revisit formulations

[jkowalleck]

formulations have some issues:

• steps can not have own input/output, but tasks can -- how would you craft a task that runs multiple steps, where every step then hands over a new piece of information to the next one?
• docs are misleading or confusing
  • where does this "inbound"/"outbound" come from? what is a "data flow"?

    • specification/schema/2.0/model/cyclonedx-formulation-2.0.schema.json

      Line 653 in a1c8aeb

      "description": "A reference to the component or service that provided the input to the task (e.g., reference to a service with data flow value of `inbound`)",

    • specification/schema/2.0/model/cyclonedx-formulation-2.0.schema.json

      Line 753 in a1c8aeb

      "description": "Component or service that received the output from the task (e.g., reference to an artifactory service with data flow value of `outbound`)",

  • ... to be continued ...
• examples dont validate against own schema.
  • per JSON schema spec, examples should validate against their schema.
    see https://json-schema.org/understanding-json-schema/reference/annotations
  • here, the target is a complex object(resourceReferenceChoice), but the example is a string
    

    specification/schema/2.0/model/cyclonedx-formulation-2.0.schema.json

    Lines 751 to 756 in a1c8aeb

    	"target": {
    	"title": "Target",
    	"description": "Component or service that received the output from the task (e.g., reference to an artifactory service with data flow value of `outbound`)",
    	"examples": ["a log file described as an `externalReference` within its target domain."],
    	"$ref": "#/$defs/resourceReferenceChoice"
    	},

  • ... to be continued ...
• input/output in general are not system-independent
• a workflow must have a taskTypes, but may have no tasks at all
• a workflow may have a task and steps, while a task has steps itself.
• ... to be continued ...

relevant resources: https://github.com/CycloneDX/guides/tree/main/MBOM/en

---

PS: Some of the "issues" I raised may be mistaken on my part — feel free to correct me in the discussion.

[stevespringett]

cc: @mrutkows