OCI and ORAS have added support for attaching SBOMs (or other related artifacts) to container images in a registry: https://oras.land/blog/oras-0.14-and-future/ Their example uses Microsoft’s SBOM Too

Reminder: SPDX tech team meeting When: 09/27/2022 11:00am to 12:30pm (UTC-05:00) America/Chicago Where: https://zoom.us/j/663426859 Organizer: Kate Stewart kstewart@... View Event Description: https:/

One thing that still needs to be decided is whether or in how much detail the logical model goes to define the Payload. This requires agreeing on the answers to two questions: 1 - True or False: Eleme

Reminder: SPDX tech team meeting When: 09/20/2022 11:00am to 12:30pm (UTC-05:00) America/Chicago Where: https://zoom.us/j/663426859 Organizer: Kate Stewart kstewart@... View Event Description: https:/

Dear all, In continuing my efforts to convert the SPDX 2.3 specification to LaTeX in order to generate a PDF edition, I'm now up against the curious case of the missing table... Clause 6 opens with 'T

Hi All, I will be attending the NIST NCCOE DevSecOps workshop - would someone be able to lead the meeting next week? If not we can skip this week. Cheers Brandon

Just an FYI, in case anyone is interested: https://energycentral.com/c/pip/omb-memo-identifies-best-practices-software-supply-chain-protections Thanks, Dick Brooks Active Member of the CISA Critical M

Excellent point, Charlie. This is what happens when Joanne has a golf tournament and I’m not included. Totally agree NDAA != 14028, but there is considerable overlap in the requirements. FYI: I’ve had

FYI: https://www.linkedin.com/posts/richard-dick-brooks-8078241_iti-and-bsa-letter-opposing-sbom-and-nist-activity-6976931523883065344-0J8-/?utm_source=share&utm_medium=member_desktop Good to know the

Parties interested in actual SBOM implementation guidance should refer to this White House Memo, issued September 14, 2022: https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf Thanks, Di

Reminder: SPDX tech team meeting When: 09/13/2022 11:00am to 12:30pm (UTC-05:00) America/Chicago Where: https://zoom.us/j/663426859 Organizer: Kate Stewart kstewart@... View Event Description: https:/

Minutes Line 62: * Proposal: Extensions field will be encapsulated in Profile and removed from Core Model type. Discussion: The goal of extensions is to easily identify non-standardized content by ins

I created a pull request for the minutes from today’s tech call including an update to the decisions document: https://github.com/spdx/meetings/pull/222/files William will follow-up if there is will b

Reminder: SPDX tech team meeting When: 09/06/2022 11:00am to 12:30pm (UTC-05:00) America/Chicago Where: https://zoom.us/j/663426859 Organizer: Kate Stewart kstewart@... View Event Description: https:/

Hi again, Now that 2.3 is out, this question is more pertinent: Note, if I want to link to a specific part of the SPDX spec, I can find it via the HTML format, for example: https://spdx.github.io/spdx

Hello Everyone, REA is looking for testing partners to share/test SPDX 2.3 SBOM’s. SAG-PM is now creating SPDX V 2.3 SBOM’s (TV only) from CycloneDX SBOM’s and would like to do some testing with other

Dear all, We've made excellent progress with the canonicalisation effort for SPDX 3.0, but as we have now discussed the majority of the SPDX 3.0 data types, we're waiting on the Tech Team and Legal Te

Dear SPDX community, As mentioned on a couple of the general calls some time ago, the Steering Committee has been working on a Change Proposal template and process to facilitate communication, priorit

Hello! Some of us in the community have come together to revive development on the spdx-sbom-generator (https://github.com/opensbom-generator/spdx-sbom-generator). The scope of the project is to gener

Reminder: SPDX tech team meeting When: 08/30/2022 11:00am to 12:30pm (UTC-05:00) America/Chicago Where: https://zoom.us/j/663426859 Organizer: Kate Stewart kstewart@... View Event Description: https:/