feat(crypto): CBOM model metadata

[qkaiser]

Description

This branch expands the cryptographic asset model with CycloneDX 1.7 certificate metadata. Certificates can now include serial numbers, preferred file extensions, fingerprints, lifecycle dates, predefined or custom lifecycle states, and standardized or custom X.509 extensions. Related cryptographic material also gains fingerprints, while both certificates and related material can express typed relationships to other cryptographic assets such as algorithms and public keys.

All new fields are version-gated to CycloneDX 1.7 and support deterministic comparison, hashing, and JSON/XML round-tripping. Existing CycloneDX 1.6 fields (including deprecated certificate extensions and direct asset references) remain intact for backward compatibility, with expanded schema-validation, enum, snapshot, and serialization tests covering the new behavior.

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: codex
  • LLMs and versions: codex-5.6-sol xhigh
  • Prompts: see below

LLM prompt

## Complete CycloneDX 1.7 cryptography models
Summary
Extend cyclonedx.model.crypto to model and round-trip every requested CycloneDX 1.7 CBOM field in JSON and XML. Preserve all existing 1.6 APIs and deprecated reference fields; the already-implemented key-wrap primitive and 1.7 protocol types require verification rather than duplication.
Public API and model changes

Add reusable RelatedCryptographicAsset(type, ref) and related_cryptographic_assets collections to certificate, related-material, and protocol properties.
Extend CertificateProperties with:
serial_number, certificate_file_extension, and fingerprint: HashType.
certificate_states, using CertificateLifecycleState, CertificatePredefinedState, and CertificateCustomState.
Creation, activation, deactivation, revocation, and destruction timestamps.
certificate_extensions, using common/custom extension models and a schema-backed common-extension-name enum.
Extend RelatedCryptoMaterialProperties with fingerprint and related_cryptographic_assets.
Keep signature_algorithm_ref, subject_public_key_ref, certificate_extension, algorithm_ref, and crypto_refs operational for both 1.6 and 1.7.

Serialization behavior

Gate new fields and structured models to SchemaVersion1Dot7, with exact CycloneDX JSON names, XML element names, ordering, nested arrays, and date/hash mappings.
Add union serialization helpers for certificate states and extensions so JSON and XML deserialize into the correct predefined/custom model.
Include every new property in comparison, hashing, sorting, and representation behavior where applicable.

Test plan

Add enum completeness tests against the bundled 1.7 schemas, including algorithm families, elliptic curves, certificate states/extensions, key-wrap, and protocol types.
Add model tests for construction, equality, hashing, sorting, union discrimination, and mixed-IKEv2 rejection.
Expand representative crypto BOM fixtures and JSON/XML snapshots with every new field.
Validate 1.7 output against strict bundled schemas and test JSON/XML round-trip deserialization.
Verify 1.6 output remains schema-valid, retains legacy fields, omits 1.7-only fields, and preserves protocol-type downgrade behavior.
Run the full unittest suite plus mypy and flake8.

Assumptions

This change targets the upstream library only; Inspector’s temporary extension properties and dependency-graph compatibility relationships remain until it upgrades to a release containing these models.
Existing deprecated CycloneDX fields are not removed or automatically translated into preferred 1.7 relationships.
Schema arrays follow the library convention of deterministic SortedSet storage.

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 123 complexity · 6 duplication

Metric	Results
Complexity	123
Duplication	6

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[read-the-docs-community]

Documentation build overview

📚 CycloneDX Python Library | 🛠️ Build #33581026 | 📁 Comparing 546d0b4 against latest (cf392e0)

  🔍 Preview build  

2 files changed

± genindex.html
± autoapi/cyclonedx/model/crypto/index.html