planetf1
commented
2 months ago - liboqs has CBOM - they are crafted carefully based on the liboqs build process. A set of yaml files describes algorithms to be retrieved from upstream sources (such as PQclean), and the CBOM is then built using these definitions (basil?)
- At the end of last year I did some scans of a few open source projects with codeQL. At the time, though I did get info about cryptographic algorithms, it was a regular sarif output, not following SBOM schema - need to look into this.
- I'm expecting scanning to be very language & ci-process specific ie per project.
- To have a meaningfull CBOM at an application/system level, we also need the associated SBOM work to be done - for example the dependency chain. Even above hard dependencies, deployments may have specific additional 'dependencies' -- for example when using openssl, perhaps oqs-provider is installed. ... so we need to figure out the context/use cases around consuming the info
A working group that could create and curate CBOM (cryptography bill of material) for “important” OSS projects.
Ideally the resulting CBOM and process to create and updating the CBOM would be submitted to the upstream project. This workgroup would help create these and eventually submit to upstream.
As a suggestion, If accepted by the TAC this group could create a CBOM subproject and start collecting the projects to tackle first and creating the CBOM on project releases to get started.
Please comment here on where the state of CBOM creation and tools are and whether this working group is warranted. If we have enough interest then I will bring it up to the next TAC.