microsoft / microsoft/sbom-tool
SPDX version 2.3 support
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 2.1k
- Forks
- 201
- Avg merge
- 6d 21h
- Merged PRs (30d)
- 1
Description
According to the documentation and output files, the format of the SPDX document is in version 2.2 ("spdxVersion": "SPDX-2.2")
However, according to the German Federal Office for Information Security (BSI), SPDX documents must be version 2.3 or higher to meet the requirements.
Source: BSI-TR-03183-2.pdf
Are there any plans to update the sbom-tool to output version 2.3 documents?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the documentation and generated output files mentioned in the issue, then trace where the SPDX version is declared and emitted. Check the referenced BSI requirement and determine the compatibility scope; done means the tool produces valid SPDX 2.3-or-higher documents and the documentation reflects that version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- devtools, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100