Skip to content

Fix Google docs links in README #117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bact wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix Google docs links in README #117

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 25 additions & 20 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,44 +4,48 @@ Home of the OpenSSF SBOM Everywhere SIG. We're glad you're here!

## Get Involved

* Official communications occur on the [openssf-sig-sbom](https://lists.openssf.org/g/openssf-sig-sbom) mailing list
* [Manage your subscriptions to Open SSF mailing lists](https://lists.openssf.org/g/main/subgroups)
* We have a [Slack Channel](https://openssf.slack.com/archives/C03GKSYFRC0) for discussion various SBOM related activities
- Official communications occur on the [openssf-sig-sbom](https://lists.openssf.org/g/openssf-sig-sbom) mailing list
- [Manage your subscriptions to Open SSF mailing lists](https://lists.openssf.org/g/main/subgroups)
- We have a [Slack Channel](https://openssf.slack.com/archives/C03GKSYFRC0) for discussion various SBOM related activities

### Meeting times

* Every other Tuesday @ 11:05am EST. The invite is available on the [OpenSSF Community Calendar](https://calendar.google.com/calendar/u/0/r?cid=czYzdm9lZmhwNWk5cGZsdGI1cTY3bmdwZXNAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ).
* [Meeting Minutes](https://docs.google.com/document/d/193ODRga1F49WKPYYR79SNi9b27mChBqpOf5iiWJcMso/edit#heading=h.xqitfd6hs1gc) can be found in this Google Document. Feel free to add agenda items, please put your name next to items you add.
- Every other Tuesday @ 11:05am EST. The invite is available on the [OpenSSF Community Calendar](https://calendar.google.com/calendar/u/0/r?cid=czYzdm9lZmhwNWk5cGZsdGI1cTY3bmdwZXNAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ).
- [Meeting Minutes](https://docs.google.com/document/d/193ODRga1F49WKPYYR79SNi9b27mChBqpOf5iiWJcMso/edit#heading=h.xqitfd6hs1gc) can be found in this Google Document. Feel free to add agenda items, please put your name next to items you add.

## Current Projects

### SBOM Catalog

To provide a better overview of the available tooling and their capabilities, this group maintains an SBOM Catalog which can be found under the following link:

[https://sbom-catalog.openssf.org/](https://sbom-catalog.openssf.org/)

If you want to get involved, please see the document [here](/SBOM-Catalog/contribute.md)

#### TODO

More data needs to be added to the catalog

### Establishing SBOM Best Practices for open source projects

The goal of this project is to understand what open source projects need to start publishing SBOMs

[https://docs.google.com/document/d/15_FKO8D03VSYDTNsMQZtn1aRfgVmModF-NM6VBnlrZA/](Draft document)
- [Draft document](https://docs.google.com/document/d/15_FKO8D03VSYDTNsMQZtn1aRfgVmModF-NM6VBnlrZA/)

#### TODO

This document needs to be better defined to construct a plan to help open source projects

### Best Practices for Naming and Directory Conventions for SBOMs (Software Bill of Materials) in Open Source Projects

This document describes where to put an SBOM to be distributed and how to name it. It currently has a very narrow scope.

#### TODO

It needs to be expanded to cover other use cases

[https://github.com/ossf/sbom-everywhere/blob/main/reference/sbom_naming.md](Reference doument)
- [Reference document](https://github.com/ossf/sbom-everywhere/blob/main/reference/sbom_naming.md)

## Motivation

Expand All @@ -50,6 +54,7 @@ It needs to be expanded to cover other use cases
## Objective

### The 3 overarching goals from the White House meeting

- Securing OSS Production: focus on preventing security defects and
vulnerabilities in code and open source packages in the first place
- Improving Vulnerability Discovery & Remediation: improving the process
Expand All @@ -58,16 +63,14 @@ It needs to be expanded to cover other use cases
distributing and implementing fixes.

### The goals for this group as defined in the mobilization plan

- The requirements needed to build use cases using SBOMs are clearly
understood, documented and implemented in current SBOM specifications
- There are “friction free” open source tools that generate SBOMs that meet
these requirements
- There is readily accessible education, awareness and implementation
guidance and 3rd party support




## Scope

The mobilization plan defines scope as
Expand All @@ -76,8 +79,6 @@ generation, consumption, and overall adoption of SBOMs everywhere, we can
improve the security posture of the entire open source ecosystem:
producers, consumers, and maintainers._



### Formatting Specifications

For the purposes of establishing ubiquity to ensure sustainability for SBOM related tooling, and future solutions for consumption, “supported” formats must be defined. At this time there are two supported formats that will be in scope for the purposes of this group: [CycloneDX](https://cyclonedx.org) and [SPDX](https://spdx.dev).
Expand Down Expand Up @@ -115,26 +116,30 @@ The Federal Government exists at every point of the Software Delivery Lifecycle,
- ![](https://www.nist.gov/sites/default/files/styles/2800_x_2800_limit/public/images/2021/07/09/software-verification-timeline.png)
- [Minimum Standards for Federal Government End Users](https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/recommended-minimum-standard-vendor-or-developer)


## Prior Work

### NTIA

- [NTIA SBOM Resources](https://ntia.gov/SBOM)
- [Software Bill of Materials Elements and Considerations](https://www.regulations.gov/docket/NTIA-2021-0001/document)
- [Plan to Congress on Declassification and Clearances related to The Communications Supply Chain Risk Information Partnership](https://ntia.gov/files/ntia/publications/ntia_plan_on_declassification_and_clearances_re_c-scrip.pdf)

NTIA's legwork has been a guiding source having done the most comprehensive research to date.

### CISA
- [CISA SBOM Resources](https://www.cisa.gov/sbom)

- [CISA SBOM Resources](https://www.cisa.gov/sbom)

### OWASP SCVS
- [OWASP SCVS Resources](https://owasp.org/scvs)

#### Tickets related to BOM Maturity model:
- [OWASP/Software-Component-Verification-Standard#34](https://github.com/OWASP/Software-Component-Verification-Standard/issues/34)
- [OWASP/Software-Component-Verification-Standard#35](https://github.com/OWASP/Software-Component-Verification-Standard/issues/35)
- [OWASP/Software-Component-Verification-Standard#36](https://github.com/OWASP/Software-Component-Verification-Standard/issues/36)
- [OWASP SCVS Resources](https://owasp.org/scvs)

#### Tickets related to BOM Maturity model

- [OWASP/Software-Component-Verification-Standard#34](https://github.com/OWASP/Software-Component-Verification-Standard/issues/34)
- [OWASP/Software-Component-Verification-Standard#35](https://github.com/OWASP/Software-Component-Verification-Standard/issues/35)
- [OWASP/Software-Component-Verification-Standard#36](https://github.com/OWASP/Software-Component-Verification-Standard/issues/36)

## Governance

The [CHARTER.md](CHARTER.md) outlines the scope and governance of our group activities.
The [CHARTER.md](CHARTER.md) outlines the scope and governance of our group activities.