Ismaël Mejía created AVRO-3702:
----------------------------------
Summary: Publish Software bill of materials (SBOM) for Avro
Key: AVRO-3702
URL: https://issues.apache.org/jira/browse/AVRO-3702
Project: Apache Avro
Issue Type: Improvement
Components: build
Reporter: Ismaël Mejía
Software Bill of Materials (SBOM) are additional artifacts containing the
aggregate of all direct and transitive dependencies of a project. The US
Government (based on NIST recommendations) currently accepts only the three
most popular SBOM standards as valid, namely:
[CycloneDX]([https://cyclonedx.org/]), [Software Identification (SWID)
tag]([https://csrc.nist.gov/projects/Software-Identification-SWID]), [Software
Package Data Exchange® (SPDX)]([https://spdx.dev/]).
Avro should cover this for all the artifacts we publish. The ASF does not yet
have a preferred standard. If they choose one we will keep that one.
[https://cwiki.apache.org/confluence/display/COMDEV/SBOM]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
