.

=item versionString C<:$version>

The service version.

=item Str C<:$description>

Specifies a description for the service.

=item URL C<:@endpoints>

The endpoint URIs of the service.

=item Bool C<:$authenticated>

A boolean value indicating if the service requires authentication. A
value of true indicates the service requires authentication prior to
use. A value of false indicates the service does not require
authentication.

=item Bool C<:$x-trust-boundary>

A boolean value indicating if use of the service crosses a trust zone
or boundary. A value of true indicates that by using the service, a
trust boundary is crossed. A value of false indicates that by using the
service, a trust boundary is not crossed.

=item Str C<:$trustZone>

The name of the trust zone the service resides in.

=item SBOM::ServiceDataset C<:@data>

Specifies information about the data including the directional flow of
data and the data classification.

=item SBOM::AnyLicense C<:@licenses>

EITHER (list of SPDX licenses and/or named licenses) OR (tuple of one
SPDX License Expression).

=item SBOM::Reference C<:@externalReferences>

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.

=item SBOM::Service C<:@services>

A list of services included or deployed behind the parent service. This
is not a dependency tree. It provides a way to specify ai hierarchical
representation of service assemblies. All items must be unique.

=item SBOM::ReleaseNotes C<:$releaseNotes>

Specifies optional release notes.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=item Str C<:@tags>

Textual strings that aid in discovery, search, and retrieval of the
associated object. Tags often serve as a way to group or categorize
similar or related objects by various attributes.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::ServiceDataset

A dataset associated with a service. Accepts these named arguments:

=item DataFlow C<:$flow> (required)

Specifies the flow direction of the data, relative to the service.

=item Str C<:$classification> (required)

Data classification tags data according to its type, sensitivity, and
value if altered, stolen, or destroyed.

=item Str C<:$name>

Name for the defined data.

=item Str C<:$description>

Short description of the data content and usage.

=item SBOM::Governance C<:$governance>

Data governance captures information regarding data ownership,
stewardship, and custodianship, providing insights into the individuals
or entities responsible for managing, overseeing, and safeguarding the
data throughout its lifecycle.

=item Endpoint C<:@source>

The URI, URL, or BOM-Link of the components or services the data came
in from.

=item Endpoint C<:@destination>

The URI, URL, or BOM-Link of the components or services the data is
sent to.

=head2 SBOM::Signatory

A signatories authorized on behalf of an organization to assert
validity of this document. Accepts these named arguments:

=item Str C<:$name>

The signatory's name.

=item Str C<:$role>

The signatory's role within an organization.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=item SBOM::Organization C<:$organization>

The signatory's organization.

=item SBOM::Reference C<:$externalReference>

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.

=head2 SBOM::Source

Defines a source of documentation, e.g. about vulnerabilities. Accepts
these named arguments:

=item URL C<:$url>

The url of documentation as provided by the source.

=item Str C<:$name>

The name of the source.

=head2 SBOM::SourceReference

A reference to a source that published a vulnerability. Accepts these
named arguments:

=item Str C<:$id>

An identifier that uniquely identifies the vulnerability.

=item SBOM::Source C<:$source>

The source that published the vulnerability.

=head2 SBOM::Standard

A standard which may consist of regulations, industry or
organizational-specific standards, maturity models, best practices, or
any other requirements which can be evaluated against or attested to.
Accepts these named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the object
elsewhere in the BOM.

=item Str C<:$name>

The name of the standard. This will often be a shortened, single name
of the standard.

=item Str C<:$version>

The version of the standard.

=item Str C<:$description>

The description of the standard.

=item Str C<:$owner>

The owner of the standard, often the entity responsible for its
release.

=item SBOM::Requirement C<:@requirements>

The list of requirements comprising the standard.

=item SBOM::RequirementLevel C<:@levels>

The list of levels associated with the standard. Some standards have
different levels of compliance.

=item SBOM::Reference C<:@externalReferences>

External references provide a way to document systems, sites, and
information that may be relevant but are not included with the BOM. They
may also establish specific relationships within or external to the BOM.

=item SBOM::ValidSignature C<:$signature>

Enveloped signature in JSON Signature Format (JSF).

=head2 SBOM::SWID

Asserts the identity of the component using ISO-IEC 19770-2 Software
Identification (SWID) Tags. Refer to @.evidence.identity to optionally
provide evidence that substantiates the assertion of the component's
identity. Accepts these named arguments:

=item Str:D C<:$tagId> (required)

Maps to the tagId of a SoftwareIdentity.

=item Str:D C<:$name> (required)

Maps to the name of a SoftwareIdentity.

=item Str:D C<:$version>

Maps to the version of a SoftwareIdentity.

=item Int:D C<:$tagVersion>

Maps to the tagVersion of a SoftwareIdentity.

=item Bool:D C<:$patch>

Maps to the patch of a SoftwareIdentity.

=item SBOM::Attachment C<:$text>

Specifies the metadata and content of the SWID tag.

=item URL C<:$url>

The URL to the SWID file.

=head2 SBOM::Target

A target against which claims are made. Accepts these named arguments:

=item SBOM::Organization C<:@organizations>

The list of organizations which claims are made against.

=item SBOM::Component C<:@components>

The list of components which claims are made against.

=item SBOM::Service C<:@services>

The list of services which claims are made against.

=head2 SBOM::Task

Describes the inputs, sequence of steps and resources used to
accomplish a task and its output. Accepts these named arguments:

=item bom-ref C<:$bom-ref> (required)

An optional identifier which can be used to reference the task
elsewhere in the BOM.

=item Str C<:$uid> (required)

The unique identifier for the resource instance within its deployment
context.

=item Str C<:$name>

The name of the resource instance.

=item Str C<:$description>

A description of the resource instance.

=item SBOM::ResourceReference C<:@resourceReferences>

References to component or service resources that are used to realize
the resource instance.

=item TaskActivity C<:@taskTypes> (required)

Indicates the types of activities performed by the set of workflow
tasks.

=item SBOM::Trigger C<:$trigger>

The trigger that initiated the task.

=item SBOM::ExecutionStep C<:@steps>

The sequence of steps for the task.

=item SBOM::Input C<:@inputs>

Represents resources and data brought into a task at runtime by
executor or task commands.

=item SBOM::Output C<:@outputs>

Represents resources and data output from a task at runtime by executor
or task commands

=item DateTime C<:$timeStart>

The date and time (timestamp) when the task started.

=item DateTime C<:$timeEnd>

The date and time (timestamp) when the task ended.

=item SBOM::Workspace C<:@workspaces>

A set of named filesystem or data resource shareable by workflow tasks.

=item SBOM::RuntimeTopology C<:@runtimeTopology>

A graph of the component runtime topology for task's instance.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::Tool

Description of a tool used to identify, confirm, or score a
vulnerability. Accepts these named arguments:

=item SBOM::Component C<:@components>

A list of software and hardware components used as tools.

=item SBOM::Service C<:@services>

A list of services used as tools. This may include microservices,
function-as-a-service, and other types of network or intra-process
services.

=head2 SBOM::Trigger

The trigger that initiated a task. Accepts these named arguments:

=item bom-ref C<:$bom-ref> (required)

An optional identifier which can be used to reference the trigger
elsewhere in the BOM.

=item Str C<:$uid> (required)

The unique identifier for the resource instance within its deployment
context.

=item Str C<:$name>

The name of the resource instance.

=item Str C<:$description>

A description of the resource instance.

=item SBOM::ResourceReference C<:@resourceReferences>

References to component or service resources that are used to realize
the resource instance.

=item TriggerEvent C<:$type>

The source type of event which caused the trigger to fire.

=item SBOM::Event C<:$event>

The event data that caused the associated trigger to activate.

=item SBOM::Condition C<:@conditions>

A list of conditions used to determine if a trigger should be
activated.

=item DateTime C<:$timeActivated>

The date and time (timestamp) when the trigger was activated.

=item SBOM::Input C<:@inputs>

Represents resources and data brought into a task at runtime by
executor or task commands.

=item SBOM::Output C<:@outputs>

Represents resources and data output from a task at runtime by executor
or task commands.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::Volume

Information about the actual volume instance allocated to the
workspace. Accepts these named arguments:

=item Str C<:$uid>

The unique identifier for the volume instance within its deployment
context.

=item Str C<:$name>

The name of the volume instance.

=item VolumeMode C<:$mode>

The mode for the volume instance.

=item Str C<:$path>

The underlying path created from the actual volume.

=item Str C<:$sizeAllocated>

The allocated size of the volume accessible to the associated
workspace. This should include the scalar size as well as IEC standard
unit in either decimal or binary form.

=item Bool C<:$persistent>

Indicates if the volume persists beyond the life of the resource it is
associated with.

=item Bool C<:$remote>

Indicates if the volume is remotely (i.e., network) attached.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::Vulnerability

A Vulnerability identified in components or services Accepts these
named arguments:

=item bom-ref C<:$bom-ref>

An optional identifier which can be used to reference the vulnerability
elsewhere in the BOM.

=item Str C<:$id>

The identifier that uniquely identifies the vulnerability.

=item SBOM::Source C<:$source>

The source that published the vulnerability.

=item SBOM::SourceReference C<:@references>

Zero or more pointers to vulnerabilities that are the equivalent of the
vulnerability specified. Often times, the same vulnerability may exist
in multiple sources of vulnerability intelligence, but have different
identifiers. References provide a way to correlate vulnerabilities
across multiple sources of vulnerability intelligence.

=item SBOM::Rating C<:@ratings>

List of vulnerability ratings.

=item PositiveInt C<:@cwes>

List of Common Weaknesses Enumerations (CWEs) codes that describes this
vulnerability. For example 399 (of
https://cwe.mitre.org/data/definitions/399.html).

=item Str C<:$description>

A description of the vulnerability as provided by the source.

=item Str C<:$detail>

If available, an in-depth description of the vulnerability as provided
by the source organization. Details often include information useful in
understanding root cause.

=item Str C<:$recommendation>

Recommendations of how the vulnerability can be remediated or
mitigated.

=item Str C<:$workaround>

A bypass, usually temporary, of the vulnerability that reduces its
likelihood and/or impact. Workarounds often involve changes to
configuration or deployments.

=item SBOM::ProofOfConcept C<:$proofOfConcept>

Evidence used to reproduce the vulnerability.

=item SBOM::Advisory C<:@advisories>

Published advisories of the vulnerability if provided.

=item DateTime C<:$created>

The date and time (timestamp) when the vulnerability record was created
in the vulnerability database.

=item DateTime C<:$published>

The date and time (timestamp) when the vulnerability record was first
published.

=item DateTime C<:$updated>

The date and time (timestamp) when the vulnerability record was last
updated.

=item DateTime C<:$rejected>

The date and time (timestamp) when the vulnerability record was
rejected (if applicable).

=item SBOM::Credits C<:$credits>

Individuals or organizations credited with the discovery of the
vulnerability.

=item SBOM::Analysis C<:$analysis>

An assessment of the impact and exploitability of the vulnerability.

=item SBOM::Affects C<:@affects>

The components or services that are affected by the vulnerability.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=item SBOM::LegacyTool C<:@tools>

The legacy tools used to identify, confirm, or score the vulnerability.

=item SBOM::Tool C<:$tools>

The tool used to identify, confirm, or score the vulnerability.

=head2 SBOM::Workflow

A specialized orchestration task. Accepts these named arguments:

=item bom-ref C<:$bom-ref> (required)

An optional identifier which can be used to reference the workflow
elsewhere in the BOM.

=item Str C<:$uid> (required)

The unique identifier for the resource instance within its deployment
context.

=item Str C<:$name>

The name of the resource instance.

=item Str C<:$description>

A description of the resource instance.

=item SBOM::ResourceReference C<:@resourceReferences>

References to component or service resources that are used toi realize
the resource instance.

=item SBOM::Task C<:@tasks>

The tasks that comprise the workflow.

=item SBOM::Dependency C<:@taskDependencies>

The graph of dependencies between tasks within the workflow.

=item TaskActivity C<:@taskTypes>

Indicates the types of activities performed by the set of workflow
tasks.

=item SBOM::Trigger C<:$trigger>

The trigger that initiated the task.

=item SBOM::ExecutionStep C<:@steps>

The sequence of steps for the task.

=item SBOM::Input C<:@inputs>

Represents resources and data brought into a task at runtime by
executor or task commands.

=item SBOM::Input C<:@outputs>

Represents resources and data output from a task at runtime by executor
or task commands.

=item DateTime C<:$timeStart>

The date and time (timestamp) when the task started.

=item DateTime C<:$timeEnd>

The date and time (timestamp) when the task ended.

=item SBOM::Workspace C<:@workspaces>

A set of named filesystem or data resource shareable by workflow tasks.

=item SBOM::RuntimeTopology C<:@runtimeTopology>

A graph of the component runtime topology for task's instance.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head2 SBOM::Workspace

A named filesystem or data resource shareable by workflow tasks.
Accepts these named arguments:

=item bom-ref C<:$bom-ref> (required)

An optional identifier which can be used to reference the workspace
elsewhere in the BOM.

=item Str C<:$uid> (required)

The unique identifier for the resource instance within its deployment
context.

=item Str C<:$name>

The name of the resource instance.

=item Str C<:@aliases>

The names for the workspace as referenced by other workflow tasks.
Effectively, a name mapping so other tasks can use their own local name
in their steps.

=item Str C<:$description>

A description of the resource instance.

=item SBOM::ResourceReference C<:@resourceReferences>

References to component or service resources that are used to realize
the resource instance.

=item AccessMode C<:$accessMode>

Describes the read-write access Acontrol for the workspace relative to
the owning resource instance.

=item Str C<:$mountPath>

A path to a location on disk where the workspace will be available to
the associated task's steps.

=item Str C<:$managedDataType>

The name of a domain-specific data type the workspace represents.

=item Str C<:$volumeRequest>

Identifies the reference to the request for a specific volume type and
parameters.

=item SBOM::Volume C<:$volume>

Information about the actual volume instance allocated to the
workspace.

=item SBOM::Property C<:@properties>

Any additional properties as name-value pairs.

=head1 SUBSETS PROVIDED

=head2 bom-ref

Identifier which can be used to reference a component in the BOM. Every
bom-ref must be unique within the BOM. Must be at least 1 characters
long.

=head2 bom-refOrLink

Reference that is either a bom-ref or a bomLinkElement

=head2 confidenceValue

The confidence value between and inclusive of 0 and 1, where 1 is 100%
confidence.

=head2 conformanceValue

The conformance value between and inclusive of 0 and 1, where 1 is 100%
conformant.

=head2 contentHash

The value of a hash. Must match regular expression:
^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$.

=head2 CPE

A CPE must conform to the CPE 2.2 or 2.3 specification. See
https://nvd.nist.gov/products/cpe.

=head2 CRE

A Common Requirements Enumeration (CRE) identifier. CRE is a structured
and standardized framework for uniting security standards and
guidelines. CRE links each section of a resource to a shared topic
identifier (a Common Requirement). Through this shared topic link, all
resources map to each other. Use of CRE promotes clear and unambiguous
communication among stakeholders.

=head2 email

An email address.

=head2 Endpoint

An endpoint for a source or destination of data.

=head2 IDnotbomLink

Identifier for referable and therefore interlinkable elements. Value
SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts
|with BOM-Links.

=head2 locale

The ISO-639 (or higher) language code and optional ISO-3166 (or higher)
country code. Examples include: "en", "en-US", "fr" and "fr-CA". Must
match regular expression: ^([a-z]{2})(-[A-Z]{2})?$.

=head2 mime-type

A MIME-type. Must match regular expression: ^[-+a-z0-9.]+/[-+a-z0-9.]+$

=head2 nistQuantumSecurityLevel

The NIST security strength category as defined in
https://csrc.nist.gov/projects/post-quantum-cryptography/post-quantum-cryptography-standardization/evaluation-criteria/security-(evaluation-criteria).
A value of 0 indicates that none of the categories are met.

=head2 number

A numeric value.

=head2 omniborId

An OmniBOR Artifact ID. The OmniBOR, if specified, must be valid and
conform to the specification defined at:
https://www.iana.org/assignments/uri-schemes/prov/gitoid.

=head2 PositiveInt

A positive integer value (> 0).

=head2 propertyName

A reference to the property name as defined in the CycloneDX Property
Taxonomy.

=head2 purl

A package-url (purl). The purl, if specified, must be valid and conform
to the specification defined at:
https://github.com/package-url/purl-spec.

=head2 referenceURL

Either a URL, a bomLinkDocument or a bomLinkElement.

=head2 serialNumber

Every BOM generated SHOULD have a unique serial number, even if the
contents of the BOM have not changed over time. If specified, the serial
number must conform to RFC 4122. Use of serial numbers is recommended.
Must match regular expression:
^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

=head2 SWHID

A Software Heritage persistent identifier (SWHID). The SWHID, if
specified, must be valid and conform to the specification defined at:
https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html.

=head2 UInt

An unsigned integer value (>= 0)

=head2 URL

A URL.

=head2 versionRange

A version range specified in Package URL Version Range syntax (vers)
which is defined at
https://github.com/package-url/purl-spec/blob/master/VERSION-RANGE-SPEC.rst

=head2 versionString

A version should ideally comply with semantic versioning but is not
enforced. Must be at most 1024 characters long.

=head1 SUBSETS API

The C<SBOM::subsets> module provides a number of functional
L<C<subset>s|https://docs.raku.org/language/typesystem#subset>.

=begin code :lang<raku>
use SBOM::subsets;  # import *all* subsets

my email $email = "foo@bar.com";  # works
my email $meh   = "foo";
# Type check failed in assignment to $a; expected email but got Str ("foo")
=end code

=begin code :lang<raku>
use SBOM::subsets <email>;  # Just import "email" subset
=end code

If only interested in one or more subsets, then these can be specified
as positional arguments in the C<use> statement.

=head1 ENUMS PROVIDED

=head2 AccessMode

Describes the read-write access control for a workspace relative to the
owning resource instance.

Supported strings:
=item read-only
=item read-write
=item read-write-once
=item write-once
=item write-only

=head2 Acknowledgement

Declared licenses and concluded licenses represent two different stages
in the licensing process within software development. Declared licenses
refer to the initial intention of the software authors regarding the
licensing terms under which their code is released. On the other hand,
concluded licenses are the result of a comprehensive analysis of the
project's codebase to identify and confirm the actual licenses of the
components used, which may differ from the initially declared licenses.
While declared licenses provide an upfront indication of the licensing
intentions, concluded licenses offer a more thorough understanding of
the actual licensing within a project, facilitating proper compliance
and risk management. Observed licenses are defined in
@.evidence.licenses. Observed licenses form the evidence necessary to
substantiate a concluded license.

Supported strings:
=item concluded
=item declared

=head2 Activity

The type of activity that is part of a machine learning model
development or operational lifecycle.

Supported strings:
=item data-collection
=item data-preparation
=item deployment
=item design
=item fine-tuning
=item inference
=item other
=item training
=item validation

=head2 Aggregate

Specifies an aggregate type that describes how complete a relationship
is.

Supported strings:
=item complete
=item incomplete
=item incomplete_first_party_only
=item incomplete_first_party_opensource_only
=item incomplete_first_party_proprietary_only
=item incomplete_third_party_only
=item incomplete_third_party_opensource_only
=item incomplete_third_party_proprietary_only
=item not_specified
=item unknown

=head2 AlgorithmPrimitive

Cryptographic building blocks used in higher-level cryptographic
systems and protocols. Primitives represent different cryptographic
routines: deterministic random bit generators (drbg, e.g. CTR_DRBG from
NIST SP800-90A-r1), message authentication codes (mac, e.g.
HMAC-SHA-256), blockciphers (e.g. AES), streamciphers (e.g. Salsa20),
signatures (e.g. ECDSA), hash functions (e.g. SHA-256), public-key
encryption schemes (pke, e.g. RSA), extended output functions (xof, e.g.
SHAKE256), key derivation functions (e.g. pbkdf2), key agreement
algorithms (e.g. ECDH), key encapsulation mechanisms (e.g. ML-KEM),
authenticated encryption (ae, e.g. AES-GCM) and the combination of
multiple algorithms (combiner, e.g. SP800-56Cr2).

Supported strings:
=item ae
=item block-cipher
=item combiner
=item drbg
=item hash
=item kdf
=item kem
=item key-agree
=item mac
=item other
=item pke
=item signature
=item stream-cipher
=item unknown
=item xof

=head2 BOMFormat

Specifies the format of the BOM. This helps to identify the file as
CycloneDX since BOMs do not have a filename convention, nor does JSON
schema support namespaces.

Supported strings:
=item CycloneDX

=head2 CO2Cost

Unit of CO2 cost.

Supported strings:
=item tCO2eq

=head2 Certification

The certification that an implementation of a cryptographic algorithm
has received. Certifications include revisions and levels of FIPS 140 or
Common Criteria of different Extended Assurance Levels (CC-EAL).

Supported strings:
=item cc-eal1
=item cc-eal1+
=item cc-eal2
=item cc-eal2+
=item cc-eal3
=item cc-eal3+
=item cc-eal4
=item cc-eal4+
=item cc-eal5
=item cc-eal5+
=item cc-eal6
=item cc-eal6+
=item cc-eal7
=item cc-eal7+
=item fips140-1-l1
=item fips140-1-l2
=item fips140-1-l3
=item fips140-1-l4
=item fips140-2-l1
=item fips140-2-l2
=item fips140-2-l3
=item fips140-2-l4
=item fips140-3-l1
=item fips140-3-l2
=item fips140-3-l3
=item fips140-3-l4
=item none
=item other
=item unknown

=head2 CertificationMode

The mode of operation in which a cryptographic algorithm (block cipher)
is used.

Supported strings:
=item cbc
=item ccm
=item cfb
=item ctr
=item ecb
=item gcm
=item ofb
=item other
=item unknown

=head2 CertificationPadding

The padding scheme that is used for a cryptographic algorithm.

Supported strings:
=item oaep
=item other
=item pkcs1v15
=item pkcs5
=item pkcs7
=item raw
=item unknown

=head2 ComponentType

Specifies the type of a component.

Supported strings:
=item application
=item container
=item cryptographic-asset
=item data
=item device
=item device-driver
=item file
=item firmware
=item framework
=item library
=item machine-learning-model
=item operating-system
=item platform

=head2 Crypto

The type for the related cryptographic material.

Supported strings:
=item additional-data
=item ciphertext
=item credential
=item digest
=item initialization-vector
=item key
=item nonce
=item other
=item password
=item private-key
=item public-key
=item salt
=item secret-key
=item seed
=item shared-secret
=item signature
=item tag
=item token
=item unknown

=head2 CryptoAsset

Cryptographic assets occur in several forms. Algorithms and protocols
are most commonly implemented in specialized cryptographic libraries.
They may, however, also be 'hardcoded' in software components.
Certificates and related cryptographic material like keys, tokens,
secrets or passwords are other cryptographic assets to be modelled.

Supported strings:
=item algorithm
=item certificate
=item protocol
=item related-crypto-material

=head2 CryptoFunction

A cryptographic function implemented by a cryptographic algorithm.

Supported strings:
=item decapsulate
=item decrypt
=item digest
=item encapsulate
=item encrypt
=item generate
=item keyderive
=item keygen
=item other
=item sign
=item tag
=item unknown
=item verify

=head2 CryptoKey

Public key type indicator.

Supported strings:
=item EC
=item OKP
=item RSA

=head2 CryptoProtocol

A concrete cryptographic protocol type.

Supported strings:
=item ike
=item ipsec
=item other
=item ssh
=item sstp
=item tls
=item unknown
=item wpa

=head2 CryptoState

The key state as defined by NIST SP 800-57.

Supported strings:
=item active
=item compromised
=item deactivated
=item destroyed
=item pre-activation
=item suspended

=head2 DataFlow

Specifies information about the directional flow of data.

Supported strings:
=item bi-directional
=item inbound
=item outbound
=item unknown

=head2 DataSource

The general theme or subject matter of model data being specified.

Supported strings:
=item configuration
=item dataset
=item definition
=item other
=item source-code

=head2 ECCurve

EC curve name.

Supported strings:
=item P-256
=item P-384
=item P-521

=head2 EdDSA

EdDSA curve name.

Supported strings:
=item Ed25519
=item Ed448

=head2 Encoding

Specifies the optional encoding a text is represented in.

Supported strings:
=item base64

=head2 Energy

The energy source of an energy provider.

Supported strings:
=item biofuel
=item coal
=item geothermal
=item hydropower
=item natural-gas
=item nuclear
=item oil
=item other
=item solar
=item unknown
=item wind

=head2 EnergyUnit

Unit of energy.

Supported strings:
=item kWh

=head2 Evidence

A technique used in method of analysis.

Supported strings:
=item ast-fingerprint
=item attestation
=item binary-analysis
=item dynamic-analysis
=item filename
=item hash-comparison
=item instrumentation
=item manifest-analysis
=item other
=item source-code-analysis

=head2 ExecutionEnvironment

The target and execution environment in which an algorithm is
implemented in.

Supported strings:
=item hardware
=item other
=item software-encrypted-ram
=item software-plain-ram
=item software-tee
=item unknown

=head2 Field

The identity field of the component which an evidence describes.

Supported strings:
=item cpe
=item group
=item hash
=item name
=item omniborId
=item purl
=item swhid
=item swid
=item version

=head2 HashAlgorithm

An algorithm to generate a hash value with.

Supported strings:
=item BLAKE2b-256
=item BLAKE2b-384
=item BLAKE2b-512
=item BLAKE3
=item MD5
=item SHA-1
=item SHA-256
=item SHA-384
=item SHA-512
=item SHA3-256
=item SHA3-384
=item SHA3-512

=head2 Justification

The rationale of why the impact analysis state was asserted.

Supported strings:
=item code_not_present
=item code_not_reachable
=item protected_at_perimeter
=item protected_at_runtime
=item protected_by_compiler
=item protected_by_mitigating_control
=item requires_configuration
=item requires_dependency
=item requires_environment

=head2 Learning

Learning types describing the learning problem or hybrid learning
problem.

Supported strings:
=item reinforcement-learning
=item self-supervised
=item semi-supervised
=item supervised
=item unsupervised

=head2 LicenseGranted

A type of license that was granted to the licensee.

Supported strings:
=item academic
=item appliance
=item client-access
=item concurrent-user
=item core-points
=item custom-metric
=item device
=item evaluation
=item named-user
=item node-locked
=item oem
=item other
=item perpetual
=item processor-points
=item subscription
=item user

=head2 LicenseId

A valid SPDX license identifier. Also gives access to any associated
URL with more information about the license.

699 strings supported.

=head2 LicenseName

A valid SPDX license name.

686 strings supported.

=head2 OutputType

Describes the type of data output.

Supported strings:
=item artifact
=item attestation
=item evidence
=item log
=item metrics
=item other

=head2 Patch

Specifies the purpose for the patch including the resolution of
defects, security issues, or new behavior or functionality.

Supported strings:
=item backport
=item cherry-pick
=item monkey
=item unofficial

=head2 Phase

Lifecycles communicate the stage(s) in which data in the BOM was
captured. Different types of data may be available at various phases of
a lifecycle, such as the Software Development Lifecycle (SDLC), IT Asset
Management (ITAM), and Software Asset Management (SAM). Thus, a BOM may
include data specific to or only obtainable in a given lifecycle.

Supported strings:
=item build
=item decommision
=item design
=item discovery
=item operations
=item post-build
=item pre-build

=head2 Platform

A platform for which an algorithm is implemented.

Supported strings:
=item armv7-a
=item armv7-m
=item armv8-a
=item armv8-m
=item armv9-a
=item armv9-m
=item generic
=item other
=item ppc64
=item ppc64le
=item s390x
=item unknown
=item x86_32
=item x86_64

=head2 ReferenceSource

Specifies the type of external reference.

Supported strings:
=item adversary-model
=item advisories
=item attestation
=item bom
=item build-meta
=item build-system
=item certification-report
=item chat
=item codified-infrastructure
=item component-analysis-report
=item configuration
=item digital-signature
=item distribution
=item distribution-intake
=item documentation
=item dynamic-analysis-report
=item electronic-signature
=item evidence
=item exploitability-statement
=item formulation
=item issue-tracker
=item license
=item log
=item mailing-list
=item maturity-report
=item model-card
=item other
=item pentest-report
=item poam
=item quality-metrics
=item release-notes
=item rfc-9116
=item risk-assessment
=item runtime-analysis-report
=item security-contact
=item social
=item source-distribution
=item static-analysis-report
=item support
=item threat-model
=item vcs
=item vulnerability-assertion
=item website

=head2 ReleaseLevel

The software versioning type of a release note.

Supported strings:
=item internal
=item major
=item minor
=item patch
=item pre-release

=head2 ResolveType

A type of issue resolvement.

Supported strings:
=item defect
=item enhancement
=item security

=head2 Response

A response to the vulnerability by the manufacturer, supplier, or
project responsible for the affected component or service. Responses are
strongly encouraged for vulnerabilities where the analysis state is
exploitable.

Supported strings:
=item can_not_fix
=item rollback
=item update
=item will_not_fix
=item workaround_available

=head2 RiskMethodology

Specifies the severity or risk scoring methodology or standard used.

Supported strings:
=item CVSSv2
=item CVSSv3
=item CVSSv31
=item CVSSv4
=item OWASP
=item SSVC
=item other

=head2 Scope

The scope of a component.

Supported strings:
=item excluded
=item optional
=item required

=head2 Severity

Textual representation of a severity.

Supported strings:
=item critical
=item high
=item info
=item low
=item medium
=item none
=item unknown

=head2 SignatureAlgorithm

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037
[RFC8037] asymmetric key algorithms. Unlike RFC8037 [RFC8037] JSF
requires explicit Ed* algorithm names instead ofi "EdDSA".

Supported strings:
=item ES256
=item ES384
=item ES512
=item Ed25519
=item Ed448
=item HS256
=item HS384
=item HS512
=item PS256
=item PS384
=item PS512
=item RS256
=item RS384
=item RS512

=head2 TaskActivity

Indicates the types of activities performed by the set of workflow
tasks.

Supported strings:
=item build
=item clean
=item clone
=item copy
=item deliver
=item deploy
=item lint
=item merge
=item other
=item release
=item scan
=item test

=head2 TriggerEvent

The source type of event which caused a trigger to fire.

Supported strings:
=item api
=item manual
=item scheduled
=item webhook

=head2 VersionAffection

The vulnerability status for the version or range of versions.

Supported strings:
=item affected
=item unaffected
=item unknown

=head2 VolumeMode

The mode for a volume instance.

Supported strings:
=item block
=item filesystem

=head2 VulnerabilityState

Declares the current state of an occurrence of a vulnerability, after
automated or manual analysis.

Supported strings:
=item exploitable
=item false_positive
=item in_triage
=item not_affected
=item resolved
=item resolved_with_pedigree

=head1 ENUMS API

The C<SBOM::enums> module provides a number of functional enum values.
Note however that these are B<NOT> enums in the pure Raku sense, but
Raku classes doing the C<Enumify> role.  This to allow for an easy check
to see whether a given string is allowed for the given "enum".

=begin code :lang<raku>
use SBOM::enums;  # import *all* enum classes

say ComponentType<application>;  # ComponentType("application")
say ComponentType<foo>;          # Nil

say ComponentType{$name};
=end code

One can check for the validity of a string for the given enum class
by considering it an C<Associative>.

=begin code :lang<raku>
use SBOM::enums <DataFlow>;  # Just import DataFlow enum

say DataFlow.WHY;           # Specifies information about the...
say DataFlow<inbound>.WHY;  # Data that enters a service.
=end code

If only interested in one or more enum classes, then these can be
specified as positional arguments in the C<use> statement.  If one
wants to know what a specific enum class is about, one can call the
C<WHY> method on it, either on an enum instance (to get information
about that particular enum), or on the whole enum class (when called
on the enum type).

=begin code :lang<raku>
use SBOM::enums <DataFlow>;  # Just import DataFlow enum

say DataFlow.keys;  # (bi-directional inbound outbound unknown)
=end code

The C<keys> method can be called on the type object of an enum class
to get a sorted list of allowable strings.

=begin code :lang<raku>
use SBOM::enums <Enumify>;  # Just import Enumify role

say Enumify.keys;   # (AccessMode Acknowledgement Activity...
=end code

The C<keys> method can also be called on the underlying C<Enumify>
role to obtain a sorted list of the names of all classes of enums
available.

=head1 THANKS

This module wouldn't exist without the nudging and support of
I<Salve J. Nilsen>.

=head1 CREDITS

The SBOM test files in the C<t/valid> directory were taken from
L<Giuseppe Di Terlizzi's SBOM::CycloneDX repository|https://github.com/giterlizzi/perl-SBOM-CycloneDX/>.

=head1 AUTHOR

Elizabeth Mattijsen <liz@raku.rocks>

Source can be located at: https://github.com/lizmat/SBOM-CycloneDX .
Comments and Pull Requests are welcome.

If you like this module, or what I’m doing more generally, committing to a
L<small sponsorship|https://github.com/sponsors/lizmat/>  would mean a great
deal to me!

=head1 COPYRIGHT AND LICENSE

Copyright 2025, 2026 Elizabeth Mattijsen

This library is free software; you can redistribute it and/or modify it under the Artistic License 2.0.

=end pod

# vim: expandtab shiftwidth=4
