kubernetes-sigs/cluster-api

Security Self-Assessment: [STRIDE-TAMPER-1] Produce a SBoM

Open

#6,153 opened on Feb 16, 2022

View on GitHub
 (32 comments) (0 reactions) (1 assignee)Go (1,532 forks)auto 404
area/securityhelp wantedkind/featurepriority/backlogsig/securitytriage/accepted

Repository metrics

Stars
 (4,267 stars)
PR merge metrics
 (PR metrics pending)

Description

User Story

As a cluster operator, i want to know the list of dependencies Cluster API brings for assurance within our organisation's software supply chain.

Detailed Description

  • Create SBoM of all the Cluster API components and verify checksum as a post build action

cc @PushkarJ for adding more details.

/kind feature /area security

Contributor guide

Research direction
Research SBoM generation tools (e.g., syft, trivy, SPDX) and examine the existing build scripts and CI pipeline. Identify where checksum verification can be added as a post build step. Look for existing issues or PRs related to SBoM for guidance.
Tech stack
go
Domain
securitydevops
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoDockerKubernetesBuild systems
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65