@mitre/hdf-schema 3.3.1 → 3.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -0
- package/dist/go/hdf.go +473 -117
- package/dist/index.d.ts +1 -0
- package/dist/index.js +26 -25
- package/dist/schemas/hdf-amendments.schema.json +53 -46
- package/dist/schemas/hdf-baseline.schema.json +58 -51
- package/dist/schemas/hdf-comparison.schema.json +846 -243
- package/dist/schemas/hdf-evidence-package.schema.json +204 -51
- package/dist/schemas/hdf-plan.schema.json +58 -51
- package/dist/schemas/hdf-results.schema.json +785 -214
- package/dist/schemas/hdf-system.schema.json +760 -187
- package/dist/ts/hdf.d.ts +517 -52
- package/dist/ts/hdf.js +42 -14
- package/dist/ts/hdf.ts +526 -52
- package/package.json +2 -2
package/dist/go/hdf.go
CHANGED
|
@@ -326,6 +326,8 @@ type Integrity struct {
|
|
|
326
326
|
// for the first amendment.
|
|
327
327
|
//
|
|
328
328
|
// Cryptographic checksum for verifying the referenced document's integrity.
|
|
329
|
+
//
|
|
330
|
+
// Cryptographic checksum of the referenced artifact for integrity verification.
|
|
329
331
|
type Checksum struct {
|
|
330
332
|
// The hash algorithm used for the checksum.
|
|
331
333
|
Algorithm HashAlgorithm `json:"algorithm"`
|
|
@@ -616,8 +618,12 @@ type Identity struct {
|
|
|
616
618
|
// The identifier value. Example: 'user@example.com', 'jdoe', 'automated-scanner-01'.
|
|
617
619
|
Identifier string `json:"identifier"`
|
|
618
620
|
// The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
|
|
619
|
-
// 'system' for
|
|
620
|
-
//
|
|
621
|
+
// 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
|
|
622
|
+
// for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
|
|
623
|
+
// apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
|
|
624
|
+
// satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
|
|
625
|
+
// 'simple' for basic string identifiers without additional classification, or 'other' for
|
|
626
|
+
// custom identity systems.
|
|
621
627
|
Type IdentityType `json:"type"`
|
|
622
628
|
}
|
|
623
629
|
|
|
@@ -858,9 +864,11 @@ type SupportedPlatform struct {
|
|
|
858
864
|
// A physical or virtual server, workstation, or network device.
|
|
859
865
|
//
|
|
860
866
|
// Base properties shared by all component types. Extends the Target concept with stable
|
|
861
|
-
// identity, external references, and
|
|
867
|
+
// identity, external references, generalized BOM attachment (boms[]), and unified artifact
|
|
868
|
+
// integrity (integrity[]).
|
|
862
869
|
//
|
|
863
|
-
// A static container image (not running).
|
|
870
|
+
// A static container image (not running). Image integrity — formerly the 'digest' field —
|
|
871
|
+
// is expressed via the shared Base_Component.integrity array.
|
|
864
872
|
//
|
|
865
873
|
// A running container instance.
|
|
866
874
|
//
|
|
@@ -874,14 +882,28 @@ type SupportedPlatform struct {
|
|
|
874
882
|
//
|
|
875
883
|
// A running application or API (for DAST tools).
|
|
876
884
|
//
|
|
877
|
-
// A software artifact or dependency (for SCA tools).
|
|
885
|
+
// A software artifact or dependency (for SCA tools). Package integrity — formerly the
|
|
886
|
+
// 'checksum' field — is expressed via the shared Base_Component.integrity array.
|
|
878
887
|
//
|
|
879
888
|
// A network segment or network device.
|
|
880
889
|
//
|
|
881
890
|
// A database instance.
|
|
891
|
+
//
|
|
892
|
+
// A thin AI-model component: identity and correlation only (parallel to Host_Component's
|
|
893
|
+
// fqdn/ip). All model detail — architecture, parameter count, serialization format, lineage
|
|
894
|
+
// — lives in an attached ai-model BOM (boms[]), never on the component itself.
|
|
895
|
+
//
|
|
896
|
+
// A thin dataset component: identity and correlation only, symmetric with
|
|
897
|
+
// AI_Model_Component. All dataset detail — record count, format, classification, lineage —
|
|
898
|
+
// lives in an attached dataset BOM (boms[]), never on the component itself.
|
|
882
899
|
type Component struct {
|
|
883
900
|
// Names of baselines that apply to this component.
|
|
884
901
|
BaselineRefs []string `json:"baselineRefs,omitempty"`
|
|
902
|
+
// Component-scoped Bills of Materials (SBOM, ai-model, dataset, or any reserved bomType),
|
|
903
|
+
// each carried by passthrough (ref/document) or normalized. Replaces the former
|
|
904
|
+
// sbom/sbomRef/sbomFormat trio; a component may carry several BOMs (e.g. an SBOM plus an
|
|
905
|
+
// ai-model BOM). See primitives/bom.schema.json.
|
|
906
|
+
Boms []BillOfMaterials `json:"boms,omitempty"`
|
|
885
907
|
// Stable UUID (RFC 4122) for this component. Required in hdf-system documents, optional in
|
|
886
908
|
// hdf-results. Enables cross-document correlation, diffing, and data flow references.
|
|
887
909
|
ComponentID *string `json:"componentId,omitempty"`
|
|
@@ -893,6 +915,13 @@ type Component struct {
|
|
|
893
915
|
ExternalIDS map[string]string `json:"externalIds,omitempty"`
|
|
894
916
|
// System-specific overrides for baseline input values.
|
|
895
917
|
InputOverrides []InputOverride `json:"inputOverrides,omitempty"`
|
|
918
|
+
// Cryptographic integrity of this component's underlying artifact — model weights or
|
|
919
|
+
// shards, dataset archive, container image, or package bytes. An array supports
|
|
920
|
+
// multi-file/sharded artifacts. This is the single, generic home for artifact/subject
|
|
921
|
+
// integrity across all component types (it replaced the former per-type Container_Image
|
|
922
|
+
// digest and Artifact checksum fields). Distinct from BOM-document integrity (Bom.hashes[])
|
|
923
|
+
// and from the document tamper-evidence Integrity type.
|
|
924
|
+
Integrity []Checksum `json:"integrity,omitempty"`
|
|
896
925
|
// Optional key-value labels for flexible grouping. Well-known keys: system, component,
|
|
897
926
|
// environment, region, team. Values must be strings.
|
|
898
927
|
Labels map[string]string `json:"labels,omitempty"`
|
|
@@ -901,21 +930,27 @@ type Component struct {
|
|
|
901
930
|
// Team or individual responsible for this component. Enables per-component ownership when
|
|
902
931
|
// different teams manage different parts of a system.
|
|
903
932
|
Owner *Identity `json:"owner,omitempty"`
|
|
904
|
-
// Embedded CycloneDX or SPDX SBOM document representing this component's software
|
|
905
|
-
// inventory. The sbomFormat field determines which format constraints apply.
|
|
906
|
-
Sbom interface{} `json:"sbom,omitempty"`
|
|
907
|
-
// Format of the SBOM (embedded or referenced). Required when sbom or sbomRef is present.
|
|
908
|
-
SbomFormat *SBOMFormat `json:"sbomFormat,omitempty"`
|
|
909
|
-
// URI reference to an external CycloneDX or SPDX SBOM document for this component. May be a
|
|
910
|
-
// relative path, absolute URI, or fragment identifier.
|
|
911
|
-
SbomRef *string `json:"sbomRef,omitempty"`
|
|
912
933
|
// Label selector to match targets belonging to this component during migration. Targets
|
|
913
934
|
// with matching labels are automatically included.
|
|
914
935
|
TargetSelector map[string]string `json:"targetSelector,omitempty"`
|
|
915
|
-
// Component type discriminator. Same values as Target types
|
|
936
|
+
// Component type discriminator. Same values as Target types, plus aiModel and dataset (thin
|
|
937
|
+
// AI subject components whose detail lives in an attached ai-model / dataset BOM).
|
|
916
938
|
Type TargetType `json:"type"`
|
|
917
|
-
//
|
|
939
|
+
// Directory domain the host is a member of — Active Directory / NetBIOS / LDAP domain (ECS
|
|
940
|
+
// host.domain semantics), NOT necessarily the DNS suffix of the FQDN. A standalone or
|
|
941
|
+
// workgroup host has a hostname but no domain. Not derivable from the FQDN; populate only
|
|
942
|
+
// from a source that carries directory membership.
|
|
943
|
+
Domain *string `json:"domain,omitempty"`
|
|
944
|
+
// Fully qualified domain name (e.g. 'web01.prod.example.com'). Distinct from 'hostname'
|
|
945
|
+
// (short) and 'domain' (directory domain). ECS recommends storing this lowercase; the
|
|
946
|
+
// schema does not enforce case so source fidelity is preserved on round-trip.
|
|
918
947
|
FQDN *string `json:"fqdn,omitempty"`
|
|
948
|
+
// Short, OS-reported host name (the unqualified machine name, e.g. 'web01'). Kept distinct
|
|
949
|
+
// from 'fqdn' because an FQDN is not reliably decomposable into hostname + domain
|
|
950
|
+
// (standalone/workgroup hosts have no domain; a directory domain is not the FQDN's DNS
|
|
951
|
+
// suffix). Aligns with ECS host.hostname and DISA STIG CKL HOST_NAME. Store the short name
|
|
952
|
+
// the source reports; do not derive it from the FQDN.
|
|
953
|
+
Hostname *string `json:"hostname,omitempty"`
|
|
919
954
|
// IP address of the host.
|
|
920
955
|
IPAddress *string `json:"ipAddress,omitempty"`
|
|
921
956
|
// MAC address in colon-separated hexadecimal format.
|
|
@@ -924,8 +959,6 @@ type Component struct {
|
|
|
924
959
|
OSName *string `json:"osName,omitempty"`
|
|
925
960
|
// Operating system version.
|
|
926
961
|
OSVersion *string `json:"osVersion,omitempty"`
|
|
927
|
-
// Image digest for immutable reference.
|
|
928
|
-
Digest *string `json:"digest,omitempty"`
|
|
929
962
|
// Container image ID.
|
|
930
963
|
ImageID *string `json:"imageId,omitempty"`
|
|
931
964
|
// Container registry. Example: 'docker.io'.
|
|
@@ -953,6 +986,11 @@ type Component struct {
|
|
|
953
986
|
// Package version.
|
|
954
987
|
//
|
|
955
988
|
// Database version.
|
|
989
|
+
//
|
|
990
|
+
// Model version, revision, or checkpoint tag.
|
|
991
|
+
//
|
|
992
|
+
// Dataset version, release identifier, or — for highly dynamic datasets — a timestamped
|
|
993
|
+
// release marker.
|
|
956
994
|
Version *string `json:"version,omitempty"`
|
|
957
995
|
// Cloud account identifier.
|
|
958
996
|
AccountID *string `json:"accountId,omitempty"`
|
|
@@ -978,8 +1016,6 @@ type Component struct {
|
|
|
978
1016
|
URL *string `json:"url,omitempty"`
|
|
979
1017
|
// Environment. Example: 'production', 'staging', 'development'.
|
|
980
1018
|
Environment *string `json:"environment,omitempty"`
|
|
981
|
-
// Package checksum for verification.
|
|
982
|
-
Checksum *string `json:"checksum,omitempty"`
|
|
983
1019
|
// Package manager. Example: 'npm', 'maven', 'pip', 'nuget'.
|
|
984
1020
|
PackageManager *string `json:"packageManager,omitempty"`
|
|
985
1021
|
// Package name.
|
|
@@ -994,6 +1030,191 @@ type Component struct {
|
|
|
994
1030
|
Host *string `json:"host,omitempty"`
|
|
995
1031
|
// Database port.
|
|
996
1032
|
Port *int64 `json:"port,omitempty"`
|
|
1033
|
+
// Provider/registry identifier for the model. Examples: a Hugging Face repo id
|
|
1034
|
+
// ('meta-llama/Llama-2-7b-hf') or a model purl. Correlates the component to its ai-model
|
|
1035
|
+
// BOM(s) and to lineage references from other models.
|
|
1036
|
+
ModelID *string `json:"modelId,omitempty"`
|
|
1037
|
+
// Provider/registry identifier for the dataset. Examples: a Hugging Face dataset repo id
|
|
1038
|
+
// ('HuggingFaceH4/ultrachat_200k'), a DOI, or a dataset purl. Correlates the component to
|
|
1039
|
+
// its dataset BOM(s) and to datasetRefs from ai-model components.
|
|
1040
|
+
DatasetID *string `json:"datasetId,omitempty"`
|
|
1041
|
+
}
|
|
1042
|
+
|
|
1043
|
+
type BillOfMaterials struct {
|
|
1044
|
+
// The manifest kind. Determines which normalized type-extension (model/dataset/packages)
|
|
1045
|
+
// may appear.
|
|
1046
|
+
BOMType string `json:"bomType"`
|
|
1047
|
+
// Normalized dataset extension. Permitted only when bomType is dataset.
|
|
1048
|
+
Dataset *DatasetBOMExtension `json:"dataset,omitempty"`
|
|
1049
|
+
// Passthrough by embedding: the native manifest carried opaquely (e.g. a raw CycloneDX or
|
|
1050
|
+
// SPDX object). HDF does not constrain its internal shape — full manifest validation is a
|
|
1051
|
+
// tool-level concern.
|
|
1052
|
+
Document map[string]interface{} `json:"document,omitempty"`
|
|
1053
|
+
// Source manifest format the BOM was produced from or references. Examples: cyclonedx,
|
|
1054
|
+
// cyclonedx-ml, spdx, spdx-ai, huggingface, croissant. Free-form so new formats need no
|
|
1055
|
+
// schema change; the converter that emits the BOM owns the value.
|
|
1056
|
+
Format string `json:"format"`
|
|
1057
|
+
// Integrity of the carried BOM *document* itself (the referenced/embedded manifest file),
|
|
1058
|
+
// NOT the integrity of the BOM's subject artifact. Subject/artifact integrity (model
|
|
1059
|
+
// weights, dataset archive) is a component-level concern, not carried here. Subject
|
|
1060
|
+
// identity is inherited from the host component/system; per-node identity lives in the
|
|
1061
|
+
// type-extension.
|
|
1062
|
+
Hashes []Checksum `json:"hashes,omitempty"`
|
|
1063
|
+
// Optional license of the BOM document as a whole (SPDX license expression). Nullable and
|
|
1064
|
+
// often meaningless (CBOM algorithms, many HBOM parts have no license); per-node licenses
|
|
1065
|
+
// live in the type-extension, not here.
|
|
1066
|
+
License *string `json:"license,omitempty"`
|
|
1067
|
+
// Normalized ai-model extension. Permitted only when bomType is ai-model.
|
|
1068
|
+
Model *AIModelBOMExtension `json:"model,omitempty"`
|
|
1069
|
+
// Normalized sbom extension: the flattened software package inventory. Permitted only when
|
|
1070
|
+
// bomType is sbom.
|
|
1071
|
+
Packages []SBOMPackage `json:"packages,omitempty"`
|
|
1072
|
+
// Passthrough by reference: URI (relative path, absolute URI, or fragment) to the native
|
|
1073
|
+
// manifest document. Present for externally-hosted BOMs.
|
|
1074
|
+
Ref *string `json:"ref,omitempty"`
|
|
1075
|
+
// Optional stable identifier for this BOM document (e.g. CycloneDX serialNumber, SPDX
|
|
1076
|
+
// documentNamespace). Correlates the same BOM across evidence packages.
|
|
1077
|
+
UniqueID *string `json:"uniqueId,omitempty"`
|
|
1078
|
+
}
|
|
1079
|
+
|
|
1080
|
+
// Normalized dataset extension. Permitted only when bomType is dataset.
|
|
1081
|
+
//
|
|
1082
|
+
// Normalized dataset fields (SPDX 3.0 Dataset profile / MLCommons Croissant aligned). All
|
|
1083
|
+
// optional; open for partial-fidelity passthrough of unmapped native fields. Symmetric with
|
|
1084
|
+
// AI_Model_Extension: carries the dataset's own lineage (baseDatasetRefs/derivation) just
|
|
1085
|
+
// as the model extension carries baseModelRef/adaptationType.
|
|
1086
|
+
type DatasetBOMExtension struct {
|
|
1087
|
+
// References to the source dataset(s) this one was derived from — a dataset componentId, or
|
|
1088
|
+
// a dataset BOM uniqueId/URI when no component exists. The lineage edge parallel to
|
|
1089
|
+
// ai-model's baseModelRef; the base dataset may carry its own dataset BOM.
|
|
1090
|
+
BaseDatasetRefs []string `json:"baseDatasetRefs,omitempty"`
|
|
1091
|
+
// Sensitivity/classification of the data. Examples: public, internal, confidential, pii,
|
|
1092
|
+
// phi.
|
|
1093
|
+
DataClassification *string `json:"dataClassification,omitempty"`
|
|
1094
|
+
// Physical format of the dataset. Examples: parquet, csv, jsonl, tfrecord, webdataset.
|
|
1095
|
+
DatasetFormat *string `json:"datasetFormat,omitempty"`
|
|
1096
|
+
// Relationship of this dataset to baseDatasetRefs, parallel to the model extension's
|
|
1097
|
+
// adaptationType. Minimal + extensible: filtered (subset by rule), augmented
|
|
1098
|
+
// (added/synthesized records), merged (union of sources), sampled (statistical draw).
|
|
1099
|
+
Derivation *DatasetDerivationType `json:"derivation,omitempty"`
|
|
1100
|
+
// Free-text statement of the dataset's intended use (CISA/G7 minimum element).
|
|
1101
|
+
IntendedUse *string `json:"intendedUse,omitempty"`
|
|
1102
|
+
// Content modality/kind of the data (CISA/G7 'Dataset content: modality'). Examples: text,
|
|
1103
|
+
// image, tabular, timeseries, audio. DISTINCT from datasetFormat, which is the physical
|
|
1104
|
+
// encoding (parquet/csv). Resolves SPDX 3.0 dataset_datasetType, which is content-kind, not
|
|
1105
|
+
// physical format. String or array of strings.
|
|
1106
|
+
Modality *Modality `json:"modality,omitempty"`
|
|
1107
|
+
// Free-text description of the dataset's origin and collection process (CISA/G7 'Dataset
|
|
1108
|
+
// provenance'; SPDX 3.0 dataset_dataCollectionProcess).
|
|
1109
|
+
Provenance *string `json:"provenance,omitempty"`
|
|
1110
|
+
// Number of records/examples in the dataset.
|
|
1111
|
+
RecordCount *int64 `json:"recordCount,omitempty"`
|
|
1112
|
+
// Free-text summary of the dataset's statistical properties (CISA/G7 minimum element;
|
|
1113
|
+
// open-ended by design). Intentionally free-text and will remain so permanently:
|
|
1114
|
+
// recordCount is the one structured statistic, and restructuring this into an object later
|
|
1115
|
+
// would break existing consumers, so it stays a string (additive-only).
|
|
1116
|
+
StatisticalProperties *string `json:"statisticalProperties,omitempty"`
|
|
1117
|
+
}
|
|
1118
|
+
|
|
1119
|
+
// Normalized ai-model extension. Permitted only when bomType is ai-model.
|
|
1120
|
+
//
|
|
1121
|
+
// Normalized AI-model fields, aligned to the CISA/G7 'SBOM for AI' minimum elements. All
|
|
1122
|
+
// fields optional (standards-correct; only the EU AI Act makes a subset binding for
|
|
1123
|
+
// high-risk/GPAI). Left open (additionalProperties: true) so a converter can carry unmapped
|
|
1124
|
+
// native fields opaquely (partial-fidelity pattern). Subject name/version are inherited
|
|
1125
|
+
// from the host aiModel component, not repeated here.
|
|
1126
|
+
type AIModelBOMExtension struct {
|
|
1127
|
+
// Lineage relationship to baseModelRef, adopting Hugging Face's base_model_relation
|
|
1128
|
+
// vocabulary (the only typed lineage enum in the ecosystem).
|
|
1129
|
+
AdaptationType *ModelAdaptationType `json:"adaptationType,omitempty"`
|
|
1130
|
+
// Reference to the base model this one was adapted from (e.g. a Hugging Face repo id or
|
|
1131
|
+
// purl). Correlates the lineage edge; the base model itself may carry its own ai-model BOM.
|
|
1132
|
+
BaseModelRef *string `json:"baseModelRef,omitempty"`
|
|
1133
|
+
// References to the training/evaluation datasets this model was produced from — preferably
|
|
1134
|
+
// a dataset component's componentId (correlating to a first-class dataset subject rather
|
|
1135
|
+
// than duplicating dataset detail, per ADR §10), or a dataset BOM uniqueId/URI when no
|
|
1136
|
+
// component exists.
|
|
1137
|
+
DatasetRefs []string `json:"datasetRefs,omitempty"`
|
|
1138
|
+
// Training hyper-parameters as name/value pairs (epochs, learning-rate, batch-size). This
|
|
1139
|
+
// is the set of training knobs, NOT the model's trainable parameterCount — the two are
|
|
1140
|
+
// routinely conflated. CISA/G7 'Model properties: hyper-parameters'; SPDX 3.0
|
|
1141
|
+
// ai_hyperparameter.
|
|
1142
|
+
Hyperparameters []Hyperparameter `json:"hyperparameters,omitempty"`
|
|
1143
|
+
// Model input/output properties (CISA/G7 minimum element): I/O data types, modality,
|
|
1144
|
+
// context/sequence length, and tokenizer. Sourced from CycloneDX
|
|
1145
|
+
// modelParameters.inputs[].format / outputs[].format. All sub-fields optional.
|
|
1146
|
+
InputOutput *InputOutput `json:"inputOutput,omitempty"`
|
|
1147
|
+
// Free-text statement of intended use and out-of-scope uses (CISA/G7 minimum element).
|
|
1148
|
+
IntendedUse *string `json:"intendedUse,omitempty"`
|
|
1149
|
+
// Model's learning/training paradigm. Free-text because the value set varies across
|
|
1150
|
+
// standards. Examples: supervised, self-supervised, semi-supervised, reinforcement.
|
|
1151
|
+
// Cross-standard intersection: SPDX 3.0 ai_typeOfModel ∩ CycloneDX
|
|
1152
|
+
// modelParameters.approach.type ∩ CISA/G7 learning type.
|
|
1153
|
+
LearningApproach *string `json:"learningApproach,omitempty"`
|
|
1154
|
+
// Model architecture family. Examples: transformer, cnn, diffusion, mixture-of-experts.
|
|
1155
|
+
ModelArchitecture *string `json:"modelArchitecture,omitempty"`
|
|
1156
|
+
// Total trainable parameter count. No native CycloneDX/SPDX field exists; first-class here
|
|
1157
|
+
// because the EU AI Act keys GPAI obligations off model scale.
|
|
1158
|
+
ParameterCount *int64 `json:"parameterCount,omitempty"`
|
|
1159
|
+
// Reported evaluation metrics as name/value pairs. Values are free-text because metrics are
|
|
1160
|
+
// heterogeneous (accuracy, f1, BLEU, latency). The item stays open (additionalProperties:
|
|
1161
|
+
// true) to carry native CycloneDX slice/confidenceInterval detail opaquely. Cross-standard
|
|
1162
|
+
// intersection: SPDX 3.0 ai_metric ∩ CycloneDX quantitativeAnalysis.performanceMetrics ∩
|
|
1163
|
+
// CISA/G7 KPI cluster.
|
|
1164
|
+
PerformanceMetrics []PerformanceMetric `json:"performanceMetrics,omitempty"`
|
|
1165
|
+
// On-disk weight serialization format. Security-critical yet under-modeled by BOM specs:
|
|
1166
|
+
// pickle/pytorch permits arbitrary code execution on load; safetensors does not. Examples:
|
|
1167
|
+
// safetensors, pytorch, gguf, onnx, tensorflow.
|
|
1168
|
+
SerializationFormat *string `json:"serializationFormat,omitempty"`
|
|
1169
|
+
// The ML task the model performs. Free-text. Examples: text-classification,
|
|
1170
|
+
// sentiment-analysis, object-detection, translation. Sourced from CycloneDX
|
|
1171
|
+
// modelParameters.task (SPDX 3.0 ai_domain is domain-level/adjacent, not the task); CISA/G7
|
|
1172
|
+
// intended-application.
|
|
1173
|
+
Task *string `json:"task,omitempty"`
|
|
1174
|
+
}
|
|
1175
|
+
|
|
1176
|
+
type Hyperparameter struct {
|
|
1177
|
+
// Hyper-parameter name. Examples: epochs, learning-rate, batch-size.
|
|
1178
|
+
Name *string `json:"name,omitempty"`
|
|
1179
|
+
// Hyper-parameter value (free-text).
|
|
1180
|
+
Value *string `json:"value,omitempty"`
|
|
1181
|
+
}
|
|
1182
|
+
|
|
1183
|
+
// Model input/output properties (CISA/G7 minimum element): I/O data types, modality,
|
|
1184
|
+
// context/sequence length, and tokenizer. Sourced from CycloneDX
|
|
1185
|
+
// modelParameters.inputs[].format / outputs[].format. All sub-fields optional.
|
|
1186
|
+
type InputOutput struct {
|
|
1187
|
+
// Maximum context/sequence length the model accepts, in tokens.
|
|
1188
|
+
ContextLength *int64 `json:"contextLength,omitempty"`
|
|
1189
|
+
// Input/output data types. Examples: string, byte[], float32, image.
|
|
1190
|
+
DataTypes []string `json:"dataTypes,omitempty"`
|
|
1191
|
+
// Input/output modalities. String or array of strings. Examples: text, image, audio.
|
|
1192
|
+
// Symmetric with Dataset_Extension.modality.
|
|
1193
|
+
Modality *Modality `json:"modality,omitempty"`
|
|
1194
|
+
// Tokenizer used for the model's input encoding. Examples: BPE, SentencePiece, tiktoken.
|
|
1195
|
+
Tokenizer *string `json:"tokenizer,omitempty"`
|
|
1196
|
+
}
|
|
1197
|
+
|
|
1198
|
+
type PerformanceMetric struct {
|
|
1199
|
+
// Metric name. Examples: accuracy, f1, BLEU, latency.
|
|
1200
|
+
Name *string `json:"name,omitempty"`
|
|
1201
|
+
// Reported metric value, free-text because metrics are heterogeneous (percentages, scores,
|
|
1202
|
+
// milliseconds).
|
|
1203
|
+
Value *string `json:"value,omitempty"`
|
|
1204
|
+
}
|
|
1205
|
+
|
|
1206
|
+
// A single normalized software package entry within an sbom BOM. Minimal identity + version
|
|
1207
|
+
// for querying/diffing; the full native record remains available via passthrough
|
|
1208
|
+
// (document/ref).
|
|
1209
|
+
type SBOMPackage struct {
|
|
1210
|
+
// SPDX license identifiers/expressions for this package.
|
|
1211
|
+
Licenses []string `json:"licenses,omitempty"`
|
|
1212
|
+
// Package name.
|
|
1213
|
+
Name string `json:"name"`
|
|
1214
|
+
// Package URL (purl) — the preferred cross-BOM identity key when present.
|
|
1215
|
+
Purl *string `json:"purl,omitempty"`
|
|
1216
|
+
// Package version.
|
|
1217
|
+
Version *string `json:"version,omitempty"`
|
|
997
1218
|
}
|
|
998
1219
|
|
|
999
1220
|
// An override of a baseline input value for a specific component. Enables system-specific
|
|
@@ -1067,7 +1288,14 @@ type Runner struct {
|
|
|
1067
1288
|
// The container image used for the test execution. Example: 'inspec/inspec:latest',
|
|
1068
1289
|
// 'ghcr.io/my-org/scanner:v2.1.0'. Useful for CI/CD pipelines where tests run in containers.
|
|
1069
1290
|
ContainerImage *string `json:"containerImage,omitempty"`
|
|
1070
|
-
// The
|
|
1291
|
+
// The directory domain the runner system belongs to (Active Directory / NetBIOS / LDAP),
|
|
1292
|
+
// NOT the DNS suffix of the FQDN. Example: 'CORP'.
|
|
1293
|
+
Domain *string `json:"domain,omitempty"`
|
|
1294
|
+
// The fully qualified domain name of the runner system, when known. Distinct from the short
|
|
1295
|
+
// 'hostname'; kept separate for the same reason as on host components (an FQDN is not
|
|
1296
|
+
// reliably decomposable). Example: 'ci-runner-01.build.example.com'.
|
|
1297
|
+
FQDN *string `json:"fqdn,omitempty"`
|
|
1298
|
+
// The short hostname of the runner system. Example: 'ci-runner-01', 'jenkins-agent-03',
|
|
1071
1299
|
// 'k8s-node-worker-03'.
|
|
1072
1300
|
Hostname *string `json:"hostname,omitempty"`
|
|
1073
1301
|
// The name of the runner environment. Examples: 'ubuntu', 'macos', 'windows', 'docker',
|
|
@@ -1243,39 +1471,44 @@ type BaselineRequirement struct {
|
|
|
1243
1471
|
// Structured comparison between two or more HDF security assessment documents. Supports
|
|
1244
1472
|
// temporal, baseline, fleet, and multi-source comparison modes.
|
|
1245
1473
|
type HDFComparison struct {
|
|
1246
|
-
// Map of annotation IDs to annotation objects, providing context or action items for
|
|
1247
|
-
// requirement diffs.
|
|
1248
|
-
Annotations
|
|
1249
|
-
// Comparison of baselines between sources.
|
|
1250
|
-
BaselineDiffs
|
|
1251
|
-
// The mode of comparison being performed.
|
|
1252
|
-
ComparisonMode
|
|
1253
|
-
// Comparison of components between two system documents. Used in systemDrift mode.
|
|
1254
|
-
|
|
1255
|
-
|
|
1256
|
-
|
|
1257
|
-
|
|
1258
|
-
|
|
1259
|
-
|
|
1260
|
-
|
|
1261
|
-
|
|
1262
|
-
|
|
1263
|
-
|
|
1264
|
-
|
|
1265
|
-
|
|
1266
|
-
|
|
1267
|
-
|
|
1268
|
-
|
|
1269
|
-
//
|
|
1270
|
-
|
|
1271
|
-
//
|
|
1272
|
-
|
|
1273
|
-
|
|
1274
|
-
|
|
1275
|
-
|
|
1276
|
-
|
|
1277
|
-
|
|
1278
|
-
|
|
1474
|
+
// Map of annotation IDs to annotation objects, providing context or action items for
|
|
1475
|
+
// requirement diffs.
|
|
1476
|
+
Annotations map[string]Annotation `json:"annotations,omitempty"`
|
|
1477
|
+
// Comparison of baselines between sources.
|
|
1478
|
+
BaselineDiffs []BaselineDiff `json:"baselineDiffs,omitempty"`
|
|
1479
|
+
// The mode of comparison being performed.
|
|
1480
|
+
ComparisonMode ComparisonMode `json:"comparisonMode"`
|
|
1481
|
+
// Comparison of components between two system documents. Used in systemDrift mode. A
|
|
1482
|
+
// component's BOM changes surface as a field change on its boms[] here.
|
|
1483
|
+
ComponentDiffs []ComponentDiff `json:"componentDiffs,omitempty"`
|
|
1484
|
+
// External/metadata changes separate from status changes (Terraform pattern).
|
|
1485
|
+
Drift []RequirementDiff `json:"drift,omitempty"`
|
|
1486
|
+
// Reserved for tool-specific data not defined in the HDF standard.
|
|
1487
|
+
Extensions map[string]interface{} `json:"extensions,omitempty"`
|
|
1488
|
+
// Schema version for this comparison format.
|
|
1489
|
+
FormatVersion FormatVersion `json:"formatVersion"`
|
|
1490
|
+
// Information about the tool that generated this comparison.
|
|
1491
|
+
Generator *Generator `json:"generator,omitempty"`
|
|
1492
|
+
// Cryptographic integrity information for verifying this comparison document.
|
|
1493
|
+
Integrity *Integrity `json:"integrity,omitempty"`
|
|
1494
|
+
// Configuration for how requirements were matched across sources.
|
|
1495
|
+
Matching *MatchingConfig `json:"matching,omitempty"`
|
|
1496
|
+
// RESERVED — not emitted by the current systemDrift comparison. systemDrift now reports a
|
|
1497
|
+
// component's BOM changes as a field change on its boms[] (see componentDiffs), and
|
|
1498
|
+
// standalone SBOM package diffing is a separate `hdf diff <sbom> <sbom>` output shape. This
|
|
1499
|
+
// field is retained for a future normalized package-level diff; consumers must not expect
|
|
1500
|
+
// it from today's systemDrift output.
|
|
1501
|
+
PackageDiffs []PackageDiff `json:"packageDiffs,omitempty"`
|
|
1502
|
+
// Detailed comparison of individual requirements between sources.
|
|
1503
|
+
RequirementDiffs []RequirementDiff `json:"requirementDiffs"`
|
|
1504
|
+
// The source documents being compared. At least two sources are required.
|
|
1505
|
+
Sources []Source `json:"sources"`
|
|
1506
|
+
// Summary statistics for the overall comparison.
|
|
1507
|
+
Summary ComparisonSummary `json:"summary"`
|
|
1508
|
+
// URI identifying the system being compared in systemDrift mode.
|
|
1509
|
+
SystemRef *string `json:"systemRef,omitempty"`
|
|
1510
|
+
// When this comparison was performed.
|
|
1511
|
+
Timestamp *time.Time `json:"timestamp,omitempty"`
|
|
1279
1512
|
}
|
|
1280
1513
|
|
|
1281
1514
|
// An annotation attached to a comparison, providing context or action items.
|
|
@@ -1415,21 +1648,28 @@ type MatchingConfig struct {
|
|
|
1415
1648
|
PrimaryStrategy MatchStrategy `json:"primaryStrategy"`
|
|
1416
1649
|
}
|
|
1417
1650
|
|
|
1418
|
-
// Comparison of a single
|
|
1651
|
+
// Comparison of a single BOM node between two BOM versions, matched by purl (software) or
|
|
1652
|
+
// identifier (models, datasets, hardware, crypto).
|
|
1419
1653
|
type PackageDiff struct {
|
|
1420
|
-
//
|
|
1421
|
-
|
|
1422
|
-
//
|
|
1423
|
-
|
|
1424
|
-
//
|
|
1425
|
-
|
|
1426
|
-
//
|
|
1427
|
-
|
|
1428
|
-
// Package
|
|
1429
|
-
|
|
1430
|
-
//
|
|
1431
|
-
|
|
1432
|
-
|
|
1654
|
+
// Generic identity key for matching a BOM node across versions when no purl applies — e.g.
|
|
1655
|
+
// a Hugging Face model ref, dataset uniqueId, crypto algorithm OID, or hardware part
|
|
1656
|
+
// number. At least one of purl or identifier is required.
|
|
1657
|
+
Identifier *string `json:"identifier,omitempty"`
|
|
1658
|
+
// License identifiers for this package.
|
|
1659
|
+
Licenses []string `json:"licenses,omitempty"`
|
|
1660
|
+
// Human-readable node name.
|
|
1661
|
+
Name *string `json:"name,omitempty"`
|
|
1662
|
+
// Package version in the new SBOM.
|
|
1663
|
+
NewVersion *string `json:"newVersion,omitempty"`
|
|
1664
|
+
// Package version in the old SBOM.
|
|
1665
|
+
OldVersion *string `json:"oldVersion,omitempty"`
|
|
1666
|
+
// Package URL (purl) — the preferred identity key for matching software packages across
|
|
1667
|
+
// BOMs. Optional: BOM nodes without a purl (AI models, datasets, hardware parts, crypto
|
|
1668
|
+
// algorithms) key on identifier instead.
|
|
1669
|
+
Purl *string `json:"purl,omitempty"`
|
|
1670
|
+
// The state of this package: added (new in new SBOM), removed (absent from new SBOM),
|
|
1671
|
+
// updated (version changed), unchanged.
|
|
1672
|
+
State PackageDiffState `json:"state"`
|
|
1433
1673
|
}
|
|
1434
1674
|
|
|
1435
1675
|
// A source document participating in the comparison.
|
|
@@ -1569,13 +1809,19 @@ type HDFSystem struct {
|
|
|
1569
1809
|
AuthorizationDate *time.Time `json:"authorizationDate,omitempty"`
|
|
1570
1810
|
// Current Authorization to Operate (ATO) status.
|
|
1571
1811
|
AuthorizationStatus *AuthorizationStatus `json:"authorizationStatus,omitempty"`
|
|
1812
|
+
// System-scoped Bills of Materials whose subject is the authorization boundary rather than
|
|
1813
|
+
// a single component (e.g. a SaaSBOM of services, a KBOM of cluster inventory, an OBOM).
|
|
1814
|
+
// Component-scoped BOMs (SBOM, ai-model) attach on the component instead. See
|
|
1815
|
+
// primitives/bom.schema.json.
|
|
1816
|
+
Boms []BillOfMaterials `json:"boms,omitempty"`
|
|
1572
1817
|
// Description of the system's authorization boundary. Example: network CIDR blocks, cloud
|
|
1573
1818
|
// VPC IDs, physical locations.
|
|
1574
1819
|
BoundaryDescription *string `json:"boundaryDescription,omitempty"`
|
|
1575
1820
|
// FIPS 199 security categorization (impact level).
|
|
1576
1821
|
CategorizationLevel *CategorizationLevel `json:"categorizationLevel,omitempty"`
|
|
1577
1822
|
// System components within the authorization boundary. Uses the full polymorphic Component
|
|
1578
|
-
// type with stable identity (componentId), external references, and
|
|
1823
|
+
// type with stable identity (componentId), external references, and generalized BOM
|
|
1824
|
+
// attachment (boms[]).
|
|
1579
1825
|
Components []Component `json:"components"`
|
|
1580
1826
|
// Declares which controls are common, hybrid, or system-specific, and which component
|
|
1581
1827
|
// provides them. Maps to NIST SP 800-53 control designations and OSCAL
|
|
@@ -1847,39 +2093,44 @@ type StandaloneOverride struct {
|
|
|
1847
2093
|
// Each content entry references a document by type, URI, and checksum for integrity
|
|
1848
2094
|
// verification.
|
|
1849
2095
|
type HDFEvidencePackage struct {
|
|
1850
|
-
// Summary of assessment completeness and compliance status.
|
|
1851
|
-
CompletenessCheck *CompletenessCheck
|
|
1852
|
-
// References to HDF documents included in this evidence package.
|
|
1853
|
-
Contents []ContentReference
|
|
1854
|
-
// Description of the evidence package's purpose and scope.
|
|
1855
|
-
Description *string
|
|
1856
|
-
//
|
|
1857
|
-
|
|
1858
|
-
//
|
|
1859
|
-
//
|
|
1860
|
-
|
|
1861
|
-
//
|
|
1862
|
-
|
|
1863
|
-
//
|
|
1864
|
-
//
|
|
1865
|
-
|
|
1866
|
-
//
|
|
1867
|
-
|
|
1868
|
-
|
|
1869
|
-
//
|
|
1870
|
-
|
|
1871
|
-
// this package.
|
|
1872
|
-
|
|
1873
|
-
|
|
1874
|
-
|
|
1875
|
-
//
|
|
1876
|
-
|
|
1877
|
-
|
|
1878
|
-
|
|
1879
|
-
|
|
1880
|
-
|
|
1881
|
-
|
|
1882
|
-
|
|
2096
|
+
// Summary of assessment completeness and compliance status.
|
|
2097
|
+
CompletenessCheck *CompletenessCheck `json:"completenessCheck,omitempty"`
|
|
2098
|
+
// References to HDF documents included in this evidence package.
|
|
2099
|
+
Contents []ContentReference `json:"contents"`
|
|
2100
|
+
// Description of the evidence package's purpose and scope.
|
|
2101
|
+
Description *string `json:"description,omitempty"`
|
|
2102
|
+
// References to external native-format evidence (log/telemetry corpora and other artifacts)
|
|
2103
|
+
// carried by URI + integrity hash + format discriminator, without recreating the data
|
|
2104
|
+
// inside HDF. Logs in ECS/OCSF/etc. are legitimate accreditation evidence; HDF indexes them
|
|
2105
|
+
// here rather than transcoding them.
|
|
2106
|
+
ExternalEvidence []ExternalEvidenceReference `json:"externalEvidence,omitempty"`
|
|
2107
|
+
// Information about the tool that generated this document.
|
|
2108
|
+
Generator *Generator `json:"generator,omitempty"`
|
|
2109
|
+
// Cryptographic integrity information for verifying this evidence package has not been
|
|
2110
|
+
// tampered with.
|
|
2111
|
+
Integrity *Integrity `json:"integrity,omitempty"`
|
|
2112
|
+
// Optional key-value labels for grouping and querying evidence packages.
|
|
2113
|
+
Labels map[string]string `json:"labels,omitempty"`
|
|
2114
|
+
// Human-readable name for this evidence package. Example: 'Enterprise Portal ATO Evidence -
|
|
2115
|
+
// Q1 2026'.
|
|
2116
|
+
Name string `json:"name"`
|
|
2117
|
+
// Unique identifier for this evidence package. Optional in casual use, expected in
|
|
2118
|
+
// production ATO submissions. Auto-generated if omitted during creation.
|
|
2119
|
+
PackageID *string `json:"packageId,omitempty"`
|
|
2120
|
+
// URI to the hdf-plan document that drove this assessment. Used for completeness
|
|
2121
|
+
// verification — every baseline in the plan should have a corresponding results document in
|
|
2122
|
+
// this package.
|
|
2123
|
+
PlanRef *string `json:"planRef,omitempty"`
|
|
2124
|
+
// When this evidence package was prepared. ISO 8601 format.
|
|
2125
|
+
PreparedAt *time.Time `json:"preparedAt,omitempty"`
|
|
2126
|
+
// Identity of who prepared this evidence package.
|
|
2127
|
+
PreparedBy *Identity `json:"preparedBy,omitempty"`
|
|
2128
|
+
// Digital signature covering the entire evidence package.
|
|
2129
|
+
Signature *Signature `json:"signature,omitempty"`
|
|
2130
|
+
// URI to the hdf-system document this evidence package covers.
|
|
2131
|
+
SystemRef *string `json:"systemRef,omitempty"`
|
|
2132
|
+
// Version of this evidence package.
|
|
2133
|
+
Version *string `json:"version,omitempty"`
|
|
1883
2134
|
}
|
|
1884
2135
|
|
|
1885
2136
|
// Summary of assessment completeness and compliance status.
|
|
@@ -1911,7 +2162,7 @@ type SBOMCoverage struct {
|
|
|
1911
2162
|
TotalComponents *int64 `json:"totalComponents,omitempty"`
|
|
1912
2163
|
}
|
|
1913
2164
|
|
|
1914
|
-
// A reference to an HDF document or
|
|
2165
|
+
// A reference to an HDF document or BOM/manifest included in the evidence package.
|
|
1915
2166
|
type ContentReference struct {
|
|
1916
2167
|
// Cryptographic checksum for verifying the referenced document's integrity.
|
|
1917
2168
|
Checksum *Checksum `json:"checksum,omitempty"`
|
|
@@ -1926,6 +2177,56 @@ type ContentReference struct {
|
|
|
1926
2177
|
URI string `json:"uri"`
|
|
1927
2178
|
}
|
|
1928
2179
|
|
|
2180
|
+
// A reference to external native-format evidence (log/telemetry corpus or other artifact)
|
|
2181
|
+
// carried by URI + integrity hash + format discriminator. Reference-only: the artifact is
|
|
2182
|
+
// never embedded (corpora can be huge) or transcoded (that would be lossy) — it stays
|
|
2183
|
+
// canonical in its native format and HDF acts as the structured index.
|
|
2184
|
+
type ExternalEvidenceReference struct {
|
|
2185
|
+
// Cryptographic checksum of the referenced artifact for integrity verification.
|
|
2186
|
+
Checksum *Checksum `json:"checksum,omitempty"`
|
|
2187
|
+
// Optional human-readable description of this evidence entry.
|
|
2188
|
+
Description *string `json:"description,omitempty"`
|
|
2189
|
+
// The native format discriminator of the referenced artifact.
|
|
2190
|
+
Format string `json:"format"`
|
|
2191
|
+
// Optional producer-declared version of the format (e.g. ECS '9.4.0', OCSF '1.8.0').
|
|
2192
|
+
// Free-text and untrusted — HDF does not validate it against a registry.
|
|
2193
|
+
FormatVersion *string `json:"formatVersion,omitempty"`
|
|
2194
|
+
// Optional IANA media type describing the on-disk serialization, orthogonal to 'format'
|
|
2195
|
+
// (the semantic standard). Examples: application/x-ndjson, application/json,
|
|
2196
|
+
// application/vnd.apache.parquet, text/csv.
|
|
2197
|
+
MediaType *string `json:"mediaType,omitempty"`
|
|
2198
|
+
// Optional descriptive metadata about the referenced corpus. Does not affect integrity.
|
|
2199
|
+
Metadata *ExternalEvidenceMetadata `json:"metadata,omitempty"`
|
|
2200
|
+
// URI to the external native-format evidence artifact (log/telemetry corpus, etc.). Can be
|
|
2201
|
+
// a relative path or absolute URL. The data stays canonical in its native format — HDF
|
|
2202
|
+
// references it, never parses or transcodes it.
|
|
2203
|
+
URI string `json:"uri"`
|
|
2204
|
+
}
|
|
2205
|
+
|
|
2206
|
+
// Optional descriptive metadata about the referenced corpus. Does not affect integrity.
|
|
2207
|
+
//
|
|
2208
|
+
// Descriptive metadata about a referenced external evidence corpus. Does not affect
|
|
2209
|
+
// integrity.
|
|
2210
|
+
type ExternalEvidenceMetadata struct {
|
|
2211
|
+
// The tool/pipeline that collected or produced the corpus. Example: 'aws-security-lake',
|
|
2212
|
+
// 'elastic-agent'.
|
|
2213
|
+
Collector *string `json:"collector,omitempty"`
|
|
2214
|
+
// Approximate number of records/events in the referenced corpus.
|
|
2215
|
+
RecordCount *int64 `json:"recordCount,omitempty"`
|
|
2216
|
+
// The time window the referenced evidence covers.
|
|
2217
|
+
TimeRange *ExternalEvidenceTimeRange `json:"timeRange,omitempty"`
|
|
2218
|
+
}
|
|
2219
|
+
|
|
2220
|
+
// The time window the referenced evidence covers.
|
|
2221
|
+
//
|
|
2222
|
+
// The time window a referenced external evidence corpus covers.
|
|
2223
|
+
type ExternalEvidenceTimeRange struct {
|
|
2224
|
+
// End of the time window the corpus covers (ISO 8601).
|
|
2225
|
+
End *time.Time `json:"end,omitempty"`
|
|
2226
|
+
// Start of the time window the corpus covers (ISO 8601).
|
|
2227
|
+
Start *time.Time `json:"start,omitempty"`
|
|
2228
|
+
}
|
|
2229
|
+
|
|
1929
2230
|
// The comparison operator used when evaluating this input against observed values.
|
|
1930
2231
|
//
|
|
1931
2232
|
// Comparison operator for evaluating the input value against observed values. Numeric:
|
|
@@ -1961,10 +2262,12 @@ const (
|
|
|
1961
2262
|
|
|
1962
2263
|
// The hash algorithm used for the checksum.
|
|
1963
2264
|
//
|
|
1964
|
-
// Supported cryptographic hash algorithms for checksums and integrity verification.
|
|
2265
|
+
// Supported cryptographic hash algorithms for checksums and integrity verification. blake3
|
|
2266
|
+
// covers container-image and other artifact digests that use it.
|
|
1965
2267
|
type HashAlgorithm string
|
|
1966
2268
|
|
|
1967
2269
|
const (
|
|
2270
|
+
Blake3 HashAlgorithm = "blake3"
|
|
1968
2271
|
Sha256 HashAlgorithm = "sha256"
|
|
1969
2272
|
Sha384 HashAlgorithm = "sha384"
|
|
1970
2273
|
Sha512 HashAlgorithm = "sha512"
|
|
@@ -2107,11 +2410,16 @@ const (
|
|
|
2107
2410
|
)
|
|
2108
2411
|
|
|
2109
2412
|
// The type of identifier. Use 'email' for email addresses, 'username' for user accounts,
|
|
2110
|
-
// 'system' for
|
|
2111
|
-
//
|
|
2413
|
+
// 'system' for deterministic non-interactive automation (CI jobs, cron, scanners), 'agent'
|
|
2414
|
+
// for an AI/LLM agent acting with autonomy — kept distinct from 'system' so auditors can
|
|
2415
|
+
// apply AI-specific scrutiny (e.g. 'an LLM proposed this' vs a deterministic job) and
|
|
2416
|
+
// satisfy AI-source disclosure under frameworks like the EU AI Act and NIST AI RMF,
|
|
2417
|
+
// 'simple' for basic string identifiers without additional classification, or 'other' for
|
|
2418
|
+
// custom identity systems.
|
|
2112
2419
|
type IdentityType string
|
|
2113
2420
|
|
|
2114
2421
|
const (
|
|
2422
|
+
Agent IdentityType = "agent"
|
|
2115
2423
|
Email IdentityType = "email"
|
|
2116
2424
|
IdentityTypeOther IdentityType = "other"
|
|
2117
2425
|
IdentityTypeSystem IdentityType = "system"
|
|
@@ -2226,6 +2534,29 @@ const (
|
|
|
2226
2534
|
VerificationMethodEnumHybrid VerificationMethodEnum = "hybrid"
|
|
2227
2535
|
)
|
|
2228
2536
|
|
|
2537
|
+
// Relationship of this dataset to baseDatasetRefs, parallel to the model extension's
|
|
2538
|
+
// adaptationType. Minimal + extensible: filtered (subset by rule), augmented
|
|
2539
|
+
// (added/synthesized records), merged (union of sources), sampled (statistical draw).
|
|
2540
|
+
type DatasetDerivationType string
|
|
2541
|
+
|
|
2542
|
+
const (
|
|
2543
|
+
Augmented DatasetDerivationType = "augmented"
|
|
2544
|
+
DatasetDerivationTypeMerged DatasetDerivationType = "merged"
|
|
2545
|
+
Filtered DatasetDerivationType = "filtered"
|
|
2546
|
+
Sampled DatasetDerivationType = "sampled"
|
|
2547
|
+
)
|
|
2548
|
+
|
|
2549
|
+
// Lineage relationship to baseModelRef, adopting Hugging Face's base_model_relation
|
|
2550
|
+
// vocabulary (the only typed lineage enum in the ecosystem).
|
|
2551
|
+
type ModelAdaptationType string
|
|
2552
|
+
|
|
2553
|
+
const (
|
|
2554
|
+
Adapter ModelAdaptationType = "adapter"
|
|
2555
|
+
Finetune ModelAdaptationType = "finetune"
|
|
2556
|
+
Merge ModelAdaptationType = "merge"
|
|
2557
|
+
Quantized ModelAdaptationType = "quantized"
|
|
2558
|
+
)
|
|
2559
|
+
|
|
2229
2560
|
type CloudProvider string
|
|
2230
2561
|
|
|
2231
2562
|
const (
|
|
@@ -2236,18 +2567,12 @@ const (
|
|
|
2236
2567
|
Oci CloudProvider = "oci"
|
|
2237
2568
|
)
|
|
2238
2569
|
|
|
2239
|
-
//
|
|
2240
|
-
|
|
2241
|
-
|
|
2242
|
-
const (
|
|
2243
|
-
Cyclonedx SBOMFormat = "cyclonedx"
|
|
2244
|
-
Spdx SBOMFormat = "spdx"
|
|
2245
|
-
)
|
|
2246
|
-
|
|
2247
|
-
// Component type discriminator. Same values as Target types.
|
|
2570
|
+
// Component type discriminator. Same values as Target types, plus aiModel and dataset (thin
|
|
2571
|
+
// AI subject components whose detail lives in an attached ai-model / dataset BOM).
|
|
2248
2572
|
type TargetType string
|
|
2249
2573
|
|
|
2250
2574
|
const (
|
|
2575
|
+
AIModel TargetType = "aiModel"
|
|
2251
2576
|
Application TargetType = "application"
|
|
2252
2577
|
Artifact TargetType = "artifact"
|
|
2253
2578
|
CloudAccount TargetType = "cloudAccount"
|
|
@@ -2256,6 +2581,7 @@ const (
|
|
|
2256
2581
|
ContainerInstance TargetType = "containerInstance"
|
|
2257
2582
|
ContainerPlatform TargetType = "containerPlatform"
|
|
2258
2583
|
Database TargetType = "database"
|
|
2584
|
+
Dataset TargetType = "dataset"
|
|
2259
2585
|
Host TargetType = "host"
|
|
2260
2586
|
Network TargetType = "network"
|
|
2261
2587
|
Repository TargetType = "repository"
|
|
@@ -2371,10 +2697,10 @@ type RequirementState string
|
|
|
2371
2697
|
|
|
2372
2698
|
const (
|
|
2373
2699
|
Fixed RequirementState = "fixed"
|
|
2374
|
-
Merged RequirementState = "merged"
|
|
2375
2700
|
Moved RequirementState = "moved"
|
|
2376
2701
|
Regressed RequirementState = "regressed"
|
|
2377
2702
|
RequirementStateAbsent RequirementState = "absent"
|
|
2703
|
+
RequirementStateMerged RequirementState = "merged"
|
|
2378
2704
|
RequirementStateNew RequirementState = "new"
|
|
2379
2705
|
RequirementStateUnchanged RequirementState = "unchanged"
|
|
2380
2706
|
RequirementStateUpdated RequirementState = "updated"
|
|
@@ -2481,17 +2807,20 @@ const (
|
|
|
2481
2807
|
|
|
2482
2808
|
// The type of HDF document being referenced.
|
|
2483
2809
|
//
|
|
2484
|
-
// The type of document referenced in the evidence package.
|
|
2810
|
+
// The type of document referenced in the evidence package. 'bom' covers any
|
|
2811
|
+
// Bill-of-Materials/manifest document (SBOM, AI model/dataset, and reserved future kinds) —
|
|
2812
|
+
// its specific kind is carried by the referenced document's bomType, not by a per-kind
|
|
2813
|
+
// Content_Type value.
|
|
2485
2814
|
type ContentType string
|
|
2486
2815
|
|
|
2487
2816
|
const (
|
|
2817
|
+
BOM ContentType = "bom"
|
|
2488
2818
|
HdfAmendments ContentType = "hdf-amendments"
|
|
2489
2819
|
HdfBaseline ContentType = "hdf-baseline"
|
|
2490
2820
|
HdfComparison ContentType = "hdf-comparison"
|
|
2491
2821
|
HdfPlan ContentType = "hdf-plan"
|
|
2492
2822
|
HdfResults ContentType = "hdf-results"
|
|
2493
2823
|
HdfSystem ContentType = "hdf-system"
|
|
2494
|
-
Sbom ContentType = "sbom"
|
|
2495
2824
|
)
|
|
2496
2825
|
|
|
2497
2826
|
type Ref struct {
|
|
@@ -2514,6 +2843,33 @@ func (x *Ref) MarshalJSON() ([]byte, error) {
|
|
|
2514
2843
|
return marshalUnion(nil, nil, nil, x.String, x.AnythingMapArray != nil, x.AnythingMapArray, false, nil, false, nil, false, nil, false)
|
|
2515
2844
|
}
|
|
2516
2845
|
|
|
2846
|
+
// Content modality/kind of the data (CISA/G7 'Dataset content: modality'). Examples: text,
|
|
2847
|
+
// image, tabular, timeseries, audio. DISTINCT from datasetFormat, which is the physical
|
|
2848
|
+
// encoding (parquet/csv). Resolves SPDX 3.0 dataset_datasetType, which is content-kind, not
|
|
2849
|
+
// physical format. String or array of strings.
|
|
2850
|
+
//
|
|
2851
|
+
// Input/output modalities. String or array of strings. Examples: text, image, audio.
|
|
2852
|
+
// Symmetric with Dataset_Extension.modality.
|
|
2853
|
+
type Modality struct {
|
|
2854
|
+
String *string
|
|
2855
|
+
StringArray []string
|
|
2856
|
+
}
|
|
2857
|
+
|
|
2858
|
+
func (x *Modality) UnmarshalJSON(data []byte) error {
|
|
2859
|
+
x.StringArray = nil
|
|
2860
|
+
object, err := unmarshalUnion(data, nil, nil, nil, &x.String, true, &x.StringArray, false, nil, false, nil, false, nil, false)
|
|
2861
|
+
if err != nil {
|
|
2862
|
+
return err
|
|
2863
|
+
}
|
|
2864
|
+
if object {
|
|
2865
|
+
}
|
|
2866
|
+
return nil
|
|
2867
|
+
}
|
|
2868
|
+
|
|
2869
|
+
func (x *Modality) MarshalJSON() ([]byte, error) {
|
|
2870
|
+
return marshalUnion(nil, nil, nil, x.String, x.StringArray != nil, x.StringArray, false, nil, false, nil, false, nil, false)
|
|
2871
|
+
}
|
|
2872
|
+
|
|
2517
2873
|
func unmarshalUnion(data []byte, pi **int64, pf **float64, pb **bool, ps **string, haveArray bool, pa interface{}, haveObject bool, pc interface{}, haveMap bool, pm interface{}, haveEnum bool, pe interface{}, nullable bool) (bool, error) {
|
|
2518
2874
|
if pi != nil {
|
|
2519
2875
|
*pi = nil
|