Software Bill of Materials (SBOM)

[TechSolomon]

• https://www.cisa.gov/sbom
• https://en.wikipedia.org/wiki/Software_supply_chain
• https://www.ntia.gov/page/software-bill-materials
• https://www.iotsecurityfoundation.org/wp-content/uploads/2023/02/RELEASE-2022-02-19-IoTSF-SBOM-whitepaper-v1-1-0.pdf
• https://andreafortuna.org/2022/12/31/the-swiss-cheese-cybersecurity-model

[TechSolomon]

Insights > Dependency graph > Export SBOM

---

{"SPDXID":"SPDXRef-DOCUMENT","spdxVersion":"SPDX-2.3","creationInfo":{"created":"2024-04-04T19:02:15Z","creators":["Tool: GitHub.com-Dependency-Graph"]},"name":"com.github.acep-uaf/data-diode","dataLicense":"CC0-1.0","documentDescribes":["SPDXRef-com.github.acep-uaf-data-diode"],"documentNamespace":"https://github.com/acep-uaf/data-diode/dependency_graph/sbom-665d8553959f53f5","packages":[{"SPDXID":"SPDXRef-com.github.acep-uaf-data-diode","name":"com.github.acep-uaf/data-diode","versionInfo":"","downloadLocation":"git+https://github.com/acep-uaf/data-diode","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:github/acep-uaf/data-diode"}]},{"SPDXID":"SPDXRef-go-github.com-cpuguy83-go-md2man-v2-2.0.4","name":"go:github.com/cpuguy83/go-md2man/v2","versionInfo":"2.0.4","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/github.com/cpuguy83/go-md2man/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-github.com-eclipse-paho.mqtt.golang-1.4.3","name":"go:github.com/eclipse/paho.mqtt.golang","versionInfo":"1.4.3","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/github.com/eclipse/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-github.com-gorilla-websocket-1.5.1","name":"go:github.com/gorilla/websocket","versionInfo":"1.5.1","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/github.com/gorilla/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-github.com-mattn-go-runewidth-0.0.15","name":"go:github.com/mattn/go-runewidth","versionInfo":"0.0.15","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/github.com/mattn/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-github.com-olekukonko-tablewriter-0.0.5","name":"go:github.com/olekukonko/tablewriter","versionInfo":"0.0.5","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/github.com/olekukonko/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-github.com-rivo-uniseg-0.4.7","name":"go:github.com/rivo/uniseg","versionInfo":"0.4.7","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/github.com/rivo/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-github.com-russross-blackfriday-v2-2.1.0","name":"go:github.com/russross/blackfriday/v2","versionInfo":"2.1.0","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/github.com/russross/blackfriday/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-github.com-urfave-cli-v2-2.27.1","name":"go:github.com/urfave/cli/v2","versionInfo":"2.27.1","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/github.com/urfave/cli/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-github.com-xrash-smetrics-0.0.0-20240312152122-5f08fbb34913","name":"go:github.com/xrash/smetrics","versionInfo":"0.0.0-20240312152122-5f08fbb34913","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/github.com/xrash/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-golang.org-x-net-0.23.0","name":"go:golang.org/x/net","versionInfo":"0.23.0","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/golang.org/x/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-golang.org-x-sync-0.6.0","name":"go:golang.org/x/sync","versionInfo":"0.6.0","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/golang.org/x/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-go-gopkg.in-yaml.v2-2.4.0","name":"go:gopkg.in/yaml.v2","versionInfo":"2.4.0","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:golang/gopkg.in/[email protected]","referenceType":"purl"}]},{"SPDXID":"SPDXRef-actions-actions-checkout-4.*.*","name":"actions:actions/checkout","versionInfo":"4.*.*","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:githubactions/actions/checkout@4.%2A.%2A","referenceType":"purl"}]},{"SPDXID":"SPDXRef-actions-actions-setup-go-5.*.*","name":"actions:actions/setup-go","versionInfo":"5.*.*","downloadLocation":"NOASSERTION","filesAnalyzed":false,"supplier":"NOASSERTION","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceLocator":"pkg:githubactions/actions/setup-go@5.%2A.%2A","referenceType":"purl"}]}],"relationships":[{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-github.com-cpuguy83-go-md2man-v2-2.0.4"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-github.com-eclipse-paho.mqtt.golang-1.4.3"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-github.com-gorilla-websocket-1.5.1"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-github.com-mattn-go-runewidth-0.0.15"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-github.com-olekukonko-tablewriter-0.0.5"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-github.com-rivo-uniseg-0.4.7"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-github.com-russross-blackfriday-v2-2.1.0"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-github.com-urfave-cli-v2-2.27.1"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-github.com-xrash-smetrics-0.0.0-20240312152122-5f08fbb34913"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-golang.org-x-net-0.23.0"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-golang.org-x-sync-0.6.0"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-go-gopkg.in-yaml.v2-2.4.0"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-actions-actions-checkout-4.*.*"},{"relationshipType":"DEPENDS_ON","spdxElementId":"SPDXRef-com.github.acep-uaf-data-diode","relatedSpdxElement":"SPDXRef-actions-actions-setup-go-5.*.*"}]}