Unified evidence model

[stevespringett]

One shared evidence model for components and vulnerabilities that records what was found, how it was determined, the confidence, and the tools and parties involved. 2.0 closes the evidence gaps that 1.x could not address without breaking changes.

Work

• Shared cyclonedx-evidence model, reused by component and vulnerability evidence with structural context separation
• Request: Evidence for Vulnerabilities #333 Vulnerability evidence: presence, absence, graded exploitability, occurrences, supporting data
• Add support for array of callstack frames #278 Multiple call stacks as a first class array, aligned with SARIF code and thread flows
• Substantiate license and copyright evidence (methods, confidence, tools, occurrences), matching identity evidence
• Attribute evidence to the parties involved, not only the tools (assertion.parties)
• Detection rules, policies, and queries, plus scanner and engine versions; method external references
• LLM assessment support via prompt and completion supporting data types
• Centralize the repeated contents construct in the data model
• Replace enum other with the 2.0 string or object form

Breaking changes are allowed in 2.0 and kept minimal. Reference schema validated against a JSON Schema 2020-12 test corpus.

[jkowalleck]

RFC notice sent on July 20, 2026

• https://groups.io/g/CycloneDX/topic/120352781
• https://cyclonedx.slack.com/archives/CVA0G10FN/p1784506598160339

Public RFC period ends August 17, 2026