SBOM - Revision history

Tom: /* Other Material */

2023-12-28T05:52:03Z

‎Other Material

Tom: /* References */

2023-08-18T00:20:23Z

‎References

Tom: /* Problems */

2023-08-18T00:17:14Z

‎Problems

Tom: /* Solutions */

2023-03-14T04:40:36Z

‎Solutions

Tom: /* Solutions */

2022-08-04T05:25:33Z

‎Solutions

Tom: /* Solutions */

2022-08-04T05:24:22Z

‎Solutions

Tom: /* References */

2022-08-04T00:34:28Z

‎References

Tom: /* Solutions */

2022-07-13T15:10:49Z

‎Solutions

Tom: /* Solutions */

2022-07-13T15:09:57Z

‎Solutions

Tom: /* SBOM Formats and Standards */

2022-05-28T01:55:24Z

‎SBOM Formats and Standards

@@ Line 33: / Line 33: @@
 <references />
 ===Other Material===
 * [https://www.iiotsbom.com/iiotsbom-for-iot-device-manufacturers/overview-of-sbom-technology-support/ OVERVIEW OF SBOM TECHNOLOGY SUPPORT]

← Older revision		Revision as of 00:20, 18 August 2023
Line 31:		Line 31:

	==References==		==References==
		+	<references />
		+	===Other Material===
	* [https://www.iiotsbom.com/iiotsbom-for-iot-device-manufacturers/overview-of-sbom-technology-support/ OVERVIEW OF SBOM TECHNOLOGY SUPPORT]		* [https://www.iiotsbom.com/iiotsbom-for-iot-device-manufacturers/overview-of-sbom-technology-support/ OVERVIEW OF SBOM TECHNOLOGY SUPPORT]

@@ Line 22: / Line 22: @@
 It is not clear who will be responsible for defining a SBOM. Here is one current problem in 2021. There is a open source product did:orb that includes a make file that depends on GCC (the Gnu Compiler). Now the problem is that there is no way to build the code without these tools. I am unclear how it could be possible to know if the tools provided any contribution the the finished products if it is required to build the product. So, is the GCC part of the did:orb SBOM? The following wiki page contains a sample SBOM, [[Did:orb#Software_Bill_of_Materials]].
 * [https://www.csoonline.com/article/3649794/drop-the-sbom.html SBOM critique] 2022-02-22 CSO Online - Software bills of material are having a moment, but the costs of an externally visible SBOM are likely to outweigh the benefits, says Andy Ellis.
 ==Solutions==

@@ Line 24: / Line 24: @@
 ==Solutions==
 * [https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-salus-software-bill-of-materials-sbom-generation-tool/ Microsoft open sources Salus software bill of materials (SBOM) generation tool] 2022-06-12
 * [https://blackberry.qnx.com/en/products/security/blackberry-jarvis BlackBerry Jarvis 2.0] Software Composition Analysis and Security Testing for Embedded Systems<blockquote>A software bill of materials (SBOM) can help you identify critical information about software components, allowing you to detect potential issues with implications for intellectual property disputes, security risks or overall quality. BlackBerry Jarvis 2.0 provides a view of your product’s SBOM without depending on what your suppliers provide. It provides you with vendor and product details for each file via an interactive chart. BlackBerry Jarvis 2.0 helps you identify risks with multiple dashboards including those for Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE). It excels in accurately detecting vulnerabilities thanks to its ability to derive deep insights on many aspects of the security of a binary package. </blockquote>

@@ Line 25: / Line 25: @@
 ==Solutions==
 * [https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-salus-software-bill-of-materials-sbom-generation-tool/ Microsoft open sources Salus software bill of materials (SBOM) generation tool] 2022-06-12
-* [https://blackberry.qnx.com/en/products/security/blackberry-jarvis BlackBerry Jarvis 2.0] Software Composition Analysis and Security Testing for Embedded Systems<blockquote>A software bill of materials (SBOM) can help you identify critical information about software components, allowing you to detect potential issues with implications for intellectual property disputes, security risks or overall quality. BlackBerry Jarvis 2.0 provides a view of your product’s SBOM without depending on what your suppliers provide. It provides you with vendor and product details for each file via an interactive chart.</blockquote>
+* [https://blackberry.qnx.com/en/products/security/blackberry-jarvis BlackBerry Jarvis 2.0] Software Composition Analysis and Security Testing for Embedded Systems<blockquote>A software bill of materials (SBOM) can help you identify critical information about software components, allowing you to detect potential issues with implications for intellectual property disputes, security risks or overall quality. BlackBerry Jarvis 2.0 provides a view of your product’s SBOM without depending on what your suppliers provide. It provides you with vendor and product details for each file via an interactive chart. BlackBerry Jarvis 2.0 helps you identify risks with multiple dashboards including those for Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE). It excels in accurately detecting vulnerabilities thanks to its ability to derive deep insights on many aspects of the security of a binary package. </blockquote>
 ==References==

@@ Line 27: / Line 27: @@
 ==References==
 [[Category: Glossary]]
 [[Category: Trust]]

← Older revision		Revision as of 15:09, 13 July 2022
Line 24:		Line 24:

	==Solutions==		==Solutions==
		+	* [Microsoft open sources Salus software bill of materials (SBOM) generation tool https://devblogs.microsoft.com/engineering-at-microsoft/microsoft-open-sources-salus-software-bill-of-materials-sbom-generation-tool/] 2022-06-12

	==References==		==References==

@@ Line 17: / Line 17: @@
 # Software ID tags - [https://csrc.nist.gov/projects/Software-Identification-SWID SWID tag]
 # Software Heritage persistent ID - [https://docs.softwareheritage.org/devel/swh-model/persistent-identifiers.html SWHID]
 ==Problems==