CycloneDX Property Taxonomy

This is the official CycloneDX property namespace and name taxonomy.

Introduction

With the v1.3 release of the CycloneDX specification, custom properties have been added to enable even more extensibility.

Although the specification doesn't impose restrictions on the property names used, standardization can assist tool implementers and BOM consumers.

The authoritative source of official namespaces and property names is this repository.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC2119.

Property Name Structure

A CycloneDX property name has two components:

• Namespace (optional): an identifier that scopes or categorizes the property.
• Name (required): the actual key or label for the property.

When a namespace is present it is separated from the name by a single colon.
A namespace is a hierarchical sequence of segments separated by colons. The first segment is the top-level namespace; subsequent segments are sub-namespaces.

Names and namespace segments MUST NOT contain ":".
The only characters that SHALL be used in official property namespace segments and names are alphanumerical characters, "-", "_" and " " from the US ASCII character set.

Namespaces SHOULD be lower case.
Names MAY use upper case.

Examples

internal:information_security_classification
internal:team_responsible
internal:project:guid

ABNF for Official CycloneDX Property Names

property-name     = [ namespace delimiter ] name

namespace         = namespace-segment           ; top-level namespace
                    *( delimiter namespace-segment ) ; sub-namespaces
namespace-segment = 1*namechar

name              = 1*namechar

namechar          = ALPHA / DIGIT / "-" / "_" / " "
delimiter         = ":"

ABNF syntax as per RFC5234: Augmented BNF for Syntax Specifications: ABNF.

Registered Top-Level Namespaces

Regardless of other licensing attributes in this repository or document,
the following table (called "registry") is marked with CC0 1.0

Registering new Top-Level Namespaces

It is RECOMMENDED that anyone creating custom properties outside of the internal namespace SHOULD register a new top-level namespace.

The process for registering a new top-level namespace is to create a new issue requesting it.

Top-level namespaces are initially registered as RESERVED.

Registered top-level namespaces SHOULD be more than two characters long.

Before using your RESERVED namespace, documentation for the taxonomy of the namespace SHOULD be publicly available. Failure to do so MAY result in the namespace reservation being revoked.

An example is the cdx taxonomy.