Add compose functionality

Question

Add compose functionality

ivanayov opened this issue 2 years ago · comments

What would you like to be added:

What do you think about adding a feature

bom compose

for merging multiple SBOMs into a top level artefact?

A PoC already exists in sbom-composer, but as bom already supports wider range of functionalities, it would be great to have such option in order to work as all-in-one solution

Why is this needed:

Having granular SBOMs is not a new concept and it's inevitable to end-up operating with tens or hundreds of documents for many use-cases. By now this is only resolved by using External Document References, but it's much harder to work with linked documents, rather than a single composed one. Having the compose option would increase the usefulness of the bom tool, resolving this problem.

Bom already has parsing and filtering features to build compose on top of.

Puerco · Answer 1 · Thu Sep 29 2022 00:00:03 GMT+0800 (China Standard Time)

Hey @ivanayov , this is a project I've had under slow development in a branch for a long time now! As with other aspects of SPDX, I'd love bom and sbom-composer to be in sync in how we merge SBOMs, it sounds to me this would warrant its own WG as the serialization folks have done as pretty soon you start running into questions like where does this package fit, etc..

Let's try so sync at some point to create a common base understanding!

Puerco · Answer 2 · Thu Sep 29 2022 01:14:35 GMT+0800 (China Standard Time)

Oh I just noticed this project by @sbs2001, same thing goes to you Shivam!

Shivam Sandbhor · Answer 3 · Thu Sep 29 2022 13:06:59 GMT+0800 (China Standard Time)

fatbom already does something very similar to this. I guess extracting this functionality in more reusable manner would be a good start.

Kubernetes Triage Robot · Answer 4 · Wed Dec 28 2022 13:39:29 GMT+0800 (China Standard Time)

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Puerco · Answer 5 · Wed Dec 28 2022 15:51:56 GMT+0800 (China Standard Time)

/remove-lifecycle stale

Kubernetes Triage Robot · Answer 6 · Tue Mar 28 2023 16:31:16 GMT+0800 (China Standard Time)

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle stale
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

Kubernetes Triage Robot · Answer 7 · Thu Apr 27 2023 16:53:47 GMT+0800 (China Standard Time)

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle rotten
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

Kubernetes Triage Robot · Answer 8 · Sat May 27 2023 17:10:16 GMT+0800 (China Standard Time)

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue with /reopen
Mark this issue as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Kubernetes Prow Robot · Answer 9 · Sat May 27 2023 17:10:19 GMT+0800 (China Standard Time)

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue with /reopen

Mark this issue as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.