[2.0] spec review: must --> shall

[jkowalleck]

THe CycloneDX 2.0 schema will be transferred into Ecma-242, 3rd edition.

Per Ecma guidelines, the word "must" should not be used, instead the word "shall" should be used. - as mentioned by @gesa .
(except when it comes to legal stuff - as mentioned by @mjherzog)

• we need to review the textual part of the schema 2.0 to not use "must", but use "shall".
• are there other such phrasing rules?

I think we have a linter tool that could find all "must".

[gesa]

I think we got rid of all the "musts" in the ECMA-424 edition published in 2025, does 2.0 have regressions or is this more a search in any recent additions?

[jkowalleck]

old long-standing issue - see #492 (comment)

working on test pipeline for this

[jkowalleck]

we do have a test for this already: https://github.com/CycloneDX/specification/blob/2.0-dev/tools/src/main/js/linter/checks/no-must-word.check.js
will add it to the CI/CT pipelines

[jkowalleck]

added linter as a regular GH workflow: #1048
this runs on pullrequests and in major merges/pushes

[jkowalleck]

re: #1033 (comment)

current findings as of https://github.com/CycloneDX/specification/actions/runs/32991680107/job/98250507390
see surrent report: report-2.0-no-must-word.json.zip

summary

{
    "filesLinted": 36,
    "totalIssues": 96,
    "totalErrors": 96,
    "totalWarnings": 0
  }

run locally:

node tools/src/main/js/linter/cli.js \
--include no-must-word \
schema/2.0/cyclonedx-2.0.schema.json schema/2.0/model/*.schema.json