omnibor / spec

A draft standard for communicating a cryptographic record of build inputs for software artifacts.

https://omnibor.io

omnibor/spec Issues

Tracking Issue: Artifact Identifier Improvements
Updated 8 months ago
Define the "GitOID construction" scheme used for creating Artifact Identifiers.
Updated 8 months ago
Amend Artifact Identifiers to use SHA-1DC, SHA-1, and SHA-256, to match Git.
Updated 8 months ago2
Define "Mandatory Hashes" and permit additional hashes for Artifact Identifier construction.
Updated 8 months ago
Alternate non-embedding proposal
Updated 9 months ago10
Add reference to Annex C to the main specification document
Closed 9 months ago
Fix Markdown syntax in Annex B document
Closed 9 months ago
Fix duplication in `OMNIBOR_DIR` precedence description
Closed 9 months ago
Update spec to define "strong reproducibility" and "weak reproducibility"
Updated 10 months ago
GITBOM_RECORD_HASH_MODE to support use case of not embedding gitoid into artifacts for reproducible build
Closed 10 months ago12
(More) General spec comments
Updated 10 months ago1
Distinguishing between artifact ID types in elf file section names
Closed 10 months ago27
Resolve consistency expectations of the `OMNIBOR_DIR`
Updated 10 months ago
OMNIBOR_DIR - location to store the omnibor documents
Closed 10 months ago1
Add contact details to the Code of Conduct
Updated 10 months ago2
Implement active versioning / version bumping of the specification
Updated 10 months ago
Consider changing directory fanout scheme in "Annex A: Filesystem Storage"
Updated 10 months ago
Annex A comments
Closed 10 months ago3
Some general observations/questions on the specs
Closed 10 months ago8
Distinguishing between artifact ID types in GitBOM docs
Closed 10 months ago3
Metadata? Earlier revs of a file?
Closed 10 months ago2
GitBOM SHA1/SHA256 parallel tree proposal
Closed 10 months ago2
GitBOM Representations of Build Tools and Build Tool configuration in tree
Closed 10 months ago4
Question: Using gitbom to report/remediate vulnerable dependencies?
Closed 10 months ago1
URI/URN representations for GitBOM
Closed 10 months ago24
Metadata for OmniBOR
Closed a year ago5
Double negative regarding patent rights in the Foreword.
Closed a year ago1
Combined SHA1-SHA256 for GitBOM
Closed 2 years ago1