Page History

We are collecting documentation on how to use SBOM within Apache at the SBOM Software Bill of Materials page.

WH Theme: SBOMS /  Notifications

...

• What type of projects/builds should include SBOMs?
• What format should be used (e.g., SPDX, CycloneDX)
• What projects are interested in working on this? 
  • Airflow (Python, CycloneDX, merged)
  • ARROW Java: Publish SBOM artifacts (Maven, CycloneDX, published)
  • AVRO-3700: Publish SBOM artifacts (Maven, CycloneDX)
  • Commons https://github.com/apache/commons-parent/pull/122 (Maven, CycloneDX, published for some)
  • ORC-1342DRUID: Publish SBOM artifacts (Maven, CycloneDX, publishedmerged)
  • AVROFLINK-370030578: Publish SBOM artifacts (Maven, CycloneDX, published)
  • PARQUETGROOVY-2224: Publish 10993: Produce and publish CycloneDX SBOM artifacts (MavenGradle, CycloneDX, published)
  • SPARKHADOOP-41893: 18590. Publish SBOM artifacts (Maven, CycloneDX, published)
  • FLINKHIVE-3057826912: Publish SBOM artifacts (Maven, CycloneDX, publishedmerged)
  • HADOOPHBASE-18590. 27562 Publish SBOM artifacts (Maven, CycloneDX, mergedpublished)
  • HIVEMaven MPOM-26912346: Publish publish SBOM artifactson release (Maven, CycloneDX, mergedpublished)
  • ARROW JavaORC-1342: Publish SBOM artifacts (Maven, CycloneDX, published)
  • HBASEPARQUET-27562 2224: Publish SBOM artifacts (Maven, CycloneDX, published)
  • DRUIDSPARK-41893: Publish SBOM artifacts (Maven, CycloneDX, mergedpublished)
  • ZOOKEEPERSOLR-465716796: Publish an SBOM for Solr artifacts (MavenGradle, CycloneDX, not published)Maven
  • MPOMSYNCOPE-346: publish SBOM on release1746: Provide Software Bill Of Materials (SBOM) (Maven, CycloneDX, published)
  • Tomcat
  • SYNCOPEZOOKEEPER-1746: Provide Software Bill Of Materials (SBOM)4657: Publish SBOM artifacts (Maven, CycloneDX, published)
  • Polaris: Add CycloneDX SBOMs (Gradle, Python, Docker, CycloneDX, open)
• How to deal with multi-language projects? (like arrow, avro, logging, parquet, spark, ...)