Create SBOMs for ASF application binary distributions
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
Research direction
No repository files or tests are identified. Start by reviewing the distribution table and its download URLs and tools, then determine how the listed binary distributions will be covered; done means providing SBOMs for the targeted ASF application distributions, expanding beyond the initial list.
Written by the indexing model from the issue text.
Description
The purpose of this issue is to provide SBOMs for all ASF binary distributions, starting with those that:
- contain executable applications,
- bundle all or most of their dependencies.
These are IMHO the most critical distributions, since users can not easily upgrade vulnerable dependencies without a new release.
The following table contains a list of binary application distributions of various Apache TLPs.
Currently only 10% of the TLPs are included:
| Application | Download URL | Tool | SBOM |
|---|---|---|---|
| Accumulo | https://accumulo.apache.org/downloads/ | Maven Assembly | [ ] |
| ActiveMQ Artemis | https://activemq.apache.org/components/artemis/download/ | Maven Assembly | [ ] |
| ActiveMQ Classic | https://activemq.apache.org/components/classic/download/ | Maven Assembly | [ ] |
| Age | only source releases? | [ ] | |
| Airavata | https://airavata.apache.org/development.html#downloads | Maven Assembly | [ ] |
| Airflow | only Python packages + Docker? | Python | [x] |
| Allura | only source releases? | [ ] | |
| Ambari | only source releases? | [ ] | |
| Ant | https://ant.apache.org/bindownload.cgi | Ant | [ ] |
| APISIX | only source releases + Docker | [ ] | |
| Aries | only sample applications | [ ] | |
| Arrow | only libraries | [ ] | |
| AsterixDB | https://asterixdb.apache.org/download.html | Maven Assembly | [ ] |
| Atlas | only libraries? | [ ] | |
| Avro | only libraries? | [ ] | |
| Axis | https://axis.apache.org/axis2/java/core/download.html | Maven WAR | [ ] |
| Beam | only libraries? | [ ] | |
| Bigtop | https://bigtop.apache.org/download.html#releases | Dpkg and Rpm | [ ] |
| Bookkeeper | https://bookkeeper.apache.org/releases/ | Maven Assembly | [ ] |
| Brooklyn | https://brooklyn.apache.org/download/index.html | Maven Assembly | [ ] |
- Dominant language
- CSS
- Stars
- 14
- Forks
- 16
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 15
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/security-site
-
generate advisories deterministicallyPossibly taken @basantjamwal claimed this 4 days ago. Openadvisories
Difficulty 3/5 1-2 days Newbie friendliness 64/100
apache/security-site#96 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
sbom
Difficulty 3/5 1-2 days Newbie friendliness 48/100
apache/security-site#44 ·
Maintainers usually reply within 1 day
-
sbom
Difficulty 5/5 Over a week Newbie friendliness 25/100
apache/security-site#43 ·
Maintainers usually reply within 1 day
-
sbom
Difficulty 5/5 Over a week Newbie friendliness 30/100
apache/security-site#42 · 1 comment ·
Maintainers usually reply within 1 day
All issues in apache/security-site
Similar issues
-
Security SecurityBundle
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
symfony/symfony-docs#23173 ·
Maintainers usually reply within 3 days
-
security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
OSCI'26
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
GauravKarakoti/SecureFlow#1215 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
containers/bubblewrap#813 · 1 reaction ·
Maintainers usually reply within 1 day
-
documentation security
Difficulty 2/5 Half a day Newbie friendliness 72/100