Skip to content

Extend cryptography-related behaviors #772

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stevespringett merged 3 commits into from
Jan 22, 2026
Merged

Extend cryptography-related behaviors #772

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
96117b4
Extend cryptography-related behaviors
bhess Jan 8, 2026
70de945
A few extensions to the crypto behaviors
bhess Jan 14, 2026
bb7e30e
Makes sure meta:enum descrptions are available for the new behaviors.…
bhess Jan 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions schema/2.0/model/cyclonedx-behavior-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -808,17 +808,42 @@
"security:cryptography:encryptsData",
"security:cryptography:exchangesKey",
"security:cryptography:generatesKey",
"security:cryptography:wrapsKey",
Comment thread
stevespringett marked this conversation as resolved.
Outdated
"security:cryptography:generatesRandomValue",
Comment on lines 823 to 824
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The behavior 'wrapsKey' is incorrectly positioned. It should appear after 'verifiesSignature' (or at the end with other 'w' entries) to maintain alphabetical ordering. The entire cryptography section follows alphabetical order, and new entries should be inserted accordingly.

Copilot uses AI. Check for mistakes.
"security:cryptography:hashesData",
"security:cryptography:issuesCertificate",
"security:cryptography:presentsServerCertificate",
"security:cryptography:presentsClientCertificate",
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All 28 newly added cryptography behaviors are missing their corresponding descriptions in the meta:enum section (around line 1545-1562). Each enum value should have a matching description entry following the pattern of existing behaviors. For example, 'security:cryptography:wrapsKey' needs an entry like '"security:cryptography:wrapsKey": "The entity encrypts a key for secure storage or transport."' in the meta:enum object.

Copilot uses AI. Check for mistakes.
Comment thread
stevespringett marked this conversation as resolved.
Outdated
"security:cryptography:retrievesKey",
"security:cryptography:revokesCertificate",
"security:cryptography:rotatesKey",
"security:cryptography:signsData",
"security:cryptography:verifiesDataSignature",
"security:cryptography:signsCode",
"security:cryptography:verifiesCodeSignature",
"security:cryptography:signsDocument",
Comment on lines 817 to +837
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These signature-related behaviors are not in correct alphabetical order. The 'signs*' entries should be grouped together (signsCode, signsData, signsDocument) before the 'verifies*' entries (verifiesCodeSignature, verifiesDataSignature, verifiesDocumentSignature).

Suggested change
"security:cryptography:signsData",
"security:cryptography:verifiesDataSignature",
"security:cryptography:signsCode",
"security:cryptography:verifiesCodeSignature",
"security:cryptography:signsDocument",
"security:cryptography:signsCode",
"security:cryptography:signsData",
"security:cryptography:signsDocument",
"security:cryptography:verifiesCodeSignature",
"security:cryptography:verifiesDataSignature",

Copilot uses AI. Check for mistakes.
"security:cryptography:verifiesDocumentSignature",
Comment thread
stevespringett marked this conversation as resolved.
Outdated
"security:cryptography:storesKey",
"security:cryptography:validatesCertificate",
"security:cryptography:verifiesHash",
"security:cryptography:verifiesSignature",
"security:cryptography:authenticates",
"security:cryptography:ensuresConfidentiality",
"security:cryptography:ensuresIntegrity",
"security:cryptography:ensuresNonRepudiation",
"security:cryptography:ensuresAccountability",
"security:cryptography:preservesPrivacy",
"security:cryptography:identifies",
"security:cryptography:usesIdentity",
"security:cryptography:validatesToken",
"security:cryptography:encryptsDataAtRest",
"security:cryptography:encryptsDataInTransit",
"security:cryptography:decryptsDataAtRest",
"security:cryptography:decryptsDataInTransit",
"security:cryptography:encryptsDisk",
"security:cryptography:decryptsDisk",
"security:cryptography:encryptsSecret",
"security:cryptography:decryptsSecret",
Comment thread
stevespringett marked this conversation as resolved.
Outdated
Comment thread
stevespringett marked this conversation as resolved.
Outdated
Comment thread
stevespringett marked this conversation as resolved.
Outdated
"security:errorHandling",
"security:errorHandling:catchesException",
"security:errorHandling:disclosesErrorDetails",
Expand Down