full path to nix-shell for now
This repository contains a collection of SBOMs published by ASF projects, copied and consolidated to provide a series of tools analyzing them:
See SECURITY/SBOM Software Bill of Materials for a quick background on what SBOMs are and how they're produced and used across the ASF.
sboms/ This folder contains an archive of SBOMs downloaded from their canonical locations. The top-level directory is the PMC, under that the directory structure follows the Purl identification of the artifacts that are described by the SBOMs.
app/ A web application hosted at https://sbom.security.apache.org/ to allow browsing the SBOM information.
ecosystem-graph/ A script to generate the graph displayed at https://sbom.security.apache.org/
scripts/ Various smaller scripts, such as for collecting SBOMs from their canonical locations.
| TLP | SBOMs | Build | SBOM Tools | Comments |
|---|---|---|---|---|
| Airflow :clipboard: | :mag: | pip npm | cdxgen | SBOMs publication |
| Arrow :clipboard: | :mag: | Maven ... | CDX Maven P | Go? Python? |
| Avro :clipboard: | :mag: | Maven ... | CDX Maven P | Python, C/C++/C#, PHP, ... |
| Camel :clipboard: | :mag: | Maven | CDX Maven P | |
| Commons :clipboard: | :mag: | Maven | CDX Maven P SPDX Maven P | |
| CXF :clipboard: | :mag: | Maven | CDX Maven P | |
| Directory :clipboard: | :mag: | Maven | CDX Maven P | |
| Druid :clipboard: | :mag: | Maven | CDX Maven P | |
| Flink :clipboard: | :mag: | Maven ... | CDX Maven P | Docker, K8S Operator |
| Groovy :clipboard: | :mag: | Gradle | CDX Gradle P | |
| Hadoop :clipboard: | :mag: | Maven | CDX Maven P | |
| HBase :clipboard: | :mag: | Maven | CDX Maven P | |
| Hop :clipboard: | :mag: | Maven | CDX Maven P | |
| Jena :clipboard: | :mag: | Maven | CDX Maven P | |
| JSPWiki :clipboard: | :mag: | Maven | CDX Maven P | |
| Logging :clipboard: | :mag: | Maven ... | CDX Maven P | C++, .Net, PHP? VDR |
| Maven :clipboard: | :mag: | Maven | CDX Maven P | |
| Orc :clipboard: | :mag: | Maven ... | CDX Maven P | Conan, Docker |
| Parquet :clipboard: | :mag: | Maven ... | CDX Maven P | C++, Rust |
| Pekko :clipboard: | :mag: | Sbt | ? | |
| Ratis :clipboard: | :mag: | Maven | CDX Maven P | |
| Santuario :clipboard: | :mag: | Maven ... | CDX Maven P | C++? |
| Skywalking :clipboard: | :mag: | Maven ... | CDX Maven P | Docker, Helm, npm, Rust, ... |
| Spark :clipboard: | :mag: | Maven pip ... | CDX Maven P | Python? K8S Operator? |
| Syncope :clipboard: | :mag: | Maven | CDX Maven P | |
| Turbine :clipboard: | :mag: | Maven | CDX Maven P | |
| Zookeeper :clipboard: | :mag: | Maven | CDX Maven P |