Details
-
Sub-task
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
1.12.0
Description
Why are the changes needed?
Here is an article to give some context.
- https://www.activestate.com/blog/why-the-us-government-is-mandating-software-bill-of-materials-sbom/
Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: [CycloneDX](https://cyclonedx.org/), [Software Identification (SWID) tag](https://csrc.nist.gov/projects/Software-Identification-SWID), [Software Package Data Exchange® (SPDX)](https://spdx.dev/).
This PR uses [CycloneDX maven plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin), a lightweight software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.
Attachments
Issue Links
- relates to
-
FLINK-30578 Publish SBOM artifacts
-
- In Progress
-
-
-
- Resolved
-
-
-
- Resolved
-
-
-
- Closed
-
- links to
