CycloneDX / CycloneDX/specification

Add a "libraries" or "dependencies" field to the machine-learning-model component

Open
#282 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

Proposal: add a list of model libraries/dependencies that exist for a given ML model. This captures one of the most important pieces of information: what primary ML library a model relies on (and where to look for the source code for that model)

Name: "libraries" or "dependencies"
Type: Array. Each would contain, at a minimum, a "name" field. (e.g. "name": "PyTorch")
Required: True

Justification: Consider the following examples on HuggingFace (looking at the tags on the top) - knowing if a model is dependent on PyTorch, ONNX, Transformers, or Diffusers is very important information for transparency. I don't expect an AI BOM generator to go grab additional information about that library (such as license, source URL, etc.), but just knowing the name is sufficiently important, according to ML experts and developers I researched with.

https://huggingface.co/nateraw/vit-base-beans
https://huggingface.co/tiiuae/falcon-7b-instruct

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.