CycloneDX / CycloneDX/bom-examples
SBOM for 2 different versions of (say) Dropwizard
- Dominant language
- No language data
- Stars
- 238
- Forks
- 83
- PR merge metrics
- No merged PRs in 30d
Description
As an enhancement, it would be useful to be publish SBOM examples for 2 versions of the same OSS project.
It does not really matter which project is chosen. Dropwizard would suit me because I use it!
The use cases are to allow for testing of tools that consume BOMs and which need to process changes in the BOM for a specific project:
- Comparison of two BOMs. ie, has the component inventory changed (versions, count of components, etc)
- Impact of change on auditing/triage.
- Notifications
- etc
Contributor guide
Research direction
No file or test is named; start by inspecting the repository's existing BOM examples and how they are organized. Choose two versions of Dropwizard, then publish comparable SBOM examples whose component inventories can be compared for changes and auditing use cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100