[Defect]: XML schema incorrectly restricts several ModelCard.Considerations list fields to a single entry

[wiebe-vandendriessche]

Describe the defect

Multiple list fields in the ModelCard definition for CycloneDX 1.5, 1.6, and 1.7 are incorrectly constrained in the XML schema. The elements users, useCases, technicalLimitations, and performanceTradeoffs all have maxOccurs="1" on both the parent element and the child element, which restricts them to a single value.

In the JSON schema, these same fields are defined as arrays. This matches their plural naming and the accompanying documentation.

The XML definitions for the fields listed above appear to be incorrect. They should allow multiple entries, consistent with the JSON schemas.

(Other list fields in the ModelCard definition, such as performanceMetrics, graphics, datasets, inputs, outputs, ethicalConsiderations, and fairnessAssessments, correctly allow multiple entries in both XML and JSON)

Additional context

Example from the XML schema illustrating the issue:

<xs:element name="users" minOccurs="0" maxOccurs="1">
    <xs:complexType>
        <xs:sequence>
            <xs:element name="user" type="xs:string" minOccurs="0" maxOccurs="1" />
        </xs:sequence>
    </xs:complexType>
</xs:element>

<xs:element name="useCases" minOccurs="0" maxOccurs="1">
    <xs:complexType>
        <xs:sequence>
            <xs:element name="useCase" type="xs:string" minOccurs="0" maxOccurs="1" />
        </xs:sequence>
    </xs:complexType>
</xs:element>

<xs:element name="technicalLimitations" minOccurs="0" maxOccurs="1">
    <xs:complexType>
        <xs:sequence>
            <xs:element name="technicalLimitation" type="xs:string" minOccurs="0" maxOccurs="1" />
        </xs:sequence>
    </xs:complexType>
</xs:element>

<xs:element name="performanceTradeoffs" minOccurs="0" maxOccurs="1">
    <xs:complexType>
        <xs:sequence>
            <xs:element name="performanceTradeoff" type="xs:string" minOccurs="0" maxOccurs="1" />
        </xs:sequence>
    </xs:complexType>
</xs:element>

[wiebe-vandendriessche]

Does this require further discussion? If not, I have a draft pull request ready.

[stevespringett]

Thanks for identifying the issue. We'll need to bump the version of the XML schema, but not the spec itself.

For example:

<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
           xmlns:vc="http://www.w3.org/2007/XMLSchema-versioning"
           xmlns:bom="http://cyclonedx.org/schema/bom/1.7"
           xmlns:spdx="http://cyclonedx.org/schema/spdx"
           elementFormDefault="qualified"
           targetNamespace="http://cyclonedx.org/schema/bom/1.7"
           vc:minVersion="1.0"
           vc:maxVersion="1.1"
           version="1.7.1">

So version becomes 1.7.1, but the namespaces remain at 1.7.

[wiebe-vandendriessche]

Hi Steve

Thanks for clarifying. I’ve bumped the XML schema patch versions (1.5, 1.6, 1.7) in the PR, as you suggested. If there’s anything else in the PR that isn’t up to project standards, please let me know.

PR: #744