DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
- Look at OpenSSF SLSA/SBOM work (SLSA). See also mail from GOSST
- Look at https://github.com/ossf/wg-security-tooling
- https://github.com/spdx/spdx-maven-plugin
Other background:
- SBOM section at https://openssf.org/oss-security-mobilization-plan/ based on WH and other meetings
- CSRB report on Log4j mentions some current issues, limitations, and recommendations https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf
Draft ASF Position:
- SBOMs needs to be automatically generated for builds at build time
- SBOMs need to be signed with the same keys used for releases
- SBOMs are expected to be static, never changed after release
- SBOMs need to be useful (i.e. can be parsed, machine readable by current/future tools)
...