Feature requests for v10 (aka cdxgenx)

[prabhu]

Specification

• Deprecate and remove CycloneDX 1.4 format - v10 release would support only CycloneDX 1.5 and 1.6 #817
• Support BOM in binary proto format (Compatible with official specs)

Language

• Convert to TypeScript #713
• Refactor to use smaller language specific modules #711

Evinse

• Merge evinse with the base cdxgen command so that SBOM with evidence can be generated with a single command - Done

SaaSBOM

• Formalize SaaSBOM generation capability. Include more documentation and tests
• Add sensitive data detection capabilities
• Support for evidence for detected services and data

Granular signing/verification

• Sign individual services in addition to full SBoM signing
• Support for verifying granular signs (Optional depending on the status of the official cli tool) - Released with 9.6.0

Rich annotation

• Textual description and summary based on the contents of the SBOM

Enhancer config

• Config files to enhance/verify the SBOM information

OWASP SCVS

• Add properties to map to controls and levels in SCVS

CBOM

• Initial support for CBOM generation for one language (Java)

Air-gap enhancements

• Can we make cdxgen work without network access? Can it then let the user know what information got missed out because of the lack of connectivity?

Documentation

• Add language/package manager/CI-specific pages
• Create playbooks and best practices for use cases

Stretch goals

• Use cyclonedx-node-module

Release Branch

• release/10.x

[prabhu]

cc: @setchy