stackabletech / stackabletech/issues
Improve SBOMs
Open
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 2
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
Tasks
- Add Pedigree information to our patched products
- Verify that product SBOMs are correct in that they e.g. list hadoop as the product and not hadoop-common or similar
- Provide the dependency tree in the SBOM instead of a flat list of dependencies
- Check results from https://github.com/interlynk-io/sbomqs
- Maybe interesting: https://github.com/snyk/parlay
- Maybe helpful: https://github.com/interlynk-io/sbomasm
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the unchecked tasks and the product SBOM generation process, since no repository, file, test, or entry point is named. Check the product identity and dependency-tree requirements, then review sbomqs and the linked parlay and sbomasm projects. Done means the remaining tasks have been resolved and product SBOMs are verified.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100