feat: Add support for TLP marking in metadata

[anthonyharrison]

As discussed in ticket #595, this PR adds TLP marking in the BOM metadata.

This PR superseeds #603

fixes #595

[jkowalleck]

could you add some documentation here and there, and properly set the default values?

[jkowalleck]

for backwards compatibility reasons, i would not set "CLEAR" as the default value.
I'd prefer a unset as default.

clean means a decision actively was made, right?

in JSON, this would mean no default is defined, and the property is optional.
in XML, this would mean no default is defined, and the element is optional.
in protobuf, this would mean adding a case TLP_UNSPECIFIED = 0;, and the field is optional.

[anthonyharrison]

for backwards compatibility reasons, i would not set "CLEAR" as the default value. I'd prefer a unset as default.

clean means a decision actively was made, right?

in JSON, this would mean no default is defined, and the property is optional. in XML, this would mean no default is defined, and the element is optional. in protobuf, this would mean adding a case TLP_UNSPECIFIED = 0;, and the field is optional.

I see CLEAR as the default when the user makes no choice as the user is more likely to explicitly state one of the other values (which indicates that he has thought about the constraints as regards sharing the BOM). Personally, I would prefer to see all BOMs to have the TLP value explicitly stated but that is possibly too much to expect at this stage.

[jkowalleck]

I'll try to fix the open issues ASAP

[jkowalleck]

The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the component that the BOM describes.

wait what? was the original ticket not about the distribution of the BOM?
why is it now about the distribution of the component???

if this was really about the distribution of the component that the BOM describes,
than the appropriate field would not be $.metadata.someshting but $.metadata.component.something.

[jkowalleck]

@anthonyharrison could you revisit this annotation?

[anthonyharrison]

@jkowalleck I was using the term component to mean SBOM, HBOM, etc and not a software component. Is there a recommended way of saying this as the TLP applies to all types of BOM?

My proposed change would be 'The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the BOM'

[jkowalleck]

maybe use

The Traffic Light Protocol (TLP) classification that controls the sharing and distribution of the BOM.

PS: eventually there will be a community review phase (RFC), so somebody else might have additional ideas how to phase things better.

[jkowalleck]

@anthonyharrison, the current state looks promising.

According to the CycloneDX working model, the next step would be to move from "prototype" to "draft", meaning the community review phase (RFC) would start.
Do you want to change anything, or should we move to RFC?

[anthonyharrison]

@jkowalleck Let's go to the next stage and see what the community thinks. I have no outstanding changes.

[jkowalleck]

RFC notice sent.

• https://groups.io/g/CycloneDX/message/307
• https://cyclonedx.slack.com/archives/CVA0G10FN/p1742068954697559

Public RFC period ends April 13, 2025

[prabhu]

default could be UNKNOWN.

[anthonyharrison]

UNKNOWN is not a valid TLP value

[prabhu]

We can retain the TLP: prefix to avoid confusions and retain the exact semantic meanings.

From the first.org website:

The four TLP labels are: TLP:RED, TLP:AMBER, TLP:GREEN, and TLP:CLEAR. In written form, they MUST not contain spaces and SHOULD be in capitals. TLP labels MUST remain in their original form, even when used in other languages: content can be translated, but the labels cannot.

[anthonyharrison]

The TLP values are identical to those adopted by CSAF

[jkowalleck]

All current discussuons are basically too late. Public RFC ended on 13. of April.

This feature is promoted to become standardized under Ecma. Vote will be on 1. May.

Please do not alter the current state last minute.
FYI : If you want to alter things, we will restart the month long RFC phase and then wait another month or so for Ecma.