feat: add origin region for hardware provenance

schema/2.0/model/cyclonedx-common-2.0.schema.json

@@ -371,6 +371,13 @@
           "title": "Organizational Contact",
           "description": "A contact at the organization. Multiple contacts are allowed.",
           "items": {"$ref": "#/$defs/organizationalContact"}
+        },
+        "origins": {
+          "type": "array",
+          "title": "Organization Origins",
+          "description": "The geographic origins associated with the organization, such as the country or countries where its goods or services originate. Multiple origins are allowed, each calculated on a different basis.",
+          "minItems": 1,
+          "items": {"$ref": "#/$defs/origin"}
         }
       }
     },
@@ -407,6 +414,52 @@
     },
     "organizationalEntityOrContact": {
 
+    },
+    "origin": {
+      "type": "object",
+      "title": "Origin",
+      "description": "Describes the geographic origin of the subject (for example, a component or party), expressed as a distribution across one or more countries or subdivisions, calculated on a stated basis.",
+      "additionalProperties": false,
+      "required": [ "basis", "distribution" ],
+      "properties": {
+        "basis": {
+          "type": "string",
+          "title": "Origin Basis",
+          "description": "A free-form description of the methodology or unit on which the origin distribution is calculated. Each origin of the same subject must use a distinct basis.",
+          "minLength": 1,
+          "examples": [ "number of parts", "manufacturing cost", "net weight" ]
+        },
+        "distribution": {
+          "type": "array",
+          "title": "Origin Distribution",
+          "description": "The distribution of the origin across regions. The percentages of all entries must total 100, within rounding of the stated precision.",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/originRegion" }
+        }
+      }
+    },
+    "originRegion": {
+      "type": "object",
+      "title": "Origin Region",
+      "description": "A single region of origin and its share of the whole.",
+      "additionalProperties": false,
+      "required": [ "isoCode", "percentage" ],
+      "properties": {
+        "isoCode": {
+          "type": "string",
+          "title": "ISO Code",
+          "description": "The country or subdivision of origin, expressed as an ISO 3166-1 alpha-2 country code (for example, 'CA' for Canada) or an ISO 3166-2 subdivision code (for example, 'US-CA' for California, United States).",
+          "pattern": "^[A-Z]{2}(-[A-Z0-9]{1,3})?$",
+          "examples": [ "CA", "US-CA" ]
+        },
+        "percentage": {
+          "type": "number",
+          "title": "Percentage",
+          "description": "The percentage of the whole attributable to this region. The percentages of all entries in a distribution must total 100, within rounding of the stated precision.",
+          "minimum": 0,
+          "maximum": 100
+        }
+      }
     },
     "properties": {
       "type": "array",

schema/2.0/model/cyclonedx-component-2.0.schema.json

@@ -90,6 +90,13 @@
           "description": "The person(s) or organization(s) that published the component",
           "examples": ["Acme Inc"]
         },
+        "origins": {
+          "type": "array",
+          "title": "Component Origins",
+          "description": "The geographic origins of the component, each expressed as a distribution across one or more countries or subdivisions. Multiple origins are allowed, each calculated on a different basis.",
+          "minItems": 1,
+          "items": { "$ref": "cyclonedx-common-2.0.schema.json#/$defs/origin" }
+        },
         "group": {
           "type": "string",
           "title": "Component Group",