https://www.thomas-huehn.com/open-source-projects-could-sell-sbom-fragments/

Discoveries

Home Blog

Open Source projects could sell SBOM fragments

2025-02-17

Scanning source files for licensing information (because the package
managers' metadata is insufficient) is a lot of work, and a lot of
wasted effort, because only rarely do companies pool their resources.
One example is OSSelot, another is ClearlyDefined.

But maybe Open Source projects could sell SBOM fragments, basically a
member of Components in CycloneDX or a Package in SPDX with correct
licensing information:

"Instead of scanning for copyright notices and license texts
yourself, just sponsor us on GitHub and get access to always
up-to-date SBOM information by the people who really know what's
inside".

#open source #sbom

[kJXQDazNPfCsKAGXsxpm] [                    ] 23
Follow me via RSS, newsletter or write an email.

Powered by Bear ?**?