Sample Challenge

[NorioKobota]

What should we fill the private package information in SBOM DOCUMENT?
No third-party verifiable package name, version and no purl.

[NorioKobota]

Solution idea

provide following information for all included software(public and private) with SBOM DOCUMENT

fields/value:

for public software

[REQUIRED]

• unique id
  purl, swhid etc.
• package name
  package name provided by the public software distributor
• version
  version number provided by the public software distributor
• dependencies
  delivery item or complete, see BSI TR-03183
• timestamp
  date and time the binary package was built
• component hash
  hash value of the binary package
• license information
  declared and concluded with the SPDX short identifier

[RECOMMENDED]

• contact information
  Supplier infomation such as company name, email address etc.
• build configuration
  compiler options etc.

for private software

[REQUIRED]

• unique id
  any unique id defined by the supplier
• package name
  any unique name defined by the supplier
• version
  version number managed by the supplier
• contact information
  company name, email address etc.
• dependencies
  top-level, see BSI TR-03183
• timestamp
  date and time the binary package was built
• component hash
  hash value of the binary package
• license information
  "PROPRIETARY"

[RECOMMENDED]

• build configuration
  compiler option etc.