For Yocto Project provide auto-merge

[riteshnoronha]

Given a yocto project, provide ability to auto-merge files in the index.json to a single sbom file, using the merge algorithms.

[par-anderssonTE]

This would be incredibly useful. Merging yocto SBOMs is exactly what I am trying to find something that can do and I was hoping sbomasm could solve it for me.

[riteshnoronha]

@par-anderssonTE that is awesome. We can prioritize this for our next release in two weeks. However we need help with the following

• Initial user (Let us know if u would be willing to participate)
• Sample files
• Expectations of merge.

We can discuss all these topics out here or you can email us at support@interlynk.io.

We have recently worked on this issue which was also a collaboration #219

Looking forward to collaborating.

Thanks
Ritesh

[par-anderssonTE]

Thanks for the enthusiastic response. However, after experimenting more with sbomasm, I'm not sure this is actually necessary to have as a dedicated feature. sbomasm seems to handle the yocto multi-file SPDX output quite well and understands the externalDocumentRef -> file mappings without the yocto-generated index file. I am getting some warnings but I think they are expected and wouldn't be helped by any parsing of the index file anyway.

I don't know about the original poster's needs but right now I think that sbomasm actually already fulfills mine.

As a side note, yocto can produce very complex and mature SPDX SBOMs with depth and granularity, and I would highly recommend any project that works on SPDX processing to use yocto builds to generate test/experimental input, even if the implementation goals are not yocto-specific. It produces very detailed multi-file SPDX output with sources, artifacts, runtimes, files, various relationship types etc. Just good data to work with, and a lot of enterprises will need to deal with this kind of detail but it's difficult to find tools that can do it well.

About #219, I've actually found some defective behaviour in that one in certain cases but I will write a separate ticket for that.

[riteshnoronha]

@par-anderssonTE one request i am writing a community blog here https://sbom-insights.dev/ about how to use sbomasm for yocto sbom merging. Wondering if you would be willing to share details (not product, but workflow) about how you went about doing it, and outcomes.

[par-anderssonTE]

@riteshnoronha We have only gotten as far as evaluating if sbomasm meets our needs for integration (currently the answer is "nearly") but as it stands I am not directly involved in that study anymore. It is unfortunate because I have more issues/feature requests/challenges related to complex assemblies, but I no longer have the opportunity to experiment as in-depth as I would need in order to be able to formulate proper tickets. It is possible that I will return to this area in the future but at the moment I have no company time to put into sbomasm experimentation/feedback.

That being said, my team and I have been looking at SBOM management in an enterprise context for some time now (and especially identifying challenges in implementing an actually mature end-to-end SBOM management process/toolchain that looks forward and satisfies expected future industry requirements of high granularity, traceability, etc). I would love to contribute insights to authors of promising open-source tools and the community in general as very few tool/service developers seem to have grasped/anticipated which features/integrations will become vital to enterprise users, especially in sensitive, high requirement sectors like telecom, healthcare, defense, government etc. Maintaining a list of components and matching CPEs to CVEs is basically Baby's First SBOM.

I will probably contact you, but working in enterprise-to-enterprise environments means I need to think hard about where the lines between sharing insights with the community and giving free consultation to Interlynk goes, and where "From my experience..." crosses over to information leakage of customer processes by inference. Not to mention what I can do on the clock.

[riteshnoronha]

sounds good @par-anderssonTE Yes please do reach out when you have bandwidth and its feasible. Would love to improve our OSS tools, for consumption.