CycloneDX / CycloneDX/specification

[FEATURE]: Include function as a component type

Open
#590 3 comments 0 reactions 0 assignees View on GitHub
proposed core enhancement
Dominant language
XSLT
Stars
547
Forks
93
Avg merge
7h 11m
Merged PRs (30d)
37

Description

## Describe the feature

Currently there is no way to describe the functions used within a library. When using a SBOM for vulnerability management, it would be useful to have a finer level of granularity than a library component and identify the actual functions used. Vulnerabilities in a library are typically associated with a vulnerable function and by including the functions actually used, this will aid the vulnerabity management process.

## Possible solutions

Make functions as a component type. A function can then be associated with a library (or other component) to show the relationship.

## Alternatives

It is possible to use the callstack within evidence object (as this has function as one of the attributes) but it is abusing the original intent of the object

## Additional context

When constructing SBOMs from a binary artafect (e.g. ELF binary), the function names used within each dynamic libraries can easily be extracted. By capturing this information in an SBOM, it will improve the efficiency of the vulnerability management triage process.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.