You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We currently do not have an authoritative way to establish a link between a purl and a bom document. Due to the differences in generator tools, the same package (identified by a purl) could have a varying number of components in the generated Bill of Materials (BOM) document.
The proposal is to use/standardize a query parameter to specify the BOM-Link of a package identified by purl.
f08a6ccd-4dce-4759-bd84-c626675d60a8 - serialNumber of the BOM 1 - version of the BOM componentA - BOM Ref. This could also be a purl, in which case it has to be encoded.
We currently do not have an authoritative way to establish a link between a purl and a bom document. Due to the differences in generator tools, the same package (identified by a purl) could have a varying number of components in the generated Bill of Materials (BOM) document.
The proposal is to use/standardize a query parameter to specify the BOM-Link of a package identified by purl.
https://cyclonedx.org/capabilities/bomlink/
Example 1: An SBOM where the given package is the parent component
f08a6ccd-4dce-4759-bd84-c626675d60a7
- serialNumber of the BOM1
- version of the BOMExample 2: A BOM where the given package is not the parent component
f08a6ccd-4dce-4759-bd84-c626675d60a8
- serialNumber of the BOM1
- version of the BOMcomponentA
- BOM Ref. This could also be a purl, in which case it has to be encoded.2A: BOM Ref is an encoded purl
Future Extension
bomlocator
parameter could be used to specify the url (or the BOM-Link!) to an external service that can be used to locate BOM documents.Hypothetical Example 1: ghcr support for storing BOM artefacts under ghcr.io/bom/{bomlink}
bomlocator is a full encoded url
Hypothetical Example 2: ghcr support for BOM becomes well-known
bomlocator is a simple alias with bomlink
Hypothetical Example 3: The same document is mirrored in multiple sources to avoid downtime
bomlocator is a list of aliases
Hypothetical Example 4: ghcr has a separate locator service for free and enterprise customers.
bomlocator uses a BOM-Link
urn%3Acdx%3Af08a6ccd-4dce-4759-bd84-c626675d60c8%2F1%2FghcrServiceA
.The text was updated successfully, but these errors were encountered: