-
For security and compliance concerns, it would be good to have a list
of dependencies for example to assess which security vulnerabilities affect Xpra:
https://en.wikipedia.org/wiki/Software_supply_…
-
**Is your feature request related to a problem? Please describe.**
Adding a software bill of materials ([SBOM](https://en.wikipedia.org/wiki/Software_supply_chain)) has several advantages:
- Pos…
-
It appears that Gitlab can provide dependency lists for projects https://docs.gitlab.com/ee/user/application_security/dependency_list/.
See:
- https://gitlab.com/gitlab-org/gitlab/-/blob/master/e…
-
ARM architecture is make enormous strides in the software-defined datacenter environment. Specifically, hyperscale cloud providers are looking at ARM architecture as a way to diversify the CPU supply …
-
`dependency-guard` does an awesome job of protecting projects from unwanted dependency changes.
But this way we know nothing about the actual dependency content and cannot protect against malicious…
amal updated
6 months ago
-
**Describe the problem**
When you use Gnome software it will complain that the RPM package isn't signed. This isn't the end of the world but it got me thinking about security and resistance to supply…
-
Dependency Management is a hot topic for the software supply chain these days. It would be nice to have a dedicated category for that. It could include both dependency update automation (Dependabot, R…
-
**❗ please do not add sensitive information in issues, you can provide extra information via email using issue number as reference ❗**
**Describe the issue**
I would like to provide an SBOM softwa…
-
```[tasklist]
### Tasks
- [ ] Investigate requirements for FINOS Guac instance for most critical dependencies
```
-
Add support to score SBOM generated in SWID format
> SWID tags can be used as an SBOM, since they provide identifying information for a software
> component, a listing of files and cryptographic…