Support for Signing with X509 certificates

[Lachstec]

Hi there. I noticed that it is possible to sign boms with the CLI, but it seems to me that it only works with XML-based BOMs and only with RSA. I think it would be really neat if the CLI would expand on the currently implemented features and add support for X509 Certs and signing with ECDSA. Is that already planned or would a Contribution in this field be welcome?

[andreas-hilti]

Hi @Lachstec
There is nothing planned as far as I know.
There are two aspects:

1. for xml:

add support for X509 Certs and signing with ECDSA

I guess it could be added (without too much work); one would need to check what and how System.Security.Cryptography.Xml supports.

2. for json:
   I have looked into this once. There is quite a bit to be added, which doesn't exist out of the box, in particular w.r.t. to json canonicalization.

Compare also
#56
and
CycloneDX/cyclonedx.org-archived#335

[Lachstec]

Would you be open for Contributions in regard to adding support for signing xml BOMs? I also read up about Signed JSON, it seems that there are some standards for it, but i'm not confident in implementing them in a way that is beneficial for the project.

[andreas-hilti]

The trickiest bit is to get it merged, given the lack of maintainer; but I'd be happy to review.