You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Change the name and version of the primary component.
69
83
```sh
@@ -160,14 +174,14 @@ for input and output formats
160
174
## Merge Algorithm
161
175
The default merge algorithm is `Hierarchical` merge.
162
176
163
-
| Algo | SBOM Spec | Notes |
164
-
|----------|----------|----------|
165
-
| Hierarchical | CycloneDX | For each input SBOM, we associate the dependent components with its primary component. This primary component is then included as a dependent of the newly created primary component for the assembled SBOM. |
166
-
| Flat | CycloneDX | Provides a flat list of components, duplicates are not removed. |
167
-
| Assembly | CycloneDX | Similar to Hierarchical merge, but treats each sbom as not dependent, so no relationships are created with primary. |
168
-
| Hierarchical | SPDX | It maintains relationships among all the merged documents. Contains relationship is using to express dependencies. No duplicate components are removed.|
169
-
| Flat | SPDX | It creates a flat list of all packages and files. It removes all relationships except the describes relationship|
170
-
| Assembly | SPDX | Similar to Hierarchical, except the contains relationship is omitted |
177
+
| Algo | SBOM Spec| Duplicates | Notes |
178
+
|----------|----------|------|----------|
179
+
| Hierarchical | CycloneDX | Not Removed | For each input SBOM, we associate the dependent components with its primary component. This primary component is then included as a dependent of the newly created primary component for the assembled SBOM|
180
+
| Flat | CycloneDX | Removed | Provides a flat list of components |
181
+
| Assembly | CycloneDX | Removed | Similar to Hierarchical merge, but treats each sbom as not dependent, so no relationships are created with primary. |
182
+
| Hierarchical | SPDX | Not Removed | It maintains relationships among all the merged documents. Contains relationship is using to express dependencies. No duplicate components are removed.|
183
+
| Flat | SPDX | Not Removed | It creates a flat list of all packages and files. It removes all relationships except the describes relationship|
184
+
| Assembly | SPDX | Not Removed | Similar to Hierarchical, except the contains relationship is omitted |
171
185
172
186
# A complete example/use-case
173
187
Interlynk produces a variety of closed-source tools that it offers to its customers. One of its security-conscious customers recognizes the importance of being diligent about the tools running on its network and has asked Interlynk to provide SBOMs for each tool. Interlynk has complied with this request by providing individual SBOMs for each tool it ships to the customer. However, the customer soon realizes that keeping track of so many SBOMs, which they receive at regular intervals, is challenging. To address this issue, the customer automates the process by combining all the SBOMs provided by Interlynk into a single SBOM, which they can monitor more easily using their preferred tool.
0 commit comments