Public
- Public
- Network
- Groups
- Popular
- People

Conversation

Notices

コロコロコロ助 (naota344@social.mikutter.hachune.net)'s status on Monday, 13-Sep-2021 01:01:06 JST コロコロコロ助

SPDX、ISOになったのか
SPDX Becomes Internationally Recognized Standard for Software Bill of Materials [LWN.net]https://lwn.net/Articles/868882/rss
In conversation Monday, 13-Sep-2021 01:01:06 JST from social.mikutter.hachune.net permalink
Attachments
1. Domain not in remote thumbnail source whitelist: static.lwn.net
  
  SPDX Becomes Internationally Recognized Standard for Software Bill of Materials
  
  The Linux Foundation has announced that Software Package Data Exchange (SPDX) has become an international standard (ISO/IEC 5962:2021). SPDX has been used in the kernel and other projects to identify the licenses and attach other metadata to software components. Between eighty and ninety percent (80%-90%) of a modern application is assembled from open source software components. An SBOM [software bill of materials] accounts for the software components contained in an application — open source, proprietary, or third-party — and details their provenance, license, and security attributes. SBOMs are used as a part of a foundational practice to track and trace components across software supply chains. SBOMs also help to proactively identify software issues and risks and establish a starting point for their remediation.

Feeds