You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@avro.apache.org by "Ismaël Mejía (Jira)" <ji...@apache.org> on 2023/01/06 10:54:00 UTC
[jira] [Updated] (AVRO-3702) Publish Software Bill of Materials (SBOM) for Avro
[ https://issues.apache.org/jira/browse/AVRO-3702?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ismaël Mejía updated AVRO-3702:
-------------------------------
Summary: Publish Software Bill of Materials (SBOM) for Avro (was: Publish Software bill of materials (SBOM) for Avro)
> Publish Software Bill of Materials (SBOM) for Avro
> --------------------------------------------------
>
> Key: AVRO-3702
> URL: https://issues.apache.org/jira/browse/AVRO-3702
> Project: Apache Avro
> Issue Type: Improvement
> Components: build
> Reporter: Ismaël Mejía
> Priority: Minor
>
> Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: [CycloneDX]([https://cyclonedx.org/]), [Software Identification (SWID) tag]([https://csrc.nist.gov/projects/Software-Identification-SWID]), [Software Package Data Exchange® (SPDX)]([https://spdx.dev/]).
> Avro should cover this for all the artifacts we publish. The ASF does not yet have a preferred standard. If they choose one we will keep that one.
> [https://cwiki.apache.org/confluence/display/COMDEV/SBOM]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)