create SBOM for software stack provided #366
Description
Is your feature request related to a problem? Please describe.
As a feature to support a more secure software supply chain, Thoth should generate a SBOM, for each advise requested, and build via a Tekton task. #needsRefinement
A SBOM is not a security tool but it is a means to improve security, it can’t guarantee “vulnerability-free” software but can be helpful in fast discovery of CVE.
High-level Goals
- SBOM should be machine-readable
- SBOM should be generated automatically
- SBOM should be static
- SBOM should be cryptographically signed
SBOM should contain:
- binary executables
- binary libraries
- packages (RPMs, wheels, jars, npm)
Describe the solution you'd like
TBD
Describe alternatives you've considered
TBD
Additional context
We need to figure out how to include/embed/reference SBOM from base operating system (composability)
https://cyclonedx.org/ might be interesting
Acceptance Criteria
TBD