Package supplier and originator fields, is having both as NOASSERTION is not EO compliant? about ntia-conformance-checker

[edonadei]

In regards of the document about minimum requirements provided by NTIA, it's written page 12 that Known Unknowns must be explicitly identified and that it's better to avoid erroneous assumptions. IMHO the NOASSERTION of the SPDX spec fits that definition.

[lumjjb]

Given that most SBOMs today don't meet the requirement, maybe we could have a mode or additional output for a score to show % of packages that are compliant (similar to how the sbom scorecards does it)

[goneall]

Agree - we could add this to a major release along with the other breaking change.

[jspeed-meyers]

@edonadei, thank you for filing this issue.

I'm open to your interpretation. @goneall or @kestewart, thoughts?

[goneall]

This is similar to #125 where we decided NOASSERTION would not be EO compliant.

[jspeed-meyers]

Okay, to clarify for myself the questions under discussion here.

One question seems to be:

If a package has:

1. a blank supplier field or a supplier field with a NOASSERTION value AND
2. a blank originator field or an originator field with a NOASSERTION value

then is that package (and by, extension, that SBOM) not NTIA minimum elements compliant?

To the best of my understanding, it is not minimum elements compliant. Does anyone disagree with that understanding?

The next question is:

If a package has:

1. a blank supplier field or a supplier field with a NOASSERTION value

then is that package (and by, extension, that SBOM) not NTIA minimum elements compliant?

Reading the code comments, the comments suggest that either the package supplier or the package originator fields satisfy the NTIA minimum elements "supplier" field. But when I read the SPDX documentation on mapping SPDX field to NTIA, it appears that only the SPDX package supplier field maps to the NTIA minimum elements supplier field. So, to me, then the code should be changed.

Hmmm. Thoughts?

[jspeed-meyers]

@lumjjb -- I'd be supportive of that as additional JSON output.

[jspeed-meyers]

Friendly ping to @edonadei. Thoughts on my September 13th response?

[jspeed-meyers]

@goneall: How would you like to proceed? This could be a candidate for a breaking change.

[jspeed-meyers]

Okay, I'll open a PR for review soon. This might require a little tinkering with the test suite too.