Add example information for NIST EO 14028 to Appendix G #733
Conversation
This commit adds an example to Appendix G.1 describing how users can reference vulnerability reports using the ExternalRefs `SECURITY` category in accordance with Executive Order 14028. This example and language was agreed upon at the SPDX Defects WG meeting on June 29th. Signed-off-by: Rose Judge <rjudge@vmware.com>
|
The definition of
giving as an example This example points to some JSON file stored on GitHub. What has to change to reconcile the two? |
|
@zvr I'm not sure the two are incompatible. This is an example for those looking for guidance on how to correlate vulnerability and SBOM information for a software product at the component level in order to satisfy EO 14028. Per ISO 29147:2018, the advisory may contain an impact statement whether a package (e.g. a product) is or is not affected by vulnerabilities, which the example file does. Technically, even a JSON file stored on GitHub is "published". I agree that there could be a better/more official example document for this appendix, but the one there now is consistent with the guidance we have provided. Perhaps we can update the example link in the future as more example documents become available. |
This commit adds an example to Appendix G.1 describing how users can
reference vulnerability reports using the ExternalRefs
SECURITYcategory in accordance with Executive Order 14028.
This example and language was agreed upon at the SPDX Defects WG meeting
on June 29th.
Signed-off-by: Rose Judge rjudge@vmware.com