search

CycloneDX / specification

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX
https://cyclonedx.org/
Apache License 2.0
337 stars 57 forks source link

Consider making `evidence.identity` mandatory #457

Open prabhu opened 1 month ago

prabhu commented 1 month ago

We are seeing SBOM tools that are making up CPE and purl identifiers without offering evidence for identity. This is causing frustration, delays, and lack of trust in the tool and the process. Making the identity mandatory could help filter components with low confidence detection techniques.

stevespringett commented 1 month ago

Agreed that this is an issue. I've seen this a lot by smaller startups and open source projects, both of which typically do not have their own data science teams. These teams usually take the mess that is CPE, and target the CVEs more accurately than what CPE can natively do. This is especially common with tools that scan libraries and container images.

The approach taken by these tools is essentially "spray and pray". If you cast a wide enough net, you're bound to catch something. But as you say, these are generally pulled from thin air, or in some cases, are designed as a workaround to the data issues present in the NVD.

While this would be a breaking change, I think one approach we can do in the meantime is to work with the offending tool authors and have them voluntarily add this data.