docs: ADR-0009 SBOM Linking #164
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Philippe <philippe.a.aviles@lmco.com>
Signed-off-by: Ian Dunbar-Hall <ian.dunbar-hall@lmco.com>
Contributor
|
The ADR ID 6 is already in use, can you update title to |
Signed-off-by: Philippe <philippe.a.aviles@lmco.com>
…k-adr Signed-off-by: Philippe <philippe.a.aviles@lmco.com>
… sbom-link-adr
Member
|
@bomctl/maintainers this needs to be revisited |
ashearin
reviewed
Nov 25, 2024
Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>
ashearin
approved these changes
Nov 25, 2024
jhoward-lm
approved these changes
Nov 25, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
6. SBOM Linking
Date: 2024-09-18
Status
Proposed
Context
SBOM Document Linking (
linkcommand)Bomctl needs the ability to create external references between documents. A use-case for this
feature could be a user that containerizes an application and then needs an SBOM for the new
container, with external references to the SBOMs of the container image and the application
binaries.
Another feature to discuss is the ability to express relationships between the components in the
SBOM.
Related issue: #81
Decision
TBD.
Consequences
✔️ Cross-referencing and tracking components will become easier. By allowing
external references and expressing relationships between components, tracking and understanding the
connections between various parts of a system will become more manageable. This will enable more
efficient analysis, such as impact assessment when making changes or upgrades.
✔️ Vulnerability scanning will be more thorough. With external references, it
will be easier to correlate SBOM components with known vulnerabilities in external repositories,
improving the overall security of the system.
❌ Data validation and consistency will become harder. With external references, ensuring data
consistency and validating the accuracy of information from external sources could become more
challenging. Implementing robust validation and error-handling mechanisms will be crucial to
maintain data integrity.