Introduce "SBOM" as a new data structure in DejaCode

Offen
  • Stimmt etwas nicht?
#175 13 Kommentare 0 Reaktionen 1 zugewiesene Person Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@DennisClark arbeitet bereits daran.

Seit 03.9.2024.

Bewertung

Dieses Issue wurde noch nicht bewertet.

Beschreibung

design needed enhancement

Problem
The SBOM community has identified multiple types of SBOM:
Software Bill of Materials (SBOM) -- the default of course
Software-as-a-Service Bill of Materials (SaaSBOM)
Hardware Bill of Materials (HBOM)
Machine Learning Bill of Materials (ML-BOM)
Cryptography Bill of Materials (CBOM)
Manufacturing Bill of Materials (MBOM)
Operations Bill of Materials (OBOM)

This list is ever-expanding; other variants include:
As-built SBOM
As-deployed SBOM

These various types are implemented variously by different SBOM standards (CycloneDX and SPDX).

The DejaCode Product definition is quite flexible, and Packages and Components can be defined to identify the kinds of things that exist in each SBOM type, but there is no standard way to identify the SBOM Type associated with a specific DejaCode Product, further complicated by the potential need to extract particular SBOMs of various types from the same Product Inventory.

Benefits
A new SBOM Type would address that need, and would support additional functionality related to various SBOM Types. Eventually this would support the generation of SBOMs from DejaCode that are more specific than the generic SBOM.

Design Challenges
Define SBOM Types in a new user-editable table in DejaCode?
OR
Define SBOM Types in a standard list in the source code?
OR
Do not validate SBOM Type and let it be free-form text?

Some advantages of an SBOM Type table would be:

  • ability to describe exactly what the SBOM Type means to the organization
  • ability to associate the SBOM Type with an SBOM Template (future ability -- this might align, for example, with SPDX SBOM "Profiles")
  • ability to associate the SBOM Type with a specific SBOM Generator (program, DejaCode Report, etc. -- also future).

Assumptions
A DejaCode Product definition can be associated with exactly one SBOM Type in a meaningful way.

Vorherrschende Sprache
Python
Sterne
53
Forks
31
Ø Merge
12 Std. 19 Min.
Gemergte PRs (30 T.)
16

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus aboutcode-org/dejacode

Alle Issues in aboutcode-org/dejacode

Ähnliche Issues

Weitere Issues zu Python

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.