create SBOM for software stack provided #366
Labels
kind/feature
Categorizes issue or PR as related to a new feature.
lifecycle/frozen
Indicates that an issue or PR should not be auto-closed due to staleness.
priority/backlog
Higher priority than priority/awaiting-more-evidence.
sig/user-experience
Issues or PRs related to the User Experience of our Services, Tools, and Libraries.
triage/needs-information
Indicates an issue needs more information in order to work on it.
Projects
Is your feature request related to a problem? Please describe.
As a feature to support a more secure software supply chain, Thoth should generate a SBOM, for each advise requested, and build via a Tekton task. #needsRefinement
A SBOM is not a security tool but it is a means to improve security, it can’t guarantee “vulnerability-free” software but can be helpful in fast discovery of CVE.
High-level Goals
SBOM should contain:
Describe the solution you'd like
TBD
Describe alternatives you've considered
TBD
Additional context
We need to figure out how to include/embed/reference SBOM from base operating system (composability)
https://cyclonedx.org/ might be interesting
Acceptance Criteria
TBD
The text was updated successfully, but these errors were encountered: