Unified evidence model addressing #278, #333 and other concerns.

[stevespringett]

• Closes Unified evidence model #979
• Closes Add support for array of callstack frames #278
• Closes Request: Evidence for Vulnerabilities #333

changes

• removes component's /$defs/copyright
• removes component's /$defs/copyrightObject
• add component's /$defs/componentEvidence/properties/callStacks
• add component's /$defs/componentEvidence/properties/licenses
• add component's /$defs/componentEvidence/properties/copyright
• add component's /$defs/licenseEvidence
• add component's /$defs/occurrence
• add component's /$defs/copyrightEvidence
• add component's /$defs/componentIdentityEvidence/properties/assertion
• add data's /$defs/dataContents
• add evidence's /$defs/identificationMethod
• add evidence's /$defs/vulnerabilityEvidence

[jkowalleck]

RFC notice sent on July 20, 2026

• https://groups.io/g/CycloneDX/topic/120352781
• https://cyclonedx.slack.com/archives/CVA0G10FN/p1784506598160339

Public RFC period ends August 17, 2026

[planetlevel]

@stevespringett - in reviewing all this, it occurs to me that we do a good job of capturing evidence of vulnerability. But to really understand a risk, it's important to understand any compensating controls. It's like evidence against vulnerability - that it doesn't exist or isn't as dangerous as it might be. Like VEX sort of. I'm wondering if we should add something in the standard to model these controls so that you can take them into account. Is this already handled somehow? Or is this somewhere else in the standard that I missed?

If we dd this, we could distinguish inherent and residual ratings and allow the residual rating to reference the mitigation assertion.

[jkowalleck]

can the components' /$defs/componentIdentityEvidence
be moved to evidence's /$defs/identityEvidence ?

this way, we would not keep this special evidence thing in the component module and have it for reusability.

[stevespringett]

Hi @planetlevel. Yes, controls can be represented in 2.0 and I'm pretty sure that the spec can do what you're looking for. Lets try to model something in our next working group. If for whatever reason there's a gap, we can work on closing that gap in another PR targeting 2.0.