Comments (1)
riteshnoronha
commented on May 29, 2024
Other Unique Identifiers details from NTIA minimum elements
Definition
Other identifiers that are used to identify a component, or
serve as a look-up key for relevant database
More details
Other unique identifiers support automated efforts to map data across data uses and ecosystems
and can reinforce certainty in instances of uncertainty. Examples of commonly used unique
identifiers are Common Platform Enumeration (CPE), Software Identification (SWID) tags, and Package Uniform Resource
Locators (PURL). These other identifiers may not be available for every piece of software, but should be used if they exist.
The above points indicate that presence of any of these identifiers would be enough. I then decided to re-read https://www.ntia.gov/files/ntia/publications/sbom_formats_survey-version-2021.pdf
That indicates for the other unique identifiers we should only be checking SPDXID + namespace for SPDX and serial number for CycloneDX
Wondering if this should be a waterfall check of ids, or just the presence check of serialnumber & spdx+namespace
Lets discuss this more, before changing it.
from sbomqs.
Related Issues (20)
- Tool does not report correct number of components for nested CycloneDX SBOMs HOT 3
- [New Check] Primary component lack of version goes undetected
- Support for strict specification adherence with analysis
- configpath and feature flags do not filter HOT 6
- Refactor Score
- Integrate with DT HOT 1
- Align Supplier Check with SPDX specification HOT 3
- Provide ability to run the tool in air-gap environment HOT 4
- Containerize sbomqs and host on ghcr
- Add support for component types HOT 1
- Remove default options from Dockerfile HOT 1
- containerized app is missing version
- JSON ouptput breaks when newer version of sbomqs is available HOT 1
- SPDX Creator Name may include spaces in the tool name HOT 3
- DTrack Score: Failed to get project: invalid character '<' HOT 17
- Ability to install sbomqs using yum or apt-get HOT 1
- [New Check] Existence of primary component must be checked
- Doesn't work with CycloneDX 1.5 HOT 2
- Add Support for Cyclonedx 1.5 HOT 3
- CycloneDX 1.5 is not considered a valid spec HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sbomqs.