CycloneDX/sbom-utility
Add support for displaying/validating CDX Signature schema (struct)
オープン
#27 opened on 2023/05/19
enhancementhelp wanted
Repository metrics
- Stars
- (155 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
i.e., add property Signature CDXSignaturejson:"signature,omitempty"to top-levelCDXBom` structure. Then support it with signing verification (validation) with testcases.
This will be a bit of a challenge as we may also need to implement JSF schema:
As referenced by the CycloneDX schema (external).
As we want the utility to work in a network-disconnected environment (e.g., a secure build pipeline), this would have to bring in a static encoding (marshal/unmarshal, etc.)