4 ms·
> the security world has been pushing CycloneDX and SPDX > CycloneDX supports JSON, XML, and YAML And SPDX is JSON. Are there any other examples of governmen
by phendrenad2 10mo ago
> the security world has been pushing CycloneDX and SPDX
> CycloneDX supports JSON, XML, and YAML
And SPDX is JSON.
Are there any other examples of government-mandated non-human-readable file formats? I feel like bureaucracies have a natural tendency to water down requirements such as this and instead focuses on getting wet signatures on pen-and-paper.
- Tomte 10mo agoOr tag-value, which is actually preferred by many practitioners. Nesting is implicit in that format, but SBOMs should be mostly flat, anyway. Unfortunately, T-V hs been dropped in SPDX 3.0.
- zvr 10mo agoIt was dropped exactly because it was flat and it was becoming completely unmanageable. SPDX v3 is based on a graph model that can represent hierarchies natively. It can then be serialized in a file, for example, in JSON format.
- Tomte 10mo agoBut it was the best format for manually creating an SBOM. Most SBOM use cases don‘t need the ability to put your detailed software architecture in the SBOM.
- zvr 10mo ago"manually creating an SBOM" is a much lower priority requirement than "easily, accurately, and completely creating an SBOM". The whole idea is to use specific libraries to produce and consume SBOMs. You wouldn't expect people to "manually create" JPG images, would you?
- Tomte 10mo agoI would expect people to do a lot of manual work in SBOM and licensing, yes. Because that‘s we do now.