Details
Description
Several issues have been identified in generated SBOM files. These should be adjusted accordingly:
- Add a "cpe" attribute to the pedigree component in the sbom.file. The Common Platform Enumeration (CPE) allows to uniquely identify the used lwip software in automated tools. I think for current version the correct cpe value would be "cpe:2.3:a:lwip_project:lwip:2.1.2:*:*:*:*:*:*:*".
- update waf to V1.14.0.3
- update all external components to newest available versions addressing SBOM requirements
- rename project's own sbom template file from "sbom.json" to "cdx.json"
- add schema reference to the top of the file:
"$schema": "https://cyclonedx.org/schema/bom-1.6.schema.json",
- correct entry metadata.component.references to metadata.component.externalReferences
- add copyright statement to project's own sbom template (metadata.component)
metadata.component.copyright:"copyright" : "Copyright (c) Hilscher Gesellschaft fuer Systemautomation mbH",
- add manufacturer statement to project's own sbom template (metadata.component)
- metadata.component.manufacturer.name & metadata.component.manufacturer.url
-
"manufacturer": { "name": "Hilscher Gesellschaft fuer Systemautomation mbH", "url": [ "https://www.hilscher.com" ] }
- If not yet present, add name to project's own sbom template (metadata.component)
metadata.component.name:"name" : "Name of JIRA Project",
-
Attachments
Issue Links
- mentioned in
-
Page Loading...