feat: add support for Service.trustZone by VanL · Pull Request #980 · CycloneDX/cyclonedx-python-lib

VanL · 2026-05-19T17:13:32Z

Adds the optional trust_zone field to Service, available in CycloneDX v1.5 and later. Serializes as trustZone in JSON and <trustZone> in XML for schemas 1.5, 1.6, and 1.7; omitted for earlier versions.

Implements part of issue #578.

Description

Adds the optional trust_zone field to Service, available in
CycloneDX v1.5 and later. Serializes as trustZone in JSON and
<trustZone> in XML for schemas 1.5/1.6/1.7; omitted for earlier
versions.

Resolves a part of: #578

AI Tool Disclosure

My contribution does not include any AI-generated content
My contribution includes AI-generated content, as disclosed below:
- AI Tools: Codex, Claude Code
- LLMs and versions: Opus 4.7, Codex 5.5 (XHigh)
- Prompts: Reviewed the existing TODO in cyclonedx/model/service.py:242-251,
  drafted an implementation plan, and implemented per the CycloneDX 1.5+
  service.trustZone schema. Implemented multiple agent adversarial review.

Affirmation

My code follows the CONTRIBUTING.md guidelines

codacy-production · 2026-05-19T17:14:29Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

read-the-docs-community · 2026-05-19T17:15:59Z

Documentation build overview

📚 CycloneDX Python Library | 🛠️ Build #33584565 | 📁 Comparing 25c9a4c against latest (0daf3f9)

🔍 Preview build

11 files changed · + 2 added · ± 9 modified

+ Added

± Modified

Copilot

Pull request overview

Adds CycloneDX v1.5+ support for Service.trustZone (Python attribute trust_zone) in the Service model, ensuring it serializes/deserializes correctly and is omitted for earlier schema versions.

Changes:

Added optional trust_zone: Optional[str] to cyclonedx.model.service.Service, with schema-version-gated serialization (v1.5+ only) and XML normalized-string handling.
Added/updated JSON and XML output validation tests to confirm presence/absence by schema version and schema rejection for pre-1.5 documents.
Updated deserialization tests and snapshot fixtures/models to include trustZone for v1.5–v1.7 outputs.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
cyclonedx/model/service.py	Introduces `trust_zone` property with v1.5+ serialization views and normalized XML string handling; updates equality/hash tuple.
tests/test_output_xml.py	Adds XML output tests for `trustZone` across schema versions, including normalization and pre-1.5 rejection validation.
tests/test_output_json.py	Adds JSON output tests for `trustZone` across schema versions and pre-1.5 rejection validation.
tests/test_model_service.py	Adds model-level tests for default/setter behavior and equality/sorted-set membership impact.
tests/test_deserialize_xml.py	Adds XML deserialization test for `trustZone` (v1.7).
tests/test_deserialize_json.py	Adds JSON deserialization test and JSON→XML roundtrip test preserving `trust_zone`.
tests/_data/models.py	Updates complex services fixture to set `trust_zone` so snapshots include the new field where applicable.
tests/_data/snapshots/get_bom_with_services_complex-1.5.xml.bin	Snapshot updated to include `<trustZone>` for schema v1.5.
tests/_data/snapshots/get_bom_with_services_complex-1.5.json.bin	Snapshot updated to include `trustZone` for schema v1.5.
tests/_data/snapshots/get_bom_with_services_complex-1.6.xml.bin	Snapshot updated to include `<trustZone>` for schema v1.6.
tests/_data/snapshots/get_bom_with_services_complex-1.6.json.bin	Snapshot updated to include `trustZone` for schema v1.6.
tests/_data/snapshots/get_bom_with_services_complex-1.7.xml.bin	Snapshot updated to include `<trustZone>` for schema v1.7.
tests/_data/snapshots/get_bom_with_services_complex-1.7.json.bin	Snapshot updated to include `trustZone` for schema v1.7.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

jkowalleck · 2026-06-04T10:46:36Z

please rebase onto latest main branch

jkowalleck · 2026-06-17T11:32:06Z

please rebase onto latest main branch.
It brings additional tests that might be needed here.

jkowalleck · 2026-06-17T13:44:51Z

        bom: Bom = Bom.from_json(json)  # <<< is expected to not crash
        self.assertIsNotNone(bom)

+    def test_service_trust_zone_from_json(self) -> None:


why is this test needed?

As per the comment below, I usually put in similar tests. Sorry I didn't see the main serialization/deserialization harness. I have deleted/moved as appropriate.

jkowalleck · 2026-06-17T13:45:04Z

+        })
+        self.assertEqual('internal-vpc', next(iter(bom.services)).trust_zone)
+
+    def test_service_trust_zone_json_to_xml_roundtrip(self) -> None:


why is this test needed?

This test (as well as the from-json test) were designed to make sure that the new trustZone items would round-trip correctly. Anytime I am working with a serialization format I add a similar test. I can remove it if you would like, though.

Resolved per other comment.s

jkowalleck · 2026-06-17T13:45:15Z

        self.assertBomDeepEqual(expected, bom,
                                fuzzy_deps=get_bom in all_get_bom_funct_with_incomplete_deps)

+    def test_service_trust_zone_from_xml(self) -> None:


why is this test needed?

jkowalleck · 2026-06-17T13:46:13Z

(de)serzialization tests are automatically done with all the test models.
please move them there.

Done. Sorry for not noticing the proper harness.

jkowalleck · 2026-06-17T13:46:19Z

(de)serzialization tests are automatically done with all the test models.
please move them there.

Done. Sorry for not noticing the proper harness.

Adds the optional `trust_zone` field to `Service`, available in CycloneDX v1.5 and later. Serializes as `trustZone` in JSON and `<trustZone>` in XML for schemas 1.5, 1.6, and 1.7; omitted for earlier versions. Implements part of issue CycloneDX#578. Signed-off-by: VanL <van@ospo.co>

Signed-off-by: VanL <van@ospo.co>

Signed-off-by: VanL <van@modelmonster.ai>

CAOShurong

AI-assisted review disclosure: I used Codex to independently inspect and execute the checks below on the current head 25c9a4c. This is a technical review, not a maintainer or code-owner statement.

I verified the compatibility boundary that this change is intended to provide:

In a clean environment with the built 11.11.0 wheel installed, Service.trust_zone serializes as trustZone/<trustZone> for v1.5, v1.6, and v1.7; strict JSON/XML validation succeeds; root and nested services preserve the value through JSON and XML deserialization.
For v1.4, the field is omitted at both root and nested-service levels. Injecting trustZone into v1.4 JSON/XML is rejected by the bundled strict schemas, so the new field does not leak into older documents.
Focused model/output/deserialization tests: 756 passed. Full suite with PYTHONUTF8=1: 6962 passed. Flake8, mypy, wheel/sdist build, and clean-wheel installation also passed.

The implementation and current fixtures therefore preserve the pre-v1.5 boundary while adding the requested v1.5+ field. I found no correctness or compatibility issue on this exact head and approve.

saquibsaifee · 2026-08-31T16:15:34Z

@VanL is the PR ready from your side?

VanL · 2026-08-31T17:35:36Z

Yes, I think so

saquibsaifee · 2026-08-31T21:07:35Z

+    @serializable.view(SchemaVersion1Dot6)
+    @serializable.view(SchemaVersion1Dot7)
+    @serializable.xml_sequence(9)
+    def trust_zone(self) -> Optional[str]:


The trust_zone property is missing the @serializable.xml_string(serializable.XmlStringSerializationType.NORMALIZED_STRING) decorator that all other Optional[str] fields in this class carry (e.g. group, description, version, name).

The CycloneDX schema defines trustZone as xs:normalizedString, which requires tab/newline characters to be collapsed to spaces. Without this decorator, a value like 'internal\tvpc' will be written as a literal tab into the XML output, producing an invalid document.

@property @serializable.view(SchemaVersion1Dot5) @serializable.view(SchemaVersion1Dot6) @serializable.view(SchemaVersion1Dot7) @serializable.xml_string(serializable.XmlStringSerializationType.NORMALIZED_STRING) # ← add this @serializable.xml_sequence(9) def trust_zone(self) -> Optional[str]:

After adding the decorator, the XML snapshot fixtures (*.xml.bin) need to be regenerated — the tab in internal\tvpc should be normalized to a space (internal vpc) in the XML output.

saquibsaifee · 2026-08-31T21:07:41Z

      </endpoints>
      <authenticated>false</authenticated>
      <x-trust-boundary>true</x-trust-boundary>
+      <trustZone>internal	vpc</trustZone>


The XML snapshot contains a raw tab character (internal\tvpc) rather than the normalized form internal vpc.

Since trustZone is typed as xs:normalizedString in the CycloneDX XML schema, tab/newline/carriage-return characters must be normalized to spaces before output. Once the @serializable.xml_string(NORMALIZED_STRING) decorator is added to the trust_zone property in service.py, please regenerate this snapshot — it should read <trustZone>internal vpc</trustZone> instead.

saquibsaifee · 2026-08-31T21:12:27Z

+    @serializable.view(SchemaVersion1Dot5)
+    @serializable.view(SchemaVersion1Dot6)
+    @serializable.view(SchemaVersion1Dot7)
+    @serializable.xml_sequence(9)


Suggested change

@serializable.xml_sequence(9)

@serializable.xml_sequence(9)

@serializable.xml_string(serializable.XmlStringSerializationType.NORMALIZED_STRING)

VanL requested a review from a team as a code owner May 19, 2026 17:13

jkowalleck mentioned this pull request May 22, 2026

[TRACKING] Complete support for CycloneDX v1.5 #578

Open

16 tasks

jkowalleck added enhancement New feature or request schema 1.5 labels May 22, 2026

jkowalleck requested a review from Copilot May 22, 2026 16:00

Copilot started reviewing on behalf of jkowalleck May 22, 2026 16:01 View session

Copilot AI reviewed May 22, 2026

View reviewed changes

jkowalleck requested changes Jun 17, 2026

View reviewed changes

VanL added 2 commits July 1, 2026 09:49

Improve XML serialization

b320cff

Signed-off-by: VanL <van@ospo.co>

VanL force-pushed the feat/service-trust-zone branch from c1325cb to 3db6f16 Compare July 1, 2026 14:50

Remove specific serialization tests in favor of regular harness

32c8304

Signed-off-by: VanL <van@modelmonster.ai>

VanL force-pushed the feat/service-trust-zone branch from 3db6f16 to 32c8304 Compare July 1, 2026 21:52

Merge branch 'main' into feat/service-trust-zone

25c9a4c

CAOShurong approved these changes Aug 15, 2026

View reviewed changes

saquibsaifee reviewed Aug 31, 2026

View reviewed changes

	@serializable.xml_sequence(9)
	@serializable.xml_sequence(9)
	@serializable.xml_string(serializable.XmlStringSerializationType.NORMALIZED_STRING)

Uh oh!

Uh oh!

Conversation

VanL commented May 19, 2026

Description

AI Tool Disclosure

Affirmation

Uh oh!

codacy-production Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

read-the-docs-community Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

jkowalleck commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkowalleck commented Jun 17, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CAOShurong left a comment

Choose a reason for hiding this comment

Uh oh!

saquibsaifee commented Aug 31, 2026

Uh oh!

VanL commented Aug 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

saquibsaifee Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codacy-production Bot commented May 19, 2026 •

edited

Loading

read-the-docs-community Bot commented May 19, 2026 •

edited

Loading

jkowalleck commented Jun 4, 2026 •

edited

Loading

saquibsaifee Aug 31, 2026 •

edited

Loading