search

CycloneDX / guides

Creative Commons Attribution 4.0 International
5 stars 5 forks source link

clarify use of "provenance" as it relates to NIST vs SLSA,etc #26

Open ashleygwilliams opened 3 weeks ago

ashleygwilliams commented 3 weeks ago

during the specification meeting, when reviewing the Terms and Definitions, it was called out that the usage of "provenance" is very specific to NIST and differs from the SLSA,etc definition. while the spec is not a good place for this information, the guide is likely a place to call this out as it will likely help clarify the term, esp for people coming from the supplychain security space who may be more familiar with the SLSA definition.

stevespringett commented 2 weeks ago

Agreed. The term provenance has been misused over the past few years. It is important to note that the CycloneDX use of the term aligns to NIST, MITRE, OWASP, and the Oxford/Cambridge definition of the word. CycloneDX is not intentionally aligned to NIST, rather, it is aligned to the common use of the term used in global supply chains.

The SBOM guide currently has a section of provenance which reads:

Provenance refers to the history of the origin and ownership of a component. In the context of a software supply chain, provenance provides a way to trace the lineage of a component and ensure its authenticity is in alignment.

Provenance information can help software developers and users identify the source of a component, and helps to establish trust and accountability among different parties involved in the software supply chain, such as software vendors, distributors, and consumers.

By maintaining a record of provenance information throughout the software supply chain, organizations can improve their ability to detect and mitigate security risks, reduce the likelihood of supply chain attacks, and increase the overall reliability and quality of their software products. Furthermore, regulatory compliance requirements (such as those related to data privacy, data protection, and intellectual property) often mandate the use of provenance tracking to ensure compliance with legal and ethical standards.

CycloneDX supports provenance via four distinct fields: author, publisher, supplier, and manufacturer. In addition, components that are modified from the original can be described along with the complete authorship, including commits and the person or account that authored and committed the modifications

Additionally, it has a definition of the term:

Provenance - The chain of custody and origin of a software component. Provenance incorporates the point of origin through distribution as well as derivatives in the case of software that has been modified.

Are there any suggestions on how to improve the clarity of the term?

ashleygwilliams commented 2 weeks ago

So I think that the current content is very good- however, I think we could improve it by calling out the lack of consistency in the term's use. We'll need to do this delicately as we don't want it to be a judgement of any particular use, but for folks who are new to the space, or more used to a different definition- a relative definition (defining "our" provenance as it relates to the "other" provenance) can help people who read the current definition and wonder why they have lingering confusion. Let me know if that makes sense!

You may be familiar with other uses of the term provenance, such as how it is leveraged by SLSA. The usage of this term in the context of CycloneDX is slightly different in that ....