Skip to content
This repository was archived by the owner on Dec 20, 2024. It is now read-only.

Commit b14f0db

Browse files
stevespringettstevespringett
committed
Merge remote-tracking branch 'origin/master'
2 parents 02c0d2e + 90af643 commit b14f0db

File tree

10 files changed

+228
-14
lines changed

10 files changed

+228
-14
lines changed

‎Gemfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,4 @@ gem "jekyll-sitemap"
55
gem "jekyll-last-modified-at"
66
gem 'jekyll-feed'
77
gem 'jekyll-redirect-from'
8+
gem 'jekyll-regex-replace'

‎Gemfile.lock‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ GEM
3636
posix-spawn (~> 0.3.9)
3737
jekyll-redirect-from (0.16.0)
3838
jekyll (>= 3.3, < 5.0)
39+
jekyll-regex-replace (1.1.0)
3940
jekyll-sass-converter (2.1.0)
4041
sassc (> 2.0.1, < 3.0)
4142
jekyll-sitemap (1.4.0)
@@ -80,7 +81,8 @@ DEPENDENCIES
8081
jekyll-feed
8182
jekyll-last-modified-at
8283
jekyll-redirect-from
84+
jekyll-regex-replace
8385
jekyll-sitemap
8486

8587
BUNDLED WITH
86-
2.2.30
88+
2.3.25

‎_config.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ plugins:
6262
- jekyll-last-modified-at
6363
- jekyll-feed
6464
- jekyll-redirect-from
65+
- jekyll-regex-replace
6566
defaults:
6667
-
6768
scope:

‎_data/carousel.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
- title: "CycloneDX: The International Standard for Bill of Materials (ECMA-424)"
2+
image: /theme/assets/images/hero-header.png
3+
description: The OWASP Foundation and Ecma International Technical Committee for Software & System Transparency (TC54), which includes representatives from Bloomberg, IBM, Lockheed Martin, and ServiceNow, drive the continued advancement of the specification.
14
- title: CycloneDX is designed to provide advanced supply chain capabilities for cyber risk reduction.
25
image: /theme/assets/images/hero-header.png
36
description: Compatible with over 200 tools across 20+ programming languages, CycloneDX is trusted by Lockheed Martin, ServiceNow, IBM, Contrast Security, Sonatype, and many others.
@@ -15,7 +18,4 @@
1518
description: CycloneDX can leverage SPDX license IDs and expressions, along with comprehensive commercial license support, supporting open source license compliance and Software Asset Management (SAM) use cases.
1619
- title: CycloneDX evolves with your project or organizational needs.
1720
image: theme/assets/images/beyond_sbom_hero.jpg
18-
description: Trusted by beginners and experts, CycloneDX offers an easy on-ramp to adoption and the world's most extensive collection of tools to get started.
19-
- title: CycloneDX is supported by technology leaders across the world.
20-
image: theme/assets/images/ecma_hero.jpg
21-
description: The OWASP Foundation maintains CycloneDX with help from the Ecma International Technical Committee for Software & System Transparency (TC54), which includes representatives from Bloomberg, IBM, Lockheed Martin, and ServiceNow.
21+
description: Trusted by beginners and experts, CycloneDX offers an easy on-ramp to adoption and the world's most extensive collection of tools to get started.

‎_data/tools.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1957,3 +1957,11 @@
19571957
categories:
19581958
- transform
19591959
- opensource
1960+
- name: cdx-enrich
1961+
publisher: Michael Tsfoni
1962+
description: Enriches a CycloneDX Software Bills of Material (SBOM) with predefined data.
1963+
websiteUrl: https://github.com/mtsfoni/cdx-enrich
1964+
repoUrl: https://github.com/mtsfoni/cdx-enrich
1965+
categories:
1966+
- build-integration
1967+
- opensource

‎_posts/2024-07-01-cyclonedx-v1.6-now-an-ecma-international-standard.md‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
---
2+
# Page settings
3+
layout: document
4+
keywords: application security, software security, software bill of material, SBOM, BOM, open source, supply chain, specification, spdx, license, package url, purl, cpe
5+
comments: false
6+
banner: false
7+
8+
# News article settings
9+
organization: CycloneDX
10+
type: Press Release
11+
12+
title: "CycloneDX v1.6: Now an Ecma International Standard"
13+
window_title: "CycloneDX v1.6: Now an Ecma International Standard"
14+
description: "CycloneDX v1.6: Now an Ecma International Standard"
15+
location: WILMINGTON, DE
16+
subtitle: CycloneDX v1.6 has been officially ratified as an Ecma International standard, following a decisive vote at the Ecma General Assembly on 26 June.
17+
excerpt: This milestone sets the stage for CycloneDX Bill of materials being available as a global xBOM (Bill of Materials) standard for use across multiple domains. CycloneDX is proud to be an OWASP Flagship standards project, and in a community development model with Ecma International’s TC54, underscoring its importance and impact in the industry.
18+
image: https://cyclonedx.org/theme/assets/images/hero-subheader.png
19+
20+
# Micro navigation
21+
micro_nav: false
22+
23+
# Page navigation
24+
breadcrumbs:
25+
- title: CYCLONEDX
26+
- title: ABOUT
27+
- title: NEWSROOM
28+
29+
---
30+
31+
# CycloneDX v1.6: Now an Ecma International Standard
32+
**01 July 2024**
33+
34+
OWASP is excited to announce that CycloneDX v1.6 has been officially ratified as an Ecma International standard,
35+
CycloneDX Bill of materials specification, following a decisive vote at the Ecma General Assembly on 26 June.
36+
This milestone sets the stage for CycloneDX Bill of materials being available as a global xBOM (Bill of Materials)
37+
standard for use across multiple domains. CycloneDX is proud to be an OWASP Flagship standards project, and in a
38+
community development model with Ecma International’s TC54, underscoring its importance and impact in the industry.
39+
40+
#### **A Comprehensive Standard for the Software Supply Chain**
41+
CycloneDX v1.6 stands out as the global xBOM standard that holistically supports a wide range of assets, including
42+
software, services, hardware, firmware, AI/ML, and cryptography. This broad coverage is crucial in today’s complex
43+
and interconnected technology landscape, enabling organizations to achieve comprehensive visibility and management
44+
across their entire supply chain.
45+
46+
* **Software**: Ensures detailed transparency and management of software components, vital for addressing security vulnerabilities and ensuring compliance.
47+
* **Services**: Covers third-party services, providing insights into potential risks and dependencies that could impact operational integrity.
48+
* **Hardware and Firmware**: Facilitates robust management and security of physical components and embedded systems, crucial for sectors like IoT and critical infrastructure.
49+
* **AI/ML**: Addresses the growing need to manage and secure machine learning models and data, essential for maintaining trust and performance in AI-driven applications.
50+
* **Cryptography**: Ensures secure handling and implementation of cryptographic assets, including Post-Quantum Cryptography (PQC) readiness as outlined in [NIST SP 1800-38B](https://csrc.nist.gov/pubs/sp/1800/38/iprd-(1)). This is a fundamental aspect of protecting data integrity and confidentiality from evolving threats.
51+
52+
#### **Ideal for Holistic Supply Chain and Advanced Cybersecurity Use Cases**
53+
54+
CycloneDX v1.6 is specifically designed to meet the demands of holistic supply chain management and advanced
55+
cybersecurity use cases. By providing a detailed and comprehensive view of the entire supply chain, CycloneDX
56+
enables organizations to identify and mitigate risks effectively, ensuring resilience and security.
57+
58+
59+
#### **Unmatched License Support**
60+
61+
One of the standout features of CycloneDX v1.6 is its advanced license support, which holistically helps to
62+
facilitate open-source license compliance and supports commercial license management and procurement scenarios.
63+
This capability is critical for organizations navigating the complexities of software licensing, ensuring compliance
64+
and optimizing procurement processes.
65+
66+
67+
#### **Wide Industry Support**
68+
69+
CycloneDX has garnered wide industry support, with over 220 tools now supporting the standard. This extensive
70+
ecosystem demonstrates the trust and adoption by the industry, making CycloneDX a reliable and effective choice
71+
for organizations looking to enhance their supply chain security and management.
72+
73+
#### **Quotes**
74+
75+
<blockquote class="press-release">
76+
<p>The ratification of CycloneDX Bill of materials specification as an Ecma International standard is a testament to
77+
the effectiveness of the community model established by Technical Committee 54 (TC54). This model is a benchmark
78+
for future technical committees and the CycloneDX Bill of materials specification is just the beginning, with
79+
several other supply chain standards expected to emerge from TC54.</p>
80+
<cite>Samina Husain, Secretary General of Ecma International</cite>
81+
</blockquote>
82+
83+
<blockquote class="press-release">
84+
<p>CycloneDX Bill of materials specification recognition as an international standard is a testament to its robustness
85+
and wide industry adoption. It exemplifies the kind of innovative solutions the OWASP Foundation is proud to support.</p>
86+
<cite>Andrew van der Stock, Executive Director of the OWASP Foundation</cite>
87+
</blockquote>
88+
89+
<blockquote class="press-release">
90+
<p>The standardization of CycloneDX by Ecma International is a major milestone for the global technology community.
91+
This achievement highlights our commitment to creating secure, transparent, and manageable supply chains.</p>
92+
<cite>Steve Springett, Chair of the Ecma TC54 and Director of Product Security at ServiceNow</cite>
93+
</blockquote>
94+
95+
#### **About Ecma Technical Committee (TC54)**
96+
97+
The Ecma Technical Committee 54 (TC54) is responsible for drafting the CycloneDX Bill of materials specification and
98+
other related initiatives. Operating under a community development model, the committee is dedicated to standardizing
99+
core data formats, APIs, and algorithms that advance software and system transparency.
100+
101+
Among TC54's ongoing projects is the standardization of Package URL (purl), a specification for identifying and locating
102+
software packages. This is crucial for managing dependencies and vulnerabilities across diverse software ecosystems.
103+
Another key initiative is the Transparency Exchange API, designed for the efficient sharing of supply chain artifacts
104+
and intelligence, further enhancing the security and transparency of supply chains.
105+
106+
For more information about TC54 and its initiatives, please visit [https://tc54.org](https://tc54.org).
107+
108+
##### **About Ecma International**
109+
110+
Ecma International is a not-for-profit industry association of technology developers, vendors, and users founded
111+
in 1961 and dedicated to the standardization of Information and Communication Technology (ICT) and Consumer
112+
Electronics (CE). For over 60 years Ecma has actively contributed to worldwide standardization in information
113+
technology and telecommunications. More than 400 Ecma Standards and 100 Technical Reports of high quality have
114+
been published, more than two-thirds of which have also been adopted as International Standards and/or Technical
115+
Reports.
116+
117+
To learn more or to become a member, visit [https://ecma-international.org](https://ecma-international.org).
118+
119+
##### **About the OWASP Foundation**
120+
The OWASP Foundation is a nonprofit organization that works to improve the security of software. Through community-led
121+
open source software projects, over 260 local chapters worldwide, tens of thousands of members, and leading educational
122+
and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. For
123+
nearly two decades corporations, foundations, developers, and volunteers have supported the OWASP Foundation and its
124+
work. To learn more or to become a member, visit [https://owasp.org](https://owasp.org).
125+
126+
For more information about CycloneDX v1.6 and its benefits, please visit [https://cyclonedx.org](https://cyclonedx.org).

‎about/working-groups/working-groups.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4628,5 +4628,19 @@
46284628
"categories": [
46294629
"contributors"
46304630
]
4631+
},
4632+
{
4633+
"displayName": "patveck",
4634+
"lastName": "patveck",
4635+
"headshot": "https://avatars.githubusercontent.com/u/3521311?v=4",
4636+
"organization": null,
4637+
"description": null,
4638+
"twitter": null,
4639+
"linkedin": null,
4640+
"github": "patveck",
4641+
"homepage": "https://github.com/patveck",
4642+
"categories": [
4643+
"contributors"
4644+
]
46314645
}
46324646
]

‎theme/_includes/tool-card.html‎

Lines changed: 34 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,39 @@
1111
<div class="card-body">{{tool.description | truncate:250}}</div>
1212
<div style="line-height: 3.0rem">&nbsp;</div>
1313
<div class="card-footer">
14-
{% assign url_prefix = tool.repoUrl | slice:0,19 %}
15-
{% if url_prefix == 'https://github.com/' %}
16-
{%comment%}repo holds the "org/repo" name, for eg anchore/syft{%endcomment%}
17-
{% assign repo = tool.repoUrl | replace:'https://github.com/','' | replace: '.git','' %}
18-
<img src="https://img.shields.io/github/forks/{{repo}}.svg?style=social&label=Forks">&nbsp;
19-
<img src="https://img.shields.io/github/stars/{{repo}}.svg?style=social&label=Stars">
20-
{% endif%}
14+
{% if tool.repoUrl contains '://github.com/' %}
15+
{%comment%}
16+
repo holds the "org/repo" name, for eg:
17+
https://github.com/anchore/syft
18+
https://github.com/anchore/syft/
19+
https://github.com/anchore/syft.git
20+
{%endcomment%}
21+
{% assign repo = tool.repoUrl | regex_replace:'^https?://github.com/','' | regex_replace:'(.git|/)$','' %}
22+
<img src="https://img.shields.io/github/forks/{{repo}}?style=social&label=Forks&logo=-" alt="#forks"/>&nbsp;
23+
<img src="https://img.shields.io/github/stars/{{repo}}?style=social&label=Stars&logo=-" alt="#stars"/>
24+
{% elsif tool.repoUrl contains '://gist.github.com/' %}
25+
{%comment%}
26+
repo holds the "gistID" as last path-part segment, for eg:
27+
https://gist.github.com/jkowalleck/a0f874ee0a8af9a56a0e887631fc53d1
28+
https://gist.github.com/a0f874ee0a8af9a56a0e887631fc53d1
29+
https://gist.github.com/a0f874ee0a8af9a56a0e887631fc53d1/
30+
https://gist.github.com/a0f874ee0a8af9a56a0e887631fc53d1.git
31+
{%endcomment%}
32+
{% assign gistID = tool.repoUrl | regex_replace:'^https?://gist.github.com/','' | regex_replace:'(.git|/)$','' | split:'/' | last %}
33+
<img src="https://img.shields.io/github/gist/stars/{{gistID}}?style=social&label=Stars&logo=-" alt="#stars"/>
34+
{% elsif tool.repoUrl contains '://gitlab.com/' %}
35+
{%comment%}
36+
repo holds the "org/repo" name, for eg:
37+
https://gitlab.com/expliot_framework/expliot
38+
https://gitlab.com/expliot_framework/expliot/
39+
https://gitlab.com/expliot_framework/expliot.git
40+
{%endcomment%}
41+
{% assign repo = tool.repoUrl | regex_replace:'^https?://gitlab.com/','' | regex_replace:'(.git|/)$','' | url_encode %}
42+
<img src="https://img.shields.io/gitlab/forks/{{repo}}?style=social&label=Forks&logo=-" alt="#forks"/>&nbsp;
43+
<img src="https://img.shields.io/gitlab/stars/{{repo}}?style=social&label=Stars&logo=-" alt="#stars"/>&nbsp;
44+
{% elsif tool.repoUrl contains '://bitbucket.org/' %}
45+
{%comment%}noting we can do for this repo hoster.{%endcomment%}
46+
{% endif %}
2147
</div>
2248
</a>
23-
</div>
49+
</div>

‎theme/_layouts/home.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ <h1>Introduction</h1>
114114
</ul>
115115

116116
Strategic direction of the specification is managed by the CycloneDX Core Working Group. CycloneDX is backed by the <a href="https://owasp.org">OWASP Foundation</a>, the global information security community, and Ecma International <a href="https://tc54.org/">Technical Committee 54</a> (Software & System Transparency).
117-
<br><br>OWASP Foundation is a not-for-profit member of Ecma International and is currently pursuing international Ecma standardization of the CycloneDX specification.
117+
<br><br>OWASP CycloneDX is an international Bill of Materials standard ratified by Ecma International as ECMA-424.
118118

119119
</div>
120120
<div class="col-md-6 col-sm-6">

‎theme/_sass/generic/_base.scss‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,42 @@ blockquote {
219219
margin: 0 0 1.25rem 0;
220220
}
221221

222+
blockquote.press-release {
223+
background: #f9f9f9;
224+
border-left: 10px solid #ccc;
225+
margin: 1.5em 10px;
226+
padding: 0.5em 10px;
227+
quotes: "\201C""\201D""\2018""\2019";
228+
}
229+
blockquote.press-release p::before {
230+
color: #ccc;
231+
content: "\201C";
232+
font-size: 4em;
233+
line-height: 0.1em;
234+
margin-right: 0.25em;
235+
vertical-align: -0.4em;
236+
}
237+
blockquote.press-release p::after {
238+
content: "\201D";
239+
font-size: 4em;
240+
line-height: 0.1em;
241+
margin-left: 0.25em;
242+
vertical-align: -0.4em;
243+
color: #ccc;
244+
}
245+
blockquote.press-release p {
246+
display: inline;
247+
}
248+
blockquote.press-release cite {
249+
display: block;
250+
font-style: italic;
251+
margin-top: 1em;
252+
color: #555;
253+
}
254+
blockquote.press-release cite::before {
255+
content: "\2013 ";
256+
}
257+
222258
q {
223259
color: $color-dark-blue;
224260
}

0 commit comments

Comments
 (0)