8000 Check how to use SBOM · Issue #95 · seapath/ansible · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Check how to use SBOM #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
ebail opened this issue Dec 5, 2022 · 4 comments
Open

Check how to use SBOM #95

ebail opened this issue Dec 5, 2022 · 4 comments
Labels
Debian enhancement New feature or request Security Potential security issue

Comments

@ebail
Copy link
Member
ebail commented Dec 5, 2022

  • SBoM information is essential for vulnerability and license
    compliance assessment

  • The US government is pushing for having such information
    in all software it procures and will probably make it mandatory soon.

Debian FAI does not support SBOM.
@ebail
Copy link
Member Author
ebail commented Dec 5, 2022

A good reference to explain how it is done with Yocto: https://summit.yoctoproject.org/yocto-project-summit-2022-11/talk/NAENTD/

@watare
Copy link
Member
watare commented Dec 5, 2022 •
edited
Loading

I'm not sure I understand "Debian FAI does not support SBOM"
because a simple script seems to do the job
https://github.com/daald/dpkg-licenses
Am I missing something ?

@ebail
Copy link
Member Author
ebail commented Dec 5, 2022

I think that this could be more complicated.

The first question is to list what should be required.
According to the presentation:

● Sources
● Licenses
● Dependencies
● Applied changes
● Fixes for known vulnerabilities

Again we would need to discuss that.

@ebail
Copy link
Member Author
ebail commented Dec 5, 2022

Some LFEnergy discussions in 2021 regarding this topic: https://docs.google.com/presentation/d/1iSLCinJoZ_TsUjogeyTr-ypmyASho5R6YOCNzZSmEIk/edit#slide=id.gb62873e1e9_1_53

@dupremathieu dupremathieu transferred this issue from seapath/build_debian_iso Dec 5, 2022
@dupremathieu dupremathieu added enhancement New feature or request Debian labels Dec 5, 2022
@dupremathieu dupremathieu moved this to Todo in SEAPATH Board Dec 5, 2022
@dupremathieu dupremathieu added the Security Potential security issue label Apr 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Debian enhancement New feature or request Security Potential security issue
Projects
SEAPATH Board
Status: Todo
Milestone
No milestone
Development

No branches or pull requests
3 participants
@dupremathieu @watare @ebail
0