From 03db684f1c798c25cb5b815bc4d0668b8ee1c92f Mon Sep 17 00:00:00 2001 From: Richard Hughes Date: Thu, 21 Nov 2024 11:44:38 +0000 Subject: [PATCH] Add a SBOM template in CycloneDX format Improve supply chain security by including a SBOM file with substituted values. This will be used to construct a composite platform SBOM. Signed-off-by: Richard Hughes --- sbom.cdx.json | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 sbom.cdx.json diff --git a/sbom.cdx.json b/sbom.cdx.json new file mode 100644 index 000000000000..53758e6a2c54 --- /dev/null +++ b/sbom.cdx.json @@ -0,0 +1,72 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "version": 1, + "metadata": { + "authors": [ + { + "name": "@VCS_SBOM_AUTHORS@" + } + ] + }, + "components": [ + { + "type": "firmware", + "bom-ref": "pkg:github/tianocore/edk2@@VCS_TAG@", + "cpe": "cpe:2.3:a:tianocore:edk2:@VCS_TAG@:*:*:*:*:*:*:*", + "name": "EDK II", + "version": "@VCS_VERSION@", + "description": "A cross-platform firmware development environment for UEFI and PI specifications", + "authors": [ + { + "name": "@VCS_AUTHORS@" + } + ], + "supplier": { + "name": "EDK II developers" + }, + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + }, + { + "license": { + "id": "BSD-2-Clause" + } + }, + { + "license": { + "id": "BSD-3-Clause" + } + }, + { + "license": { + "id": "MIT" + } + }, + { + "license": { + "id": "PSF-2.0" + } + }, + { + "license": { + "id": "Zlib" + } + } + ], + "externalReferences": [ + { + "type": "website", + "url": "https://www.tianocore.org/" + }, + { + "type": "vcs", + "url": "https://github.com/tianocore/edk2" + } + ] + } + ] +}