Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve SBOM Product Management #2685

Open
anthonyharrison opened this issue Feb 10, 2023 · 3 comments
Open

Improve SBOM Product Management #2685

anthonyharrison opened this issue Feb 10, 2023 · 3 comments

Comments

@anthonyharrison
Copy link
Contributor

anthonyharrison commented Feb 10, 2023 •
edited
Loading

SBOMs can specify a product in a number of different ways. For example, a SBOM can include a product as a Name, a CPE or a PURL (and possibly all three!). Whilst the quality of SBOMs is variable (and in some cases inconsistent) extending the mechanisms beyond a name should increase the reliability of the SBOM scanning and reduce false reports as CPE and/or PURL can include vendor information as well.

If a PURL record is used, there is also the possibility of interogating an ecosystem to get more accurante product information.

This task will also require changes to the SBOM parsing routines to use external libraries e.g. SPDX Python Tools

Possibly add to GSOC task?
@terriko terriko added the gsoc Tasks related to our participation in Google Summer of Code label Feb 14, 2023
@anthonyharrison
Copy link
Contributor Author

This may be of relevance.

@terriko
Copy link
Contributor

terriko commented Feb 16, 2023

Darn, I was hoping that they were proposing infrastructure fixes. But better namespaces are good too.

This was referenced Mar 9, 2023
Open
Open
@ffontaine ffontaine mentioned this issue Mar 23, 2023
Closed
@terriko
Copy link
Contributor

terriko commented Apr 25, 2023 •
edited
Loading

This didn't wind up worked explicitly into any gsoc applications this year. We already have Name support so I'm going to open two separate issues and initially invite the hackathon folk to work on them this week:

@terriko terriko removed the gsoc Tasks related to our participation in Google Summer of Code label Apr 25, 2023
This was referenced Apr 25, 2023
Closed
Closed
@anthonyharrison anthonyharrison mentioned this issue Aug 1, 2023
Open
@anthonyharrison anthonyharrison mentioned this issue Sep 12, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@terriko @anthonyharrison