Proposed 2.0 schema for AI/ML BOM

[mrutkows]

Note: I rebased from "2.0-dev" and then manually brought in schemas from "2.0-threadmodeling" and also from "2.0-blueprints" and this PR is against master...

The only files that matter (if other branches are merged) are:

• schema/2.0/model/cyclonedx-ai-ml-2.0.schema.json
• .gitignore (to ignore files from MacOS and IDEs going forward)

Plus, want to delete the 1.7 port of:

• schema/2.0/model/cyclonedx-ai-modelcard-2.0.schema.json

[mrutkows]

Please note that the patterns found that begin with "^cdx:ai-ml:" can be further constrained to specific taxonomic categories in the referenced AI/ML v2.0 CycloneDX Property Tax. proposal PR (draft). This is included in the proposed schema and reflected in the corollary PR: CycloneDX/cyclonedx-property-taxonomy#175

[mrutkows]

@stevespringett Here is the "off-the-top-of-my-head" list of things that perhaps need thought around risk schema...

Proposed updates the risk schema's "assessment" object

goal: to be used for AI/ML or other types of assessments per regulatory requirements changes needed tot he "risk" schema's assessment object to address the needs for AI regulations (in these terms):

• lists of "harms" and "benefits" relative to using the component (model) assumed to help assess risk scoring
  - i.e., the "pros" and "cons" found by the assessment

Currently, they are declared in "consideration":

        "benefits": {
          "type": "string",
          "title": "Benefits",
          "description": "Expected benefits to the identified groups at risk."
        },
        "harms": {
          "type": "string",
          "title": "Harms",
          "description": "Expected harms to the identified groups at risk."
        },

Promote measure (metrics) and type groupings to "common":

 "measure": {
      "type": "object",
      "title": "Measure",
      "description": "A generic measurement with a value and unit.",
      "required": [
        "value",
        "unit"
      ],
      "additionalProperties": false,
      "properties": {
        "value": {
          "type": "number",
          "title": "Value",
          "description": "The numeric value of the measurement."
        },
        "unit": {
          "type": "string",
          "title": "Unit",
          "description": "The unit of measurement.",
          "anyOf": [
            {"$ref": "#/$defs/timeUnits"},
            {"$ref": "#/$defs/throughputUnits"},
            {"$ref": "#/$defs/computeUnits"},
            {"$ref": "#/$defs/memoryUnits"},
            {"$ref": "#/$defs/ratioUnits"},
            {"$ref": "#/$defs/energyUnits"},
            {"$ref": "#/$defs/co2Units"},
            {"$ref": "#/$defs/customUnitPattern"}
          ]
        }
      }
    },

Note: these include metrics for "enviromentalConsiderations" which have been candidates for move to "common" as well.

Input/Output Formats and encodings

Similarly, "format" and "encoding" objects and values are candidates for promotion to "common":

 "format": {
          "type": "object",
          "title": "Format",
          "$comment": "TODO: There should be a common place in the CycloneDX Property Taxonomy to define encoding types",
          "description": "Describes the format and encoding of the parameter data.",
          "additionalProperties": false,
          "properties": {
            "dataType": {
              "type": "string",
              "title": "Data Type",
              "description": "The data type of the parameter.",
              "examples": [
                "string",
                "float32",
                "fp16",
                "bf16",
                "int64",
                "uint8",
                "q8_0"
              ]
            },
            "encoding": {
              "type": "string",
              "title": "Encoding",
              "description": "The encoding format of the parameter data.",
              "anyOf": [
                {
                  "enum": [
                    "utf-8",
                    "ascii",
                    "base64",
                    "jpeg",
                    "png",
                    "wav",
                    "mp3",
                    "flac",
                    "raw",
                    "tokenized",
                    "other"
                  ],
                  "meta:enum": {
                    "utf-8": "UTF-8 text encoding.",
                    "ascii": "ASCII text encoding.",
                    "base64": "Base64 encoded binary data.",
                    "jpeg": "JPEG image format.",
                    "png": "PNG image format.",
                    "wav": "WAV audio format.",
                    "mp3": "MP3 audio format.",
                    "flac": "FLAC lossless audio format.",
                    "raw": "Raw binary data without specific encoding.",
                    "tokenized": "Pre-tokenized input (token IDs).",
                    "other": "Other encoding format not explicitly listed."
                  }
                },
                {
                  "pattern": "^cdx:ai-ml:[a-z0-9:-]+$"
                }
              ],
              "examples": [
                "utf-8",
                "tokenized",
                "jpeg",
                "wav"
              ]
            },

[mrutkows]

@stevespringett added examples to all simple, non-nested schema type within the ai-ml schema file.