Updated: 2024-11-21 SBOM Central

An artifact refers to physical files that make up a specific version of a software component. When such an artifact is registered in SBOM Central, it is assigned to a component with the same 'name,' i.e. normally a combination of type, vendor, and product name.

Example: in SBOM Central the artifact pkg gem/ruby/matrix@0.4.2 will get a corresponding component name gem:ruby/matrix. If the component already exists, the artifact will be assigned to it. If not, a new component is created prior to assigning.

When opening the component show page, a table will presents all artifacts and versions registered in the system.

Updated: 2024-11-16 SBOM Central

An SBOM refers to a software library, application, firmware etc. When such an artifact is registered, it is assigned a Product identity, which would be the combination of group (vendor) and name.

Example: An SBOM representing the application com.t2data/epss_cloud@1.3.4 gets the product identity com.t2data/epss_cloud. If the product exists, the artifact will be assigned to it. If not, a new product is created.

When opening the product show page, a table presents all artifacts and versions registered by the system.

For SBOMs, the history is also controlled by the collection of Tags.

To have a reference to a previous version of any software, both identity and tag collection must correspond.

Updated:2024-10-29 MAIA & SBOM Central

Read here about how Vcs, Homepage and Alt.Link is used

Alt. link is an alternate and manually inserted link address to a component source, superseding Vcs and Homepage. When adding the Alt. link, all versions registered in MAIA/SBOMC, current, previous and future, will have the Alt. link activated.

Example:

• Pages referenced in this example:

  • openssl 1.1.1o (component/version) show page.
  • openssl component index page.
  • openssl component edit dialog.

• The component is openssl 1.1.1o.

• Weblink is set to openssl.org with no usable API for MAIA.

• No update information available.

• Action 1: open the component index page by clicking the openssl/openssl link in the top the information section.

• Action 2: find the openssl component on a repository service integrated with MAIA/SBOMC.
• Open SSL is a software that is monitored by the Release Monitoring web.
• The Release Monitoring API is integrated with MAIA/SBOMC.
• Action 3: Search for openssl on the releasemonitoring page.
• There are 39 different projects for openssl. Here the first project (openssl.org) is matching our component.
• Action 4: select and open the openssl link to open the project page.

• Check that the openssl project page seems to match the information known for your component.
• Action 5: copy the release-monitoring project web address, https://release-monitoring.org/project/2566/

• Action 6: click the Edit button to change component information.

• Action 7: paste the weblink into the Alt weblink section.
• Action 8: save and close

• The component index page is updated.
• The Alt. link in the information section is updated.
• All weblinks, for each version, in the table are updated.

• Data in the openssl 1.1.1o show page is updated.
• Later, when the externa artifact update job is executed, the MAIA/SBOMC services will update the version status for openssl 1.1.1o.

Updated:2024-11-16 SBOM Central

Read here about how Vcs, Homepage and Alt.Link is used

Alt. link is an alternate and manually inserted link address to a component source, superseding Vcs and Homepage. When adding the Alt. link, all versions registered in MAIA, current, previous and future, will have the Alt. link activated.

Example:

• Pages referenced in this example:

  • actioncable 6.5.1 (component/version) show page.
  • actioncable component index page.
  • actioncable component edit dialog.

• The component is actioncable 6.1.5.

• Weblink is set to rubyonrails.org with no usable API for MAIA/SBOMC.

• No update information available.

• Action 1: open the component index page by clicking the actioncable link in the top the information section.

• Action 2: find the actioncable component on a repository service integrated with MAIA/SBOMC.
• actioncable is a Gem so it can be found on the RubyGems web.
• RubyGems API is integrated with MAIA.
• Action 3: copy the actioncable web address, https://rubygems.org/gems/actioncable

• The actioncable component index page is opened.
• Action 4: click the Edit button to change component information.

• Action 5: paste the weblink into the Alt weblink section.
• Action 6: save and close

• The component index page is updated.
• The Alt. link in the information section is updated.
• All weblinks, for each version, in the table are updated.

• Data in the actioncable 6.5.1 show page is updated.
• Later, when the externa artifact update job is executed, the MAIA/SBOMC services will update the version status for actioncable 6.5.1.

Updated: 2024-11-22 SBOM Central

SBOM Central can continuously examine the status of included software artifacts. If a new release is detected at the artifact source, the "Update available" tag will be set.

The information about the release status is provided by the Information Services.

Updated: 2024-11-16 SBOM Central

Homepage is a link address to the project that produces the artifact's home page.

Vcs is a link address to the repository containing the artifact.

If one of the link addresses is:

1. to a repository hosting service, and...
2. the hosting service has an API, and...
3. SBOM Central is integrated with the hosting service, ...

...then SBOM Central will be able to check the version status of the external artifact.

Homepage and Vcs are automatically set by the system (if possible). The Homepage link may be manually modified, but when upgrading the artifact, the Homepage for that version will be altered, disabling the previous modifications.

Alt. link is an alternate and manually inserted link address to the source, superseding Vcs and Hompage links. When adding the Alt. link, all versions registered in SBOM Central, current, previous and future, will have the Alt. link activated. A common and helpful situation for the use of Alt. link is when the artifact source links doesn't meet the requirements 1-3 above, but has a code mirroring site that does.

SBOM Central is prioritizing the links as follows:

1. Alt. link
2. Vcs
3. Homepage

References:

• RubyGems: How do I set the Alt. link to collect data from RubyGems
• Release Monitoring: How do I set the Alt. link to collect data from Release Monitoring

Updated: 2024-11-21 SBOM Central

A Component is a unit of software identified by its name. An Artifact is a single occurrence of the component i.e. the physical files that make up a specific version of an application

Updated: 2024-11-21 SBOM Central

An artifact refers to physical files that make up a specific version of a software component, application, etc..

An "External artifact" refers to an artifact normally not part of the internal source code development with version control, i.e. an external dependency that is downloaded and included into an application, library, etc.

There are no requirements regarding the origin of an external artifact in SBOM Central, it's more of a designation.

Updated:2024-11-21 SBOM Central

Currently is the SemVer system the norm, with some extensions. The Semantic Versioning (SemVer) (external link) system is a numbering system with numbers separated by dots, e.g. 1.0.2

The focus is on final releases. Pre-releases, betas, etc. will normally not be considered when examining the version status.

Examples:

• Omitting all characters preceding the numbering series e.g. rev_1.2.3 or v1.2.3 will be considered as 1.2.3
• Approves characters directly following the numbering series e.g. 1.2.3k or 1.2.3ac
• Rejects all versions with characters following the numbering series, if starting with a hyphen, underscore, point, etc. E.g. 1.2.3-pre1 or 1.2.3.rc1
• Approves underscore inside the numbering series e.g. 1_2_3 will be considered as 1.2.3

Other variants may be applicable.

Updated: 2024-11-21 SBOM Central

There could be several reasons why the new release of an external artifact doesn't get an "Update available"-tag.

For example:

1. The artifact source address (Homepage/Vcs/Alt.link) doesn't represent a repository hosting service with an API that SBOM Central is integrated with.
2. The Information Services has not updated the information yet (the cache is not renewed).
3. The version number and date are ambiguous.
4. The version number and date cannot be interpreted by SBOM Central.

Updated: 2024-11-21 SBOM Central

There are a number of reasons why the version status cannot resolved for an external artifact, setting it to Unresolved.

First: To be able to be Unresolved, SBOM Central must be integrated with an external service providing the data, else the status will be No data.

Integration examples:

• The artifact source address is stored in SBOM Central as Homepage, Vcs, or Alt link. The links may reference a repository hosting service with an API integrated with SBOM Central.
• Artifact information is found in a external monitoring service having an API integrated with SBOM Central.

Then, if:

1. the artifact version you are using doesn't exist at the repository hosting service, or...
2. you have versioning standards ambiguities, for the artifact version a) you are using or/and b) at the repository hosting service, or...
3. there is version date ambiguities at the repository hosting service.

the verdict will be Unresolved for the version status.