That depends on what one means by "bundling". If SBOMs are mostly static and VEXs are updated rapidly, then one can define a bundle structure holding them both, But it must be possible to update the bundle WITHOUT being forced to update the SBOM. If you call the outer structure SPDX instead of SPDX-Bundle, then it must have what CMS ( https://datatracker.ietf.org/doc/html/rfc5652) calls "authenticated attributes" (the SBOM bits with a persistent identifier covered by an integrity mechanism) and "unauthenticated attributes" (the VEX bits that can be updated every minute without breaking integrity of the SBOM).
Regards, Dave On Sat, Feb 12, 2022 at 7:31 AM Dick Brooks < [email protected]> wrote: > I just want you to know that your work on defects for V 2.3 is indeed > important and useful. Here is what Chris had to say about vulnerability > reporting in a recent email exchange: > > > > *SBOMs are mostly static for a given build (yeah I know there are edge > conditions here, but lets just go with this idea)* > > *VEXs are highly dynamic.* > > *QED SBOMs and VEXs cannot occupy the same artifact as they have two > different time domains! WRONG!* > > > > *We were so wrapped up in the 'device delivers the SBOM' model, that we > never thought far enough to realize, that 'NO' there are going to be online > databases that can distribute SBOMs with VEXs that can change every minute.* > > > > *So while I was a huge proponent of CSAF, I have come to believe that the > real answer is bundling them together such as CycloneDX v1.4 has done.* > > > > Thanks, > > > > Dick Brooks > > > > Never trust software, always verify and report! ™ > > http://www.reliableenergyanalytics.com > > Email: [email protected] > > Tel: +1 978-696-1788 > > > > > > > -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#4376): https://lists.spdx.org/g/Spdx-tech/message/4376 Mute This Topic: https://lists.spdx.org/mt/89092050/21656 Group Owner: [email protected] Unsubscribe: https://lists.spdx.org/g/Spdx-tech/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
