sbom-utility
sbom-utility copied to clipboard
Add support for displaying/validating CDX Signature schema (struct)
i.e., add property Signature CDXSignature
json:"signature,omitempty"to top-level
CDXBom` structure. Then support it with signing verification (validation) with testcases.
This will be a bit of a challenge as we may also need to implement JSF schema:
- https://github.com/CycloneDX/specification/blob/master/schema/jsf-0.82.schema.json
As referenced by the CycloneDX schema (external).
As we want the utility to work in a network-disconnected environment (e.g., a secure build pipeline), this would have to bring in a static encoding (marshal/unmarshal, etc.)