Comments (8)
Do you plan to map the identifier to certain fields of the SBOM in the schema
Yes.
A generator (or any BOM utility) will only need to read the schema if they want to make use of the mapping. SBOM generators will not need to do anything different than they do today. No changes.
But any BOM utility can then optionally make use of the mappings to aid in conversion, policy evaluation, etc.
from specification.
Do you plan to map the identifier to certain fields of the SBOM in the schema, or are the SBOM generators adding them?
So, if I initialize the supplier field, is it safe to say that the supplier identifier will always be right here?
Generators might forget to add the identifiers properly or add them in all the wrong places.
Or did I not understand the idea correctly?
from specification.
@Mariuxdeangelo I hope to use/add a "meta:scvs"
styled key to each data type in the schema (much like added for "meta:enum".
from specification.
I guess e could even grate an XSD extension that would allow adding these flags to out XSD files ....
Not so sure about the protobuff schema files ...
from specification.
Yeah, not too worried about protobuf. But if we find a way to do this in the XSD, that would be great. If not, the JSON Schema is our reference implementation for the specification and the Ecma standard, so its obviously a priority.
from specification.
By supporting SCVS BOM Maturity Model in the schema itself, this would allow tool makers to leverage the model and have a build-in mapping.
@stevespringett if we added those markers to a schema, how would this help anybody?
Is there any existing/discrete tool that would read those fields? If there is no such tool yet, where is the spec of such a tool - I mean i could probably come up with some alternatives to this very proposal, so that such a tool would still be functioning ...
I find the proposal waaaay to vague, so I can not see any value in it yet. I would even say it is bloat I would avoid having in the schema files.
from specification.
The CycloneDX SBOM Utility that Matt has created, currently uses Go annotations to do somthing similar. Its very manual however. The idea is to remove the annotations that are specific to the tool, and use the mapping provided by the schema itself. In doing so, other tools would be able to adopt the same approach.
from specification.
In doing so, other tools would be able to adopt the same approach.
This would require other tools to follow the same annotation style we would come up now.
I don't see that as a desirable way to work for anybody.
here is another approaches, which is more versatile in many means:
Somebody provides mapping of each SCVS "flag" to (multiple) actual BOM-document targets in form of JSONPath(JSON and YAML documents), XPATH(XML documents), FieldMask(Protobuf documents).
Such mapping is document centric (not schema- nor specification-centric).
Such mapping would not be part of any schema file, but independent.
Such mapping is portable.
Such mapping is machine readable.
example for CycloneDX JSON:
urn:owasp:scvs:bom:core:timestamp
->$.metadata.timestamp
urn:owasp:scvs:bom:resource:software:sbom
->$..externalReferences[?($.type=='bom')].url
- ...
This solution is actually one that the SCVS BOM Maturity Model WorkGroup should have come up with in the first place, since this is the most interoperable way (I can think of) of mapping their "Identifier" to an actual data structure.
This is the relevant part: mapping to data structures, since they should not care for capabilities(schema or specification) but actual SBOM data.
These mappings can be provided by the SCVS community without any need for interaction with SBOM standards working groups, so this makes them even independent.
from specification.
Related Issues (20)
- Convert publisher from `string` to `organizationalContact`
- `organizationalContact` enhancements
- Evidence for `component.scope`
- Consider making specVersion an integer with validations HOT 1
- Support for dependency graph to better represent Software Heritage and OmniBOR ADG
- Support for blob component type
- Support for externalReferences.type source-archive
- Support for api-resolver as a technique
- Clarify swhid in documentation
- Add externalReferences.type = funding HOT 3
- Improve documentation for BOM-Link externalReferences.type
- Add BOM-Link to component schema HOT 1
- feat: express list of contributors of an element(component, ...) HOT 1
- Recommend evidence for `compositions.aggregate`
- Support for ulid HOT 2
- Use defined domains for examples
- Support for Hardware IDs HOT 3
- licenses: allow mix of multiple SPDX expressions AND multiple named/spdx licenses
- xml/json 1.5 spec differences? HOT 3
- Consider making `evidence.identity` mandatory HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from specification.