Skip to content

Commit 1b9d264

Browse files
eddie-knightpuercoSecurityCRobfunnelfiascoeleftherias
authored
Updated and extended dependency + SBOM criteria (#186)
* Add dependency/SBOM critaria and leveling This commit updates the dependency criteria to add increasing transparency requirements at each level. Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net> * Update baseline/OSPS-QA.yaml Co-authored-by: Ben Cotton <bcotton@funnelfiasco.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/OSPS-QA.yaml Co-authored-by: Ben Cotton <bcotton@funnelfiasco.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/OSPS-QA.yaml Co-authored-by: Eleftheria Stein-Kousathana <eleftheria.kousathana@gmail.com> Signed-off-by: Eddie Knight <knight@linux.com> * Update OSPS-QA.yaml suggested update to QA-12 Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update OSPS-QA.yaml better update than the last one Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update OSPS-QA.yaml an even better update than the last two Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/OSPS-QA.yaml Co-authored-by: David A. Wheeler <dwheeler@dwheeler.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/OSPS-QA.yaml Co-authored-by: David A. Wheeler <dwheeler@dwheeler.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/OSPS-QA.yaml Co-authored-by: David A. Wheeler <dwheeler@dwheeler.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/OSPS-QA.yaml Co-authored-by: Eleftheria Stein-Kousathana <eleftheria.kousathana@gmail.com> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update OSPS-QA.yaml updated 03 mappings Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Updated SBOM criteria and lexicon Signed-off-by: Eddie Knight <knight@linux.com> * Update OSPS-QA.yaml updates to qa03 & 11 Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> * Update baseline/OSPS-QA.yaml Signed-off-by: Eddie Knight <knight@linux.com> --------- Signed-off-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com> Signed-off-by: Eddie Knight <knight@linux.com> Co-authored-by: Adolfo García Veytia (Puerco) <adolfo.garcia@uservers.net> Co-authored-by: CRob <69357996+SecurityCRob@users.noreply.github.com> Co-authored-by: Ben Cotton <bcotton@funnelfiasco.com> Co-authored-by: Eleftheria Stein-Kousathana <eleftheria.kousathana@gmail.com> Co-authored-by: David A. Wheeler <dwheeler@dwheeler.com>
1 parent b2238d3 commit 1b9d264

File tree

2 files changed

+53
-30
lines changed

2 files changed

+53
-30
lines changed

‎baseline/OSPS-QA.yaml‎

Lines changed: 41 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -62,38 +62,28 @@ criteria:
6262
security_insights_value: # TODO
6363

6464
- id: OSPS-QA-03
65-
maturity_level: 2
65+
maturity_level: 1
6666
criterion: |
67-
All released software assets MUST be
68-
delivered with a machine-readable list of
69-
all direct and transitive internal software
70-
dependencies with their associated version
71-
identifiers.
67+
The code repository MUST contain a dependency
68+
list that accounts for the direct language dependencies
69+
when the package management system supports it.
7270
rationale: |
7371
Provide transparency and accountability for
74-
the project's dependencies, enabling users
75-
and contributors to understand the
76-
software's dependencies and versions.
72+
the project's dependencies
73+
while enabling users and contributors to understand the
74+
software's direct dependencies.
7775
details: |
78-
This may take the form of a software bill of
79-
materials (SBOM) or a dependency file that
80-
lists all direct and transitive dependencies
81-
such as package.json, Gemfile.lock, or
82-
go.sum.
83-
84-
It is recommended to use a CycloneDX or SPDX
85-
file that is auto-generated at build time by
86-
a tool that has been vetted for accuracy.
87-
This enables users to ingest this data in a
88-
standardized approach alongside other
89-
projects in their environment.
76+
This may take the form a package manager or
77+
language dependency file that ennumerates all
78+
direct dependencies such as package.json,
79+
Gemfile, or go.mod.
9080
control_mappings:
91-
BPB: Q-S-9
92-
CRA: 1.2b, 2.1
93-
SSDF: PO4, PS1
81+
BPB: Q-S-8, Q-S-9
82+
CRA: 2.1, 2.3
83+
SSDF: PO3.3, PS1, PS3.2
9484
CSF: ID.AM-02
95-
OC: 4.3.1
96-
OCRE: 486-813, 124-564, 863-521
85+
OC: 4.1.5, 4.3.1
86+
OCRE: 486-813, 124-564, 673-475,863-521, 613-286
9787
security_insights_value: # TODO
9888

9989
- id: OSPS-QA-04
@@ -237,3 +227,28 @@ criteria:
237227
control_mappings:
238228
BPB: B-G-3
239229
security_insights_value: # TODO
230+
231+
- id: OSPS-QA-11
232+
maturity_level: 3
233+
criterion: |
234+
All compiled released software assets MUST be
235+
delivered with a software bill of materials.
236+
rationale: |
237+
Provide transparency and accountability for
238+
the project's dependencies in a standard format,
239+
allowing automated systems to understand the
240+
software's dependencies and versions.
241+
details: |
242+
It is recommended to auto-generate SBOMs at build time
243+
using a tool that has been vetted for accuracy.
244+
This enables users to ingest this data in a
245+
standardized approach alongside other
246+
projects in their environment.
247+
control_mappings:
248+
BPB: Q-S-8, A-S-1
249+
CRA: 2.1
250+
SSDF: PS3.2, PW4
251+
CSF: ID.AM-01, ID.AM-02
252+
OC: 4.3.1
253+
OCRE: 486-813, 124-564, 863-521, 613-286
254+
security_insights_value: # TODO

‎baseline/lexicon.yaml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -266,10 +266,18 @@
266266
- https://csrc.nist.gov/pubs/sp/800/218/final
267267
- term: Software Bill of Materials
268268
definition: |
269-
A manifest or list of all components that make up a given piece of software or hardware, preferably in a machine-readable/macine-parseable format.
270-
synonyms:
271-
- SBOM
272-
references:
269+
A list of all components that make up a given piece of software
270+
or hardware, formatted as CycloneDX or SPDX. This list must include
271+
the following data elements for the components included in the released
272+
software asset: license, supplier name, filename of the component,
273+
component name, component version, software identifiers, relationship
274+
between the components, author of the SBOM data and timestamp. Additionally,
275+
for deployable and executable components, the SBOM should record their
276+
cryptographic hashes.
277+
synonyms:
278+
- SBOM
279+
- SBOMs
280+
references:
273281
- https://www.ntia.gov/sites/default/files/publications/sbom_minimum_elements_report_0.pdf
274282
- https://www.cisa.gov/sites/default/files/2023-04/sbom-types-document-508c.pdf
275283
- https://spdx.dev

0 commit comments

Comments
 (0)