Add sbom generation description (#2232)#2672
Conversation
|
|
|
The created documentation from the pull request is available at: docu-html |
| SBOM Requirements | ||
| ^^^^^^^^^^^^^^^^^ | ||
|
|
||
| SBOMs are generated for all planned releases per :need:`wp__sw_platform_sbom` in SPDX 2.3 and CycloneDX 1.6 formats |
There was a problem hiding this comment.
We have also Module SBOMs, https://eclipse-score.github.io/process_description/main/process_areas/security_management/security_management_workproducts.html#wp__sw_module_sbom,
thus also for all planned Module releases the SBOM shall be generated too.
| SBOM Requirements | ||
| ^^^^^^^^^^^^^^^^^ | ||
|
|
||
| SBOMs are generated for all planned releases per :need:`wp__sw_platform_sbom` in SPDX 2.3 and CycloneDX 1.6 formats |
There was a problem hiding this comment.
For the Formats we may add a table, showing current support version and future, e.g. SPDX 2.3, indicating future support 3.x?
| ^^^^^^^^^^^^^^^^^ | ||
|
|
||
| SBOMs are generated for all planned releases per :need:`wp__sw_platform_sbom` in SPDX 2.3 and CycloneDX 1.6 formats | ||
| using the S-CORE SBOM tooling. All metadata values are derived from automated sources (Bazel dependency graph, |
There was a problem hiding this comment.
May add link to to the tool repo?
| using the S-CORE SBOM tooling. All metadata values are derived from automated sources (Bazel dependency graph, | ||
| lockfiles, and external registries) and must not be manually edited. | ||
|
|
||
| Every generated SBOM must include the CISA 2025 minimum elements for each component: |
There was a problem hiding this comment.
May add link to the public available documentation where we got the information from
|
|
||
| Every generated SBOM must include the CISA 2025 minimum elements for each component: | ||
|
|
||
| * **Component name** - human-readable name of the dependency |
There was a problem hiding this comment.
Are we considering to add CVEs later too?
There was a problem hiding this comment.
CVE will be handled by dependabot this is how i undersatand this i've added it to description
Lukasz-Juranek
force-pushed
the
feat/issue-2232-sbom-init
branch
from
439436a to
acbb1cc
Compare
masc2023
requested review from
PandaeDo,
aschemmel-tech and
pahmann
as code owners
3 participants
Documentation for SBOM tooling added in eclipse-score/sbom-tool#1