Hi, Just made the sbom-composer tool public. It’s been only run with sboms that I generated, so would be very happy to hear your feedback and do any following updates if necessary. Joe, it does the me

#spdx

Cosign also has a format for doing this: https://github.com/sigstore/cosign/blob/main/specs/SBOM_SPEC.md (Different from the attestation i just sent)

#spdx

Get BlueMail for Android On ۲۳ ژوئن ۲۰۲۲, at ۱۵:۲۳, "Patil, Sandeep via lists.spdx.org" <philips.com@... target=_blank>sandeep.patil=philips.com@...> wrote:

#spdx

Sandeep, A good example of a VEX advisory is provided by Siemens in their log4j advisory: https://cert-portal.siemens.com/productcert/csaf/ssa-661247.json NOTE: VEX’s are vulnerability centric, where

#spdx

Hi , Is there any roadmap to integrate VEX to with SPDX ? Or is there already way in current SPDX specification to integrate vulnerability information ? Regards Sandeep

#spdx

Armijn raises a valid concern. We’ve avoided dynamic information in the past, but even with version 1.0 you could argue the “Concluded License” could change over time if new information is available a

#spdx

Hi Sandeep, Although the SPDX ID is internal to SPDX documents, you can refer to an SPDX ID in a different document using the SPDX Document identifier as defined in section 6.6. So the statement below

#spdx

This is how Microsoft has approached this: https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/ The one thing I’d add is that ad

#spdx

Hi Belen, Welcome to SPDX, We are glad you find our project idea interesting. Join the developers community on gitter at https://gitter.im/spdx-org/Lobby to discuss your ideas and questions. Best rega

#spdx #gsoc

In addition to Java, we have quite a few tools written in Python. We just added libraries written in go. Gary

#spdx

Hi Varshak, Welcome! Glad you're interested in participating in our community. I am copying the spdx-tech mail list where we discuss the GSoC efforts. Ideas we've come up with so far are listed on: ht

#spdx

Hi, Have just finished setting up a #spdx IRC channel on freenode, to be used for ongoing SPDX project communication and collaboration. Was just going to send this to the tech list, but realized its m

#spdx