Protobuf: `Evidence.identity` is `repeated`, but should be `optional`

[nscuro]

The identity field of Evidence is repeated in the current v1.5 Protobuf schema, whereas it is a singular object in the JSON and XML variants of the schema.

specification/schema/bom-1.5.proto

Lines 652 to 658 in cc15c85

	message Evidence {
	repeated LicenseChoice licenses = 1;
	repeated EvidenceCopyright copyright = 2;
	repeated EvidenceIdentity identity = 3;
	repeated EvidenceOccurrences occurrences = 4;
	optional Callstack callstack = 5;
	}

specification/schema/bom-1.5.schema.json

Lines 1458 to 1469 in cc15c85

	"componentEvidence": {
	"type": "object",
	"title": "Evidence",
	"description": "Provides the ability to document evidence collected through various forms of extraction or analysis.",
	"additionalProperties": false,
	"properties": {
	"identity": {
	"type": "object",
	"description": "Evidence that substantiates the identity of a component.",
	"required": [ "field" ],
	"additionalProperties": false,
	"properties": {

specification/schema/bom-1.5.xsd

Lines 2132 to 2134 in cc15c85

	<xs:complexType name="componentEvidenceType">
	<xs:sequence>
	<xs:element name="identity" minOccurs="0" maxOccurs="1">

As the field is not required, it should be optional.

[prabhu]

Am I correct in assuming that even Evidence must be optional as shown in the below commit?

AppThreat/cdx-proto@3b57244?diff=split&w=1#diff-8dd4e24a6bce8169f7ec43877352e1f85f2c5cf66b8f0733b1957c7f540e6861

I think in 1.6, we need to add some conformance tests where we serialize using proto and then attempt to deserialize and read as json and vice versa.

[stevespringett]

Actually, the defect is in the JSON and XML schemas. In this case, the protobuf is correct. Identity should be an array.

[stevespringett]

I think in 1.6, we need to add some conformance tests where we serialize using proto and then attempt to deserialize and read as json and vice versa.

I think there's some tests that are performed in .NET. Perhaps @coderpatros can shed some light.

[prabhu]

Actually, the defect is in the JSON and XML schemas. In this case, the protobuf is correct. Identity should be an array.

This would be a large breaking change for cdxgen and depscan users since the identity object is used quite heavily

[stevespringett]

This would be a large breaking change for cdxgen and depscan users since the identity object is used quite heavily

How would this be a breaking change? The unit tests, which incorporate both single object and arrays, are passing validation. There will be no changes required in cdxgen or depscan, although the current method (single object) has been deprecated. So implementations will be encouraged to update to supporting arrays. But no functionality is breaking.

[stevespringett]

Fix will be included in v1.6