Generate modern sbom formats when releasing etcd
Open
area/security
area/tooling
priority/important-longterm
stage/tracked
type/feature
- Dominant language
- Go
- Stars
- 52.3k
- Forks
- 10.5k
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 44
Description
### What would you like to be added?
I'd like to contribute SBOM generation to the release process of this project in both cyclonedx and spdx formats.
I'm part of https://github.com/CISA-SBOM-Community/SBOM-Generation thats building reference implementations for "good" SBOM generation and we thought etcd would be a great candidate.
### Why is this needed?
SBOMs are becoming a common part of software releases because they provide insight into what dependencies are used in a project. This allows better vulnerability management.
Contributor guide
Assessment
This issue has not been assessed yet.