CycloneDX / CycloneDX/cyclonedx-cli

Add support for component modification

Open
#14 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C#
Stars
541
Forks
82
PR merge metrics
No merged PRs in 30d

Description

One of the benefits of an SBOM first approach in a build pipeline is to be able to correct component identity and other data during a build.

Examples:
* Correcting the group, name, version, and PURL due incorrect identity information in a organizational repo (nexus, artifactory, etc).
* Correcting license data in the event of dual licenses (choice of open source and commercial license)
* Specifying a component is derived from another component (an org forks and modifies a library) so that accurate Pedigree information can be applied
* Applying CPEs and/or SWIDs to components in the event an org knows what they are in advance
* etc, etc, etc

Currently, organizations can opt to do this, but they have to roll their own solution to achieve it. The goal of this enhancement is to make this functionality accessible to all, thus lowering the maturity and investment required to produce the most accurate inventory possible.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.