[HN Gopher] GitBOM: Enabling universal artifact traceability in ...
       ___________________________________________________________________
        
       GitBOM: Enabling universal artifact traceability in software supply
       chains
        
       Author : todsacerdoti
       Score  : 17 points
       Date   : 2022-04-30 18:17 UTC (4 hours ago)
        
 (HTM) web link (gitbom.dev)
 (TXT) w3m dump (gitbom.dev)
        
       | [deleted]
        
       | throwamon wrote:
       | > By generating artifact trees at build time, embedding the hash
       | of the tree in produced artifacts, and referencing that hash in
       | each subsequent build step, GitBOM will enable the creation of
       | verifiable and complete artifact trees while requiring no effort
       | from, or changes in, most open source projects
       | 
       | So, Nix? (Except maybe the part where there's no effort/changes
       | needed...)
        
       | westurner wrote:
       | From https://gitbom.dev/resources/whitepaper/ :
       | 
       | > _For this reason we propose two areas of work:_
       | 
       | > _1. enhancing artifact-generating tools (e.g., compilers,
       | linkers, and container image generators) to also output metadata
       | regarding their inputs and outputs_
       | 
       | > _2. defining a storage format which represents the minimum
       | information to describe the artifact relationship tree, and which
       | uses git's on-disk storage format_
       | 
       | > _Following from (1), this approach will require minimal to no
       | effort on the part of open source project maintainers, thus
       | significantly increasing its chances of widespread adoption as
       | compared to any approach which requires maintainers to perform
       | additional actions (e.g., implementing substantive changes in
       | their CI /CD or package build pipeline to generate an SBOM)._
       | 
       | Requirements traceability:
       | https://en.wikipedia.org/wiki/Requirements_traceability
       | 
       | codemeta/codemeta - _Minimal metadata schemas for science
       | software and code, in JSON-LD_ :
       | https://github.com/codemeta/codemeta
       | 
       | JSON-LD: https://en.wikipedia.org/wiki/JSON-LD
        
       | freemint wrote:
       | I know of Hardware companies which commit binaries and such
       | artefacts to git (generated from the source code in repo) to
       | ensure that those are available. This looks like a really good
       | solution for this.
        
       ___________________________________________________________________
       (page generated 2022-04-30 23:01 UTC)