Skip to content

Commit 76d0a30

Browse files
desmax74ctron
desmax74
authored and
ctron
committed
feat: Add support for aibom and cbom detection
This PR loops through the sbom components and applies kind label if it finds ai or crypto components inside Signed-off-by: desmax74 <mdessi@redhat.com> (cherry picked from commit 2c357b0)
1 parent d105547 commit 76d0a30

File tree

4 files changed

+617
-2
lines changed

4 files changed

+617
-2
lines changed

‎etc/test-data/cyclonedx/ai/ibm-granite_granite-docling-258M_aibom.json‎

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
{
2+
"bomFormat": "CycloneDX",
3+
"components": [
4+
{
5+
"authors": [
6+
{
7+
"name": "ibm-granite"
8+
}
9+
],
10+
"bom-ref": "pkg:huggingface/ibm-granite/granite-docling-258M@1.0",
11+
"copyright": "NOASSERTION",
12+
"description": "No description available",
13+
"externalReferences": [
14+
{
15+
"type": "website",
16+
"url": "https://huggingface.co/ibm-granite/granite-docling-258M"
17+
}
18+
],
19+
"group": "ibm-granite",
20+
"licenses": [
21+
{
22+
"license": {
23+
"id": "unknown",
24+
"url": "https://spdx.org/licenses/"
25+
}
26+
}
27+
],
28+
"manufacturer": {
29+
"name": "ibm-granite",
30+
"url": [
31+
"https://huggingface.co/ibm-granite"
32+
]
33+
},
34+
"modelCard": {
35+
"modelParameters": {
36+
"architectureFamily": "transformer",
37+
"inputs": [
38+
{
39+
"format": "text"
40+
}
41+
],
42+
"modelArchitecture": "granite-docling-258MForCausalLM",
43+
"outputs": [
44+
{
45+
"format": "generated-text"
46+
}
47+
],
48+
"task": "text-generation"
49+
},
50+
"properties": [
51+
{
52+
"name": "bomFormat",
53+
"value": "CycloneDX"
54+
},
55+
{
56+
"name": "specVersion",
57+
"value": "1.6"
58+
},
59+
{
60+
"name": "serialNumber",
61+
"value": "urn:uuid:ibm-granite-granite-docling-258M"
62+
},
63+
{
64+
"name": "version",
65+
"value": "1.0.0"
66+
},
67+
{
68+
"name": "primaryPurpose",
69+
"value": "image-text-to-text"
70+
},
71+
{
72+
"name": "suppliedBy",
73+
"value": "ibm-granite"
74+
},
75+
{
76+
"name": "licenses",
77+
"value": "apache-2.0"
78+
},
79+
{
80+
"name": "safetyRiskAssessment",
81+
"value": "and fairness, misinformation, and autonomous decision-making, and ethical considerations, including but not limited to: bias and fairness, misinformation, and autonomous decision-making, considerations, the model may in some cases produce inaccurate, biased, offensive or unwanted responses to user prompts, in prompts and responses across key dimensions outlined in the IBM AI Risk Atlas, of triggering unwanted output"
82+
},
83+
{
84+
"name": "typeOfModel",
85+
"value": "idefics3"
86+
},
87+
{
88+
"name": "downloadLocation",
89+
"value": "https://huggingface.co/ibm-granite/granite-docling-258M/tree/main"
90+
},
91+
{
92+
"name": "external_references",
93+
"value": "[{\"type\": \"website\", \"url\": \"https://huggingface.co/ibm-granite/granite-docling-258M\", \"comment\": \"Model repository\"}, {\"type\": \"distribution\", \"url\": \"https://huggingface.co/ibm-granite/granite-docling-258M/tree/main\", \"comment\": \"Model files\"}]"
94+
}
95+
],
96+
"quantitativeAnalysis": {
97+
"graphics": {}
98+
}
99+
},
100+
"name": "granite-docling-258M",
101+
"publisher": "ibm-granite",
102+
"purl": "pkg:huggingface/ibm-granite/granite-docling-258M@1.0",
103+
"supplier": {
104+
"name": "ibm-granite",
105+
"url": [
106+
"https://huggingface.co/ibm-granite"
107+
]
108+
},
109+
"type": "machine-learning-model",
110+
"version": "1.0"
111+
}
112+
],
113+
"dependencies": [
114+
{
115+
"dependsOn": [
116+
"pkg:huggingface/ibm-granite/granite-docling-258M@1.0"
117+
],
118+
"ref": "pkg:generic/ibm-granite%2Fgranite-docling-258M@1.0"
119+
}
120+
],
121+
"externalReferences": [
122+
{
123+
"type": "distribution",
124+
"url": "https://huggingface.co/ibm-granite/granite-docling-258M"
125+
}
126+
],
127+
"metadata": {
128+
"component": {
129+
"bom-ref": "pkg:generic/ibm-granite%2Fgranite-docling-258M@1.0",
130+
"copyright": "NOASSERTION",
131+
"description": "No description available",
132+
"name": "granite-docling-258M",
133+
"purl": "pkg:generic/ibm-granite%2Fgranite-docling-258M@1.0",
134+
"type": "application",
135+
"version": "1.0"
136+
},
137+
"properties": [
138+
{
139+
"name": "primaryPurpose",
140+
"value": "image-text-to-text"
141+
},
142+
{
143+
"name": "suppliedBy",
144+
"value": "ibm-granite"
145+
},
146+
{
147+
"name": "typeOfModel",
148+
"value": "idefics3"
149+
},
150+
{
151+
"name": "bomFormat",
152+
"value": "CycloneDX"
153+
},
154+
{
155+
"name": "specVersion",
156+
"value": "1.6"
157+
},
158+
{
159+
"name": "serialNumber",
160+
"value": "urn:uuid:ibm-granite-granite-docling-258M"
161+
},
162+
{
163+
"name": "version",
164+
"value": "1.0.0"
165+
},
166+
{
167+
"name": "primaryPurpose",
168+
"value": "image-text-to-text"
169+
},
170+
{
171+
"name": "suppliedBy",
172+
"value": "ibm-granite"
173+
},
174+
{
175+
"name": "licenses",
176+
"value": "apache-2.0"
177+
},
178+
{
179+
"name": "safetyRiskAssessment",
180+
"value": "and fairness, misinformation, and autonomous decision-making, and ethical considerations, including but not limited to: bias and fairness, misinformation, and autonomous decision-making, considerations, the model may in some cases produce inaccurate, biased, offensive or unwanted responses to user prompts, in prompts and responses across key dimensions outlined in the IBM AI Risk Atlas, of triggering unwanted output"
181+
},
182+
{
183+
"name": "typeOfModel",
184+
"value": "idefics3"
185+
},
186+
{
187+
"name": "downloadLocation",
188+
"value": "https://huggingface.co/ibm-granite/granite-docling-258M/tree/main"
189+
},
190+
{
191+
"name": "external_references",
192+
"value": "[{\"type\": \"website\", \"url\": \"https://huggingface.co/ibm-granite/granite-docling-258M\", \"comment\": \"Model repository\"}, {\"type\": \"distribution\", \"url\": \"https://huggingface.co/ibm-granite/granite-docling-258M/tree/main\", \"comment\": \"Model files\"}]"
193+
}
194+
],
195+
"timestamp": "2025-09-26T10:04:16.628402Z",
196+
"tools": {
197+
"components": [
198+
{
199+
"bom-ref": "pkg:generic/aetheris-ai/aetheris-aibom-generator@1.0.0",
200+
"manufacturer": {
201+
"name": "Aetheris AI"
202+
},
203+
"name": "aetheris-aibom-generator",
204+
"type": "application",
205+
"version": "1.0"
206+
}
207+
]
208+
}
209+
},
210+
"serialNumber": "urn:uuid:445dd258-a0b0-426c-aee0-e9d135fb3f56",
211+
"specVersion": "1.6",
212+
"version": 1
213+
}

0 commit comments

Comments
 (0)