Page History

We are collecting documentation on how to use SBOM within Apache at the SBOM Software Bill of Materials page.

WH Theme: SBOMS /  Notifications

...

• What type of projects/builds should include SBOMs?
• What format should be used (e.g., SPDX, CycloneDX)
• What projects are interested in working on this? 
  • Airflow (Python, CycloneDX, merged)
  • ARROW Java: Publish SBOM artifacts (Maven, CycloneDX, published)
  • AVRO-3700: Publish SBOM artifacts (Maven, CycloneDX)
  • Commons Commons? https://github.com/apache/commons-parent/pull/122 (Maven, CycloneDX, published for some)
  • DRUID: Publish SBOM artifacts (Maven, CycloneDX, merged)
  • ORCFLINK-134230578: Publish SBOM artifacts  (Maven, CycloneDX, published)
  • AVROGROOVY-3700: 10993: Produce and publish CycloneDX SBOM artifacts (Gradle, CycloneDX, published)
  • HADOOP-18590. Publish SBOM artifacts (Maven, CycloneDX, published)
  • PARQUETHIVE-222426912: Publish SBOM artifacts (Maven, CycloneDX, merged)SPARK
  • HBASE-41893: 27562 Publish SBOM artifacts (Maven, CycloneDX, published)
  • Maven MPOM-346: publish SBOM on release (Maven, CycloneDX, published)
  • ORC-1342FLINK-30578: Publish SBOM artifacts (Maven, CycloneDX, published)
  • HADOOPPARQUET-18590. 2224: Publish SBOM artifacts (Maven, CycloneDX, published)
  • HIVESPARK-2691241893: Publish SBOM artifacts (Maven, CycloneDX, published)
  • ARROW JavaSOLR-16796: Publish an SBOM artifacts (CycloneDX)for Solr artifacts (Gradle, CycloneDX, not published)
  • SYNCOPE-1746: Provide Software Bill Of Materials (SBOM) (Maven, CycloneDX, published)
  • Tomcat
  • ZOOKEEPER-4657DRUID: Publish SBOM artifacts(Maven, CycloneDX, published)
  • Polaris: Add CycloneDX SBOMs (Gradle, Python, Docker, CycloneDX, open)
• How to deal with multi-language projects? (like arrow, avro, logging, parquet, spark, ...)