CycloneDX / CycloneDX/cyclonedx-cli
Add support for component modification
- Dominant language
- C#
- Stars
- 541
- Forks
- 82
- PR merge metrics
- No merged PRs in 30d
Description
One of the benefits of an SBOM first approach in a build pipeline is to be able to correct component identity and other data during a build.
Examples:
* Correcting the group, name, version, and PURL due incorrect identity information in a organizational repo (nexus, artifactory, etc).
* Correcting license data in the event of dual licenses (choice of open source and commercial license)
* Specifying a component is derived from another component (an org forks and modifies a library) so that accurate Pedigree information can be applied
* Applying CPEs and/or SWIDs to components in the event an org knows what they are in advance
* etc, etc, etc
Currently, organizations can opt to do this, but they have to roll their own solution to achieve it. The goal of this enhancement is to make this functionality accessible to all, thus lowering the maturity and investment required to produce the most accurate inventory possible.
Contributor guide
Assessment
This issue has not been assessed yet.