add ntia compliance report #286

viveksahu26 · 2024-07-09T09:02:41Z

closes: #242

This PR will add NTIA minimum element compliance report. For now I have only updated README for NTIA minimum element compliance report.

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

riteshnoronha · 2024-07-10T15:29:08Z

@viveksahu26 this does not look accurate to me.

viveksahu26 · 2024-07-10T16:33:13Z

No, it's not yet completed. It's in process. I have simply added NTIA compliance readme fow now, code part is still left.

viveksahu26 · 2024-07-11T11:54:01Z

Hey @riteshnoronha , can you go through this NTIA minimum elements compliance report readme and let me know what changes to be made. The recommended data-fields are there in the NTIA minimum elements report - on page 15, so that's why I have added. We can also mark it as optional field.

Apart from that one thing I have noticed that the cra_score.go is 95% same as oct_score.go except some print statement. Similarly for cra_report.go and oct_report.go. And again for NTIA we have to repeat it and that would be ntia_score.go and ntia_report.go. Can we generalized these in a common package, which will contain both score.go and report.go functionality. WDT ??

viveksahu26 · 2024-07-17T13:33:05Z

@riteshnoronha , any update here ?

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> rename relation interface Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> remove duplicate Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> increase the visiblity of variables, interfaces, struct for reuse Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> add pass test for ntia cdx as well as spdx part Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> update readme ntia compliance for remaining ones Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> fix alligment Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> re-update readme Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> re structure fields to ntia complaince report Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

viveksahu26 · 2024-08-12T12:53:57Z

Hey @riteshnoronha, somewhat it's ready for review. Checkout this ntia compliance feature. And if changes let me know.

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

riteshnoronha · 2024-09-02T23:25:26Z

Compliance.md

+| NTIA minimum elements | Section ID | NTIA Fields | CycloneDX |SPDX(2.3)  | Notes |
+| :---   | :---  |:---   |   :---  |  :---  | :---   |
+| Automation Support | 1.1 | `Machine Readable Format` |  BomFormat & data forrmat | SPDXversion & data forrmat |  |
+| SBOM Data Fields | 2.1 |  `Author of the SBOM` | metadata->authors, metadata->supplier | creator  |   |


For SPDX it should be creator->Person, creator->organization or creator->tool

riteshnoronha · 2024-09-02T23:25:35Z

Compliance.md

+| Automation Support | 1.1 | `Machine Readable Format` |  BomFormat & data forrmat | SPDXversion & data forrmat |  |
+| SBOM Data Fields | 2.1 |  `Author of the SBOM` | metadata->authors, metadata->supplier | creator  |   |
+|  | 2.2 |  `Timestamp` |  metadata->timestamp  |  created  |   |
+|  | 2.3 |  `present` |           |           | all package elements |


remove this

riteshnoronha · 2024-09-02T23:25:56Z

Compliance.md

+|  | 2.2 |  `Timestamp` |  metadata->timestamp  |  created  |   |
+|  | 2.3 |  `present` |           |           | all package elements |
+| Package Data Fields | 2.4 |  `Package Name` |  component->name | package->name |  |
+|  | 2.5 |  `Dependency Relationship` | dependencies, composition | relationships  |  |


Just dependencies here, composition is for depth.

riteshnoronha · 2024-09-02T23:26:24Z

Compliance.md

+|  | 2.5 |  `Dependency Relationship` | dependencies, composition | relationships  |  |
+|  | 2.6 |  `Supplier Name`  |  component->supplier | packageSupplier, packageOriginator |  |
+|  | 2.7 |  `Version of Component` | component->version | package->version |  |
+|  | 2.8 |  `Other Uniq IDs` | component->cpe, component->purl | DocumentNamespace, SPDXID |  |


For SPDX it should also be cpe/purl

riteshnoronha · 2024-09-02T23:27:09Z

Compliance.md

@@ -66,3 +66,21 @@ The [OpenChain Telco](https://github.com/OpenChain-Project/Reference-Material/bl
 | Timing of SBOM delivery | 3.6 | `SBOM delivery time` | delivery time | |
 | Method of SBOM delivery | 3.7 | `SBOM delivery method` | delivery method | |
 | SBOM Scope | 3.8 | `SBOM scope` | sbom scope | |
+
+## NTIA minimum elements: SBOM Requirements for NTIA


We should also denotes field which are mandatory vs optional with an *

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

viveksahu26 added 2 commits July 9, 2024 14:30

add ntia compliance readme report

e547686

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

correct numbering

c92ea61

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

viveksahu26 requested a review from riteshnoronha July 12, 2024 15:18

viveksahu26 force-pushed the feat_ntia_compliance_report branch from 764dab0 to 4240071 Compare August 7, 2024 06:34

viveksahu26 added 5 commits August 12, 2024 10:54

added a ntia result

dde7932

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com> rename relation interface Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

add ntia compliance command

9d1d507

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

Merge branch 'main' into feat_ntia_compliance_report

ee04827

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

update variables and function name as per casing

a089309

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

viveksahu26 force-pushed the feat_ntia_compliance_report branch from 0a6bd27 to a089309 Compare August 12, 2024 06:26

viveksahu26 added 3 commits August 12, 2024 13:04

implement fakeauthor to author interface

709611c

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix dependencies issue

302ee12

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

sort section for section wise output

a882fc3

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

viveksahu26 added 3 commits August 13, 2024 13:09

improve code readability

d876dcd

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

complete test for fail case too

80053c4

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix lintings errors

673a929

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

riteshnoronha requested changes Sep 2, 2024

View reviewed changes

viveksahu26 added 2 commits September 6, 2024 01:32

correct dependencies for spdx

45d2e30

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

add primary component properties

80ae86f

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

viveksahu26 requested a review from riteshnoronha September 5, 2024 21:09

viveksahu26 added 5 commits September 9, 2024 14:18

Merge branch 'main' into feat_ntia_compliance_report

962bb40

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

resolve liniting errors

ba04e91

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

replace id by name

0f8f22f

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

fix dependencies and compositions

9e54452

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

add test ci workflow

8c1b3db

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

updated test acc to dependencies updates

567737e

Signed-off-by: Vivek Kumar Sahu <vivekkumarsahu650@gmail.com>

viveksahu26 force-pushed the feat_ntia_compliance_report branch from 029b692 to 567737e Compare September 12, 2024 10:12

viveksahu26 mentioned this pull request Sep 21, 2024

Compliance rating (BSI TR-03183) using CycloneDX 1.6 interlynk-io/sbomex#55

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add ntia compliance report #286

add ntia compliance report #286

viveksahu26 commented Jul 9, 2024

riteshnoronha commented Jul 10, 2024

viveksahu26 commented Jul 10, 2024

viveksahu26 commented Jul 11, 2024

viveksahu26 commented Jul 17, 2024

viveksahu26 commented Aug 12, 2024

riteshnoronha Sep 2, 2024

riteshnoronha Sep 2, 2024

riteshnoronha Sep 2, 2024

riteshnoronha Sep 2, 2024

riteshnoronha Sep 2, 2024

viveksahu26 Sep 12, 2024

add ntia compliance report #286

Are you sure you want to change the base?

add ntia compliance report #286

Conversation

viveksahu26 commented Jul 9, 2024

riteshnoronha commented Jul 10, 2024

viveksahu26 commented Jul 10, 2024

viveksahu26 commented Jul 11, 2024

viveksahu26 commented Jul 17, 2024

viveksahu26 commented Aug 12, 2024

riteshnoronha Sep 2, 2024

Choose a reason for hiding this comment

riteshnoronha Sep 2, 2024

Choose a reason for hiding this comment

riteshnoronha Sep 2, 2024

Choose a reason for hiding this comment

riteshnoronha Sep 2, 2024

Choose a reason for hiding this comment

riteshnoronha Sep 2, 2024

Choose a reason for hiding this comment

viveksahu26 Sep 12, 2024

Choose a reason for hiding this comment