I’ve posted a second example https://drive.google.com/open?id=1SSgs92QKQCrvUnQiPZduB-N2MWrxp-mn
It illustrates the split approach when detailed information about each file is needed.
Compared to the single-package approach (https://drive.google.com/open?id=1QvRq68o9woludq2_CLYFpmauwPCzwTma ), the only differences are:
The wrapper SBOM file still details a multi-file artifact as I’m delivering distinct files and not a zip file containing the individual files.
Let me know your thoughts
M: +33 6 69 95 49 59
About Which of the following do we do?" , the model right now lets you do 1. and 2.
The decision between the 2 options should be driven by the way you use these artifacts and the overhead you’re willing to pay:
In my opinion, it’s similar to the source repository discussion: the specification supports 1 SBOM for the whole source repository (1 artifact but many many files) and the specification supports 1 SBOM per file in the source repository and 1 wrapper SBOM for the repository if needed
About 3., the model as of now would deal with the situation the following way: the LicenseInfo is based on a licensing _expression_ which can indicate that you are using multiple licenses.
Would you or your supplier/customer need finer-grain information, then you would provide the information as described in 1. and 2.
In my opinion, it’s similar to the Windows discussion: you may not disclose file-level information about the distribution of Windows, but, if you choose to or are required to do so, you should comply with the 3T-SBOM-EMS format.
When you write “I say this because the file is the level of granularity at which we want to attach intellectual property (license) data.”, it means you “choose to or are required to do so” and you are willing to pay the overhead to attach the information at the file-level.
By the way, I posted an illustration of the proposed model with my tooling in the google drive: https://drive.google.com/open?id=1QvRq68o9woludq2_CLYFpmauwPCzwTma
It’s multi-file but single-SBOM.
M: +33 6 69 95 49 59
Hi. I have been working through some examples in our User Scenarios document and have a question related to the multiplicity of files.
Specifically, I wonder if it might be better to have a 1:1 relationship between an SBOM and a single artifact file. I say this because the file is the level of granularity at which we want to attach intellectual property (license) data.
Let’s say we have three files, a, b and c. Files a and b are GPL licensed., File c is BSD.
Which of the following do we do?
Am I understanding our current model correctly?
As you can guess from my first model, I'm also in favor of Artifact.
About the multiplicity of files, the model is quite clear with a [1..*] cardinality between the Artifact class and the File class.
To help, we could make sure that every illustrations of the different usage scenarii are multi-file situations.
For your information, I posted updated versions of the documents (docx, pdf, xmi) and illustrations in the SBOM google drive; they contain:
* Artifact terminology
* optional association between the Document class and the LicenseInfo
From: Ido Green
Sent: Tuesday, October 22, 2019 6:21 PM
+1 for artifact
But I wonder how can we make it clear that it could contain multiple files.
On Tue, Oct 22, 2019 at 09:10 Dan Lorenc <> wrote: