Skip to content

docs: ADR-0007 sbom diff #112

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jhoward-lm merged 6 commits into from
Nov 25, 2024
Merged

docs: ADR-0007 sbom diff #112

jhoward-lm merged 6 commits into from
Nov 25, 2024

Conversation

@mfrystacky
Copy link
Contributor

@mfrystacky mfrystacky commented Jul 30, 2024 •
edited
Loading

7. SBOM Diff

Date: 2024-07-30

Status

Proposed

Context

Support the ability to see the difference between two SBOMs.

Decision

Seeing where two SBOMs differ and highlighting potentially problematic changes such as:

a dependency that is slightly renamed and pointing to a different url
a new dependency that is pointing to a new/unknown package
a dependency whose version is bumped down

Some tools do that do that on the package lock level since that sort of supply chain attack is starting to get a bit more prevalent.

Are there other useful things we should highlight for the user?

Consequences

@mfrystacky
docs: ADR-0007 sbom diff
e2c992c 
Signed-off-by: Michal Frystacky <michal.frystacky@lmco.com>
@mfrystacky mfrystacky requested a review from a team as a code owner July 30, 2024 19:14
@mfrystacky mfrystacky self-assigned this Jul 30, 2024
@idunbarh
Copy link
Member

idunbarh commented Jul 30, 2024

@houdini91, I think @puerco mentioned that you are working on a diff feature in protobom. Do you have thoughts how bomctl should handle this?

@mfrystacky
format cleanup
3a51511 
Signed-off-by: Michal Frystacky <michal.frystacky@lmco.com>
@mfrystacky
lint cleanup
cd7701c 
Signed-off-by: Michal Frystacky <michal.frystacky@lmco.com>
@jhoward-lm
Copy link
Contributor

jhoward-lm commented Jul 31, 2024

Mind updating the PR description like the others with the content of the ADR document?

@mfrystacky
Copy link
Contributor Author

mfrystacky commented Jul 31, 2024

Done!

@jhoward-lm
Copy link
Contributor

jhoward-lm commented Jul 31, 2024

Done!

I meant copy the content of the new ADR document, edit the PR description, and replace everything with paste

@mfrystacky
small cleanup
e7c1332 
Signed-off-by: Michal Frystacky <michal.frystacky@lmco.com>
@djmoch
Copy link

djmoch commented Aug 12, 2024

Capturing the thoughts that I brought up in the working meeting:

  • We should make clear that the default output will output all of the changes. Whatever we think we need to do to highlight information we think is critical is fine, but I do think users will expect to see all changes given the diff verb.
  • Similarly, I agree with everyone else in the meeting that the most obvious output format would be a textual, git diff-style output. I'm not persuaded it's wise to invest in other output formats until a stronger culture develops around how to represent changes between SBOM's.

@idunbarh idunbarh added documentation Improvements or additions to documentation adr Architecture Decision Records use to decide architecture or implementation details of `bomctl` labels Aug 26, 2024
@jhoward-lm jhoward-lm requested a review from ashearin November 25, 2024 16:51
@jhoward-lm jhoward-lm merged commit 0db705e into main Nov 25, 2024
9 checks passed
@jhoward-lm jhoward-lm deleted the fry/docs-adr-diff branch November 25, 2024 16:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ashearin ashearin ashearin approved these changes

@jhoward-lm jhoward-lm jhoward-lm approved these changes

@idunbarh idunbarh Awaiting requested review from idunbarh

Assignees

@mfrystacky mfrystacky

Labels

adr Architecture Decision Records use to decide architecture or implementation details of `bomctl` documentation Improvements or additions to documentation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@mfrystacky @idunbarh @jhoward-lm @djmoch @ashearin