spdx@lists.spdx.org

Home Messages Hashtags Subgroups

Messages

Between

and

Announcement from Exiger

Hello Everyone, Consolidation of the SBOM market space continues at pace with this announcement of Ion Channel being acquired by

By Dick Brooks · #1690 ·

Reminder: Thursday SPDX General Meeting

Meeting Time: Thurs, May 4, 8am PT / 10 am CT / 11am ET / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html Conf call dial-in: Join the

By Phil Odence · #1689 ·

Re: [SCITT] [spdx] CISA's proposed attestation form is now available and they are seeking comments

Thanks for your consideration, Henry. John, is ITI interested in collaborating with the SMB community on this opportunity? There are literally thousands of SMB’s in this space and my list of

By Dick Brooks · #1688 ·

Re: CISA's proposed attestation form is now available and they are seeking comments

Dear Mr Brooks, We are interested in attestation. Alfred Strauch, Smart Talk Beacon Steven CarbnoSmart Talk Beacon Alfred Strauch President SmartTalk Security Inc. Bus: 306-5291442 Email:

By Alfred Strauch · #1687 ·

Re: CISA's proposed attestation form is now available and they are seeking comments

FYI I have reached out to ITI and BSA on this opportunity and am waiting to hear back. This matter affects everyone working in the SBOM community that is producing software products, aiming to

By Dick Brooks · #1686 ·

Re: CISA's proposed attestation form is now available and they are seeking comments

I am interested. Also I would like to know if anyone else has any interest in ensuring attestation standards have space to enable cryptographic agility or move towards self attesting addresses? --

By Jean Camp · #1685 ·

Re: [SCITT] [spdx] CISA's proposed attestation form is now available and they are seeking comments

I'm seeing a good response so far. Hoping to reach 100 small and medium businesses providing software to the US Government sign-on to this collaborative joint filing effort before the filing

By Dick Brooks · #1684 ·

Re: [SCITT] [spdx] CISA's proposed attestation form is now available and they are seeking comments

Thank you Jean, I have added your name to the growing list of parties that have expressed an interest in joining this collaboration. FYI: I’ve also reached out to ITI and BSA to collaborate on

By Dick Brooks · #1683 ·

Re: CISA's proposed attestation form is now available and they are seeking comments

FYI: I’m envisioning a similar process to what was used by the SBOM Special Internet Group (SBOM SIG), contained in this filing to

By Dick Brooks · #1682 ·

CISA's proposed attestation form is now available and they are seeking comments

Hello Everyone, CISA is seeking comments on their proposed self-attestation form for OMB M-22-18 and EO 14028. Is there any interest in doing a joint comment filing to CISA? Please respond to

By Dick Brooks · #1681 ·

Elucidating why I'm leaving SPDX

Dear all, I have relished the intellectual company of the SPDX community. There has been no other open source community that I have felt more welcomed in, nor one that shows so much potential for

By Sebastian Crane · #1680 ·

Re: SPDX Gen Meeting Follow up- Mistake and Thanks

The WDK that contains our SBOM and COSE tools is now available through the Windows Insider Program. I would appreciate any feedback on the tools or the delivery process. Register to for the

By Joe Bussell · #1679 ·

Google announce open devs.dep API

Google have opened their deps.dev API, covering dependencies, license information and vulnerabilities. Right now, it's open and free to use – you don't even need an API key. Blog post here:

By Steve Kilbane · #1678 ·

Re: SPDX Gen Meeting Follow up- Mistake and Thanks

Joe, As you know well, medical device security is a big challenge. SBOM is probably needed most in healthcare as you pointed out. We have lots of healthcare customers asking for SBOM, but many MDMs

By May Wang · #1677 ·

Re: SPDX Gen Meeting Follow up- Mistake and Thanks

Hi Dick, Thank you so much for the explanation. I have yet to see an SPDX representation as well and trying to wrap my head around some of these SBOM challenges in the Medical Device space where

By Joseph Silvia · #1676 ·

Re: SPDX Gen Meeting Follow up- Mistake and Thanks

Hi Joe, Both formats satisfy the NIST VDR data requirements identified in SP 800-161 RA-5, IMO. REA uses an explicit model, listing each component and its vulnerability search status,

By Dick Brooks · #1675 ·

Re: SPDX Gen Meeting Follow up- Mistake and Thanks

Hello Dick, You stated the REA has offered to withdraw it’s VDR format if the industry agrees to endorse the CycloneDX VDR format. Can you provide more details on the similarities and

By Joseph Silvia · #1674 ·

Re: SPDX Gen Meeting Follow up- Mistake and Thanks

May, Thank you for the quick response. With regard to testing; some of the spdx tool vendors conduct interoperability testing by sharing artifacts and reporting on any issues encountered. The

By Dick Brooks · #1673 ·

Re: SPDX Gen Meeting Follow up- Mistake and Thanks

Dick, Thank you for your questions. 1. Our spdx-based IoT SBOM is available to all our customers. I am not sure about the specific "testing purposes" you are referring to, happy to talk more

By May Wang · #1672 ·

Re: SBOMs from vcpkg?

Looks like SPDX JSON is generated by default, see [1]. [1]: https://github.com/microsoft/vcpkg/issues/30461#issuecomment-1485245851 -- Sebastian Schuberth

By Sebastian Schuberth · #1671 ·

1 - 20 of 1690

Home Hashtags Subgroups Terms