search

microsoft / sbom-tool

The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts.
MIT License
1.51k stars 121 forks source link

SPDX version 2.3 support #537

Open neo42man opened 3 months ago

neo42man commented 3 months ago

According to the documentation and output files, the format of the SPDX document is in version 2.2 ("spdxVersion": "SPDX-2.2")

However, according to the German Federal Office for Information Security (BSI), SPDX documents must be version 2.3 or higher to meet the requirements. Source: BSI-TR-03183-2.pdf

Are there any plans to update the sbom-tool to output version 2.3 documents?

jlperkins commented 3 months ago

We are eagerly anticipating the release of the SPDX 3.0 spec (may be soon! 😉).

riteshnoronha commented 3 months ago

In SPDX 2.3, new features include optional fields for Primary Package Purpose, support for additional hashing algorithms (SHA3-256, SHA3-384, SHA3-512, BLAKE2b-256, BLAKE2b-384, BLAKE2b-512, BLAKE3, ADLER32), new relationship types (REQUIREMENT_DESCRIPTION_FOR and SPECIFICATION_FOR), package fields for ValidUntilDate, and expanded external repository identifiers in Security (introducing advisory, fix, URL, and SWID categories).

Note that most fields remain optional, and compliance with SPDX 2.3 doesn't require mandatory use of new fields, making SPDX 2.3 documents backward compatible with SPDX 2.2.

For BSI compliance, the following fields are more of a challenge:

  1. Packages Creator: (Package Supplier) (email or url is required)
  2. Package Dependencies: (Relationships) Direct dependencies
  3. Package Vuln Ids: cpe or purl(inaccuracies)
0xabdi commented 1 month ago

Any idea when support for spdx 2.3 will be added to the tool?

henning-krause commented 1 month ago

Hmm.. the Version 3 of spdx was released: https://spdx.github.io/spdx-spec/v3.0/.

wglenos commented 1 month ago

Also interested in finding out about sbom-tool support for spdx 2.3 output if anybody can provide any details or ETA (if any)

I realize the 3.0 spec is also out however spdx 2.3 output is what we are currently looking to use at the moment - thanks for any info