Skip to content

Publish SBOM blogpost part two #1954

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
o1oo11oo merged 1 commit into from
Sep 15, 2023
Merged

Publish SBOM blogpost part two #1954

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions documentation/blog/2023-09-01-sbom-part-one-generation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,5 +263,6 @@ One remaining problem are packages installed directly as binary, without any kin
Especially in containers this is pretty prevalent for the "main software" of a container.
This is a known issue for both Trivy and Syft: [trivy#481](https://github.com/aquasecurity/trivy/issues/481), [trivy#1064](https://github.com/aquasecurity/trivy/issues/1064), [trivy#2839](https://github.com/aquasecurity/trivy/issues/2839), [syft#1197](https://github.com/anchore/syft/issues/1197), [syft#1607](https://github.com/anchore/syft/issues/1607), [syft#1963](https://github.com/anchore/syft/issues/1963).
It seems that Syft's support for those kinds of binaries is slightly better, in the Juice Shop image, only Syft detects the actual node binary.
<!-- TODO: #346 Add link to part 2 -->
Before selecting one of these two as a tool for the MVP, it makes sense to look at the __other side__ of an _SBOM workflow_, the __consuming side__ in a second upcoming blog post.

Before selecting one of these two as a tool for the MVP, it makes sense to look at the __other side__ of an _SBOM workflow_, the __consuming side__.
These details are covered in [_Part 2: SBOM Consumption_](/blog/2023/09/15/sbom-part-two-consumption).
1 change: 0 additions & 1 deletion documentation/blog/2023-09-15-sbom-part-two-consumption.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ tags:
- Dependency-Track
description: We describe our plans to build an SBOM workflow for the secureCodeBox, including an SBOM tool comparison and interoperability troubles. This part treats the aspects of consuming SBOMs.
image: /img/blog/2023-09-15-river-mouth.jpg
draft: true
---

![A river mouth](/img/blog/2023-09-15-river-mouth.jpg)
Expand Down