-
Notifications
You must be signed in to change notification settings - Fork 42
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support attestations as artifacts in SPDX 3.1 #594
Comments
Work may need to happen in 3.1; depending on alignment of schedules, but we should agree on way this can be done in 3.0 in a way that will not make future work a breaking change at a minimum. |
@lumjjb - Was anything similar to this requirement discussed in the build profile? |
I'm happy to make a proposal and put in the work to get attestation support in 3.0. I think it would be a good discussion for the next security meeting. |
Is there any info on why including this in the generated SBOM is needed? |
@mlieberman85 - see attacks that that SBOMit project is trying to make visible SBOMit/specification#20 |
I know that, I'm a TAC sponsor of SBOMit. I am just curious if we have any documentation, reasoning, etc. as to which of the attacks in SBOMit are detected or mitigated by including the attestation or a reference to it in the SBOM?
|
@mlieberman85 - https://docs.google.com/document/d/1wGBiAMNkeE_R4NxzzWl1UBmTCfxDbpuzwz9qs2IJ63E/edit has been shared that I think gets into the some of what you were looking for. Working in airgapped environments is highlighted in the discussions. |
Moving this to 3.1 since we did not get any proposals before RC2 |
There is a need to be able to attest to the transformation of SBOM information from one format to another, and carry this attestation with the SBOM generated (rather than as a side car/ encapulating envelope). There are a couple of mechanisms possible.
The SBOMit project is looking at options for this, and there was a talk at OpenSSFday 2023/12 Japan on this project.
There is now an issue in the SBOMit repository to track this issue, and some preliminary analysis has been done. In terms of what we can do in SPDX we need to discuss this as a community, so opening this issue to track it here, and draw the connections.
The text was updated successfully, but these errors were encountered: