SBOMit = SBOM + in-toto on SBOMit

Mon, 01 Jan 0001 00:00:00 +0000

Technical Charter (the “Charter”) for SBOMit a Series of LF Projects, LLC

Adopted: January 9th, 2024

This Charter sets forth the responsibilities and procedures for technical contribution to, and oversight of, the SBOMit open source project, which has been established as SBOMit a Series of LF Projects, LLC (the “Project”). LF Projects, LLC (“LF Projects”) is a Delaware series limited liability company. All contributors (including committers, maintainers, and other technical positions) and other participants in the Project (collectively, “Collaborators”) must comply with the terms of this Charter.

Community

Mon, 01 Jan 0001 00:00:00 +0000

SBOMit is an open community project developed under the OpenSSF Security Tooling Working Group. We welcome contributors, users, and anyone interested in improving the trustworthiness of software supply chains.

Meetings

Schedule: Every Wednesday at 11:00 AM US Eastern Time Zoom Meeting Link
Meeting notes

Meet the Maintainers!

Maintainers

Join our Slack!

Click the Slack Icon at the bottom of the page
Add these two channels: #sbomit and #sig-sbom-everywhere

Documentation

Mon, 01 Jan 0001 00:00:00 +0000

Documentation for the SBOMit specification, tooling, and reference implementations will live here.

In the meantime, the authoritative source is the SBOMit specification repository.

Getting started

Content coming soon.

Specification

Content coming soon.

Tooling

Content coming soon.

FAQ

Mon, 01 Jan 0001 00:00:00 +0000

Why do we need Accurate SBOMs?

When Log4Shell (CVE-2021-44228) hit in December 2021, the number of exposed systems exploded from 40,000 to 830,000 in under 72 hours. Log4j was buried as a transitive dependency, and most teams had no way to know whether they were running it and where. Incident response turned into an organization-wide mining project.

Affected systems in the 72 hours following the Log4Shell outbreak.

Getting Started

Mon, 01 Jan 0001 00:00:00 +0000

This guide walks through setting up Witness to instrument your build, then using SBOMit to generate an enriched SBOM from the resulting attestation.

Prerequisites

Go 1.19 or later
openssl
jq
base64 (part of GNU coreutils)

Part 1: Witness

Witness wraps your build process and records signed attestations, a cryptographic audit trail.

1. Install Witness

bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh)

Or download a binary from the Witness releases page.