[FEATURE]: Rename bomFormat to specFormat

[stevespringett]

Proposal: Rename bomFormat to specFormat

Summary

This proposal recommends renaming the root-level property bomFormat to specFormat to better reflect CycloneDX's evolution from a Bill of Materials standard into a comprehensive transparency expression language.

Background

Current implementation

The bomFormat property is currently defined in the CycloneDX 1.7 JSON Schema as follows:

"bomFormat": {
  "type": "string",
  "title": "BOM Format",
  "description": "Specifies the format of the BOM. This helps to identify the file as CycloneDX since BOMs do not have a filename convention, nor does JSON schema support namespaces. This value must be "CycloneDX".",
  "enum": [
    "CycloneDX"
  ]
}

The property is required at the root level alongside specVersion and serves as a format identifier.

The problem

CycloneDX has evolved far beyond a traditional "Bill of Materials" format. The specification now supports a diverse range of document types and use cases that may not constitute a BOM at all:

Document type	Description
VEX	Vulnerability Exploitability eXchange documents
VDR	Vulnerability Disclosure Reports
CDXA	CycloneDX Attestations for compliance-as-code
BOV	Bill of Vulnerabilities (standalone vulnerability data)
Release notes	Common release notes format

Additionally, CycloneDX 2.0 introduces behavioral, threat, and risk modeling capabilities that push further away from a BOM-only model

Proposed change

Rename the property

Current	Proposed
bomFormat	specFormat

Proposed schema definition

"specFormat": {
  "type": "string",
  "title": "Specification Format",
  "description": "Specifies the format. This value shall be \"CycloneDX\".",
  "enum": [
    "CycloneDX"
  ]
}

[stevespringett]

Note, the 2.0-dev branch already contains this change so there are no open PRs. If the proposal is rejected, the branch and all child branches will be reverted back to bomFormat.

[devashridatta-dotcom]

Thank you for raising this proposal. The rationale for renaming bomFormat to specFormat appears well-aligned with CycloneDX’s evolution beyond a traditional Bill of Materials into a broader set of transparency artifacts, including VEX, VDR, attestations, BOV, and release-note use cases.

From an enterprise SBOM and transparency governance perspective, clearly distinguishing the document’s specification context at the root level materially improves automation, ingestion logic, and policy routing—particularly in environments that process mixed CycloneDX artifacts across large and diverse product portfolios.

The proposed specFormat naming better reflects real-world usage and helps avoid the implicit assumption that all CycloneDX documents represent BOM-only content. This clarification also supports interoperability when integrating CycloneDX artifacts into supply-chain transparency and compliance systems that rely on accurate format identification.