Skip to content

Commit 2c357b0

Browse files
desmax74dejanb
desmax74
authored and
dejanb
committed
feat: Add support for aibom and cbom detection
This PR loops through the sbom components and applies kind label if it finds ai or crypto components inside Signed-off-by: desmax74 <mdessi@redhat.com>
1 parent e710813 commit 2c357b0

File tree

4 files changed

+617
-2
lines changed

4 files changed

+617
-2
lines changed

‎etc/test-data/cyclonedx/ai/ibm-granite_granite-docling-258M_aibom.json‎

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
{
2+
"bomFormat": "CycloneDX",
3+
"components": [
4+
{
5+
"authors": [
6+
{
7+
"name": "ibm-granite"
8+
}
9+
],
10+
"bom-ref": "pkg:huggingface/ibm-granite/granite-docling-258M@1.0",
11+
"copyright": "NOASSERTION",
12+
"description": "No description available",
13+
"externalReferences": [
14+
{
15+
"type": "website",
16+
"url": "https://huggingface.co/ibm-granite/granite-docling-258M"
17+
}
18+
],
19+
"group": "ibm-granite",
20+
"licenses": [
21+
{
22+
"license": {
23+
"id": "unknown",
24+
"url": "https://spdx.org/licenses/"
25+
}
26+
}
27+
],
28+
"manufacturer": {
29+
"name": "ibm-granite",
30+
"url": [
31+
"https://huggingface.co/ibm-granite"
32+
]
33+
},
34+
"modelCard": {
35+
"modelParameters": {
36+
"architectureFamily": "transformer",
37+
"inputs": [
38+
{
39+
"format": "text"
40+
}
41+
],
42+
"modelArchitecture": "granite-docling-258MForCausalLM",
43+
"outputs": [
44+
{
45+
"format": "generated-text"
46+
}
47+
],
48+
"task": "text-generation"
49+
},
50+
"properties": [
51+
{
52+
"name": "bomFormat",
53+
"value": "CycloneDX"
54+
},
55+
{
56+
"name": "specVersion",
57+
"value": "1.6"
58+
},
59+
{
60+
"name": "serialNumber",
61+
"value": "urn:uuid:ibm-granite-granite-docling-258M"
62+
},
63+
{
64+
"name": "version",
65+
"value": "1.0.0"
66+
},
67+
{
68+
"name": "primaryPurpose",
69+
"value": "image-text-to-text"
70+
},
71+
{
72+
"name": "suppliedBy",
73+
"value": "ibm-granite"
74+
},
75+
{
76+
"name": "licenses",
77+
"value": "apache-2.0"
78+
},
79+
{
80+
"name": "safetyRiskAssessment",
81+
"value": "and fairness, misinformation, and autonomous decision-making, and ethical considerations, including but not limited to: bias and fairness, misinformation, and autonomous decision-making, considerations, the model may in some cases produce inaccurate, biased, offensive or unwanted responses to user prompts, in prompts and responses across key dimensions outlined in the IBM AI Risk Atlas, of triggering unwanted output"
82+
},
83+
{
84+
"name": "typeOfModel",
85+
"value": "idefics3"
86+
},
87+
{
88+
"name": "downloadLocation",
89+
"value": "https://huggingface.co/ibm-granite/granite-docling-258M/tree/main"
90+
},
91+
{
92+
"name": "external_references",
93+
"value": "[{\"type\": \"website\", \"url\": \"https://huggingface.co/ibm-granite/granite-docling-258M\", \"comment\": \"Model repository\"}, {\"type\": \"distribution\", \"url\": \"https://huggingface.co/ibm-granite/granite-docling-258M/tree/main\", \"comment\": \"Model files\"}]"
94+
}
95+
],
96+
"quantitativeAnalysis": {
97+
"graphics": {}
98+
}
99+
},
100+
"name": "granite-docling-258M",
101+
"publisher": "ibm-granite",
102+
"purl": "pkg:huggingface/ibm-granite/granite-docling-258M@1.0",
103+
"supplier": {
104+
"name": "ibm-granite",
105+
"url": [
106+
"https://huggingface.co/ibm-granite"
107+
]
108+
},
109+
"type": "machine-learning-model",
110+
"version": "1.0"
111+
}
112+
],
113+
"dependencies": [
114+
{
115+
"dependsOn": [
116+
"pkg:huggingface/ibm-granite/granite-docling-258M@1.0"
117+
],
118+
"ref": "pkg:generic/ibm-granite%2Fgranite-docling-258M@1.0"
119+
}
120+
],
121+
"externalReferences": [
122+
{
123+
"type": "distribution",
124+
"url": "https://huggingface.co/ibm-granite/granite-docling-258M"
125+
}
126+
],
127+
"metadata": {
128+
"component": {
129+
"bom-ref": "pkg:generic/ibm-granite%2Fgranite-docling-258M@1.0",
130+
"copyright": "NOASSERTION",
131+
"description": "No description available",
132+
"name": "granite-docling-258M",
133+
"purl": "pkg:generic/ibm-granite%2Fgranite-docling-258M@1.0",
134+
"type": "application",
135+
"version": "1.0"
136+
},
137+
"properties": [
138+
{
139+
"name": "primaryPurpose",
140+
"value": "image-text-to-text"
141+
},
142+
{
143+
"name": "suppliedBy",
144+
"value": "ibm-granite"
145+
},
146+
{
147+
"name": "typeOfModel",
148+
"value": "idefics3"
149+
},
150+
{
151+
"name": "bomFormat",
152+
"value": "CycloneDX"
153+
},
154+
{
155+
"name": "specVersion",
156+
"value": "1.6"
157+
},
158+
{
159+
"name": "serialNumber",
160+
"value": "urn:uuid:ibm-granite-granite-docling-258M"
161+
},
162+
{
163+
"name": "version",
164+
"value": "1.0.0"
165+
},
166+
{
167+
"name": "primaryPurpose",
168+
"value": "image-text-to-text"
169+
},
170+
{
171+
"name": "suppliedBy",
172+
"value": "ibm-granite"
173+
},
174+
{
175+
"name": "licenses",
176+
"value": "apache-2.0"
177+
},
178+
{
179+
"name": "safetyRiskAssessment",
180+
"value": "and fairness, misinformation, and autonomous decision-making, and ethical considerations, including but not limited to: bias and fairness, misinformation, and autonomous decision-making, considerations, the model may in some cases produce inaccurate, biased, offensive or unwanted responses to user prompts, in prompts and responses across key dimensions outlined in the IBM AI Risk Atlas, of triggering unwanted output"
181+
},
182+
{
183+
"name": "typeOfModel",
184+
"value": "idefics3"
185+
},
186+
{
187+
"name": "downloadLocation",
188+
"value": "https://huggingface.co/ibm-granite/granite-docling-258M/tree/main"
189+
},
190+
{
191+
"name": "external_references",
192+
"value": "[{\"type\": \"website\", \"url\": \"https://huggingface.co/ibm-granite/granite-docling-258M\", \"comment\": \"Model repository\"}, {\"type\": \"distribution\", \"url\": \"https://huggingface.co/ibm-granite/granite-docling-258M/tree/main\", \"comment\": \"Model files\"}]"
193+
}
194+
],
195+
"timestamp": "2025-09-26T10:04:16.628402Z",
196+
"tools": {
197+
"components": [
198+
{
199+
"bom-ref": "pkg:generic/aetheris-ai/aetheris-aibom-generator@1.0.0",
200+
"manufacturer": {
201+
"name": "Aetheris AI"
202+
},
203+
"name": "aetheris-aibom-generator",
204+
"type": "application",
205+
"version": "1.0"
206+
}
207+
]
208+
}
209+
},
210+
"serialNumber": "urn:uuid:445dd258-a0b0-426c-aee0-e9d135fb3f56",
211+
"specVersion": "1.6",
212+
"version": 1
213+
}

0 commit comments

Comments
 (0)