Skip to content

Commit 080f1c2

Browse files
authored
Revised SBOM section with updated information (#31)
Signed-off-by: Ioana Iliescu <ioana.iliescu@eclipse-foundation.org>
1 parent cf4ed26 commit 080f1c2

5 files changed

Lines changed: 150 additions & 219 deletions

File tree

docs/sbom/earlyadopters.md

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,31 @@
11
# SBOM Early Adopters
22

3-
The Eclipse Foundation Security Team is leading an ongoing initiative to support projects in adopting Software Bill of Materials (SBOM), with a particular focus on designing and implementing Github Actions workflows that:
4-
- automatically generate SBOMs for new project releases, and
5-
- publish them to our DependencyTrack [instance](https://sbom.eclipse.org)
3+
The Eclipse Foundation Security Team is leading an ongoing initiative to support projects in adopting Software Bill of Materials (SBOM). Our aim is to enable project in pursuing independent implementations of SBOM generation and upload workflows into their existing release pipelines.
64

7-
As part of this initiative, we are collaborating with early adopter groups to design and implement such workflows tailored to their specific ecosystems and release processes.
5+
As such, we have been collaborating with Early Adopter projects and offering our hands-on support to design and implement such workflows tailored to their specific ecosystems and release processes. These engagements helped identify common challenges as well as effective solutions, which we are now sharing to accelerate broader adoption.
86

9-
These engagements helped identify common challenges as well as effective solutions, which we are now sharing to accelerate broader adoption. The examples in the table below illustrate a variety of successful implementation strategies developed as a result of these collaborations. They are intended to serve as practical inspiration for projects looking to integrate SBOM generation into their own release workflows.
7+
The examples in the table below illustrate a variety of successful implementation strategies developed as a result of these collaborations. They are intended to serve as practical inspiration for projects looking to integrate SBOM generation into their own release workflows.
108

11-
| Project | Ecosystem | SBOM Workflow |
12-
|----------------|------------------|-------------------------------------------------------------------------------------------|
13-
| Eclipse CSI | Python | [generate-sbom.yml](https://github.com/eclipse-csi/otterdog/blob/main/.github/workflows/generate-sbom.yml) |
14-
| Eclipse SysON | NPM | [generate-npm-sbom.yml](https://github.com/eclipse-syson/syson/blob/main/.github/workflows/generate-npm-sbom.yml) |
15-
| | Maven | [generate-maven-sbom.yml](https://github.com/eclipse-syson/syson/blob/main/.github/workflows/generate-maven-sbom.yml) |
16-
| Eclipse Kuksa | Python | [generate-python-sbom.yml](https://github.com/eclipse-kuksa/kuksa-python-sdk/blob/main/.github/workflows/generate-python-sbom.yml) |
17-
| Eclipse LMOS | Gradle | [generate-gradle-sbom.yml](https://github.com/eclipse-lmos/arc/blob/main/.github/workflows/generate-gradle-sbom.yml) |
18-
| Eclipse JKube | Maven | [generate-maven-sbom.yml](https://github.com/eclipse-jkube/jkube/blob/master/.github/workflows/generate-maven-sbom.yml) |
9+
| Project | Ecosystem | SBOM Workflow |
10+
|--------------------|------------------|-------------------------------------------------------------------------------------------------------------------------|
11+
| Eclipse Che | NPM | [chectl/generate-npm-sbom.yml](https://github.com/che-incubator/chectl/blob/main/.github/workflows/generate-sbom.yml) |
12+
| Eclipse SysON | NPM | [syson/generate-npm-sbom.yml](https://github.com/eclipse-syson/syson/blob/main/.github/workflows/generate-npm-sbom.yml) |
13+
| Eclipse Theia | NPM (monorepo) | [theia/generate-sbom.yml](https://github.com/eclipse-theia/theia/blob/master/.github/workflows/generate-sbom.yml) |
14+
| Eclipse Langium | NPM (monorepo) | [langium/generate-sbom.yml](https://github.com/eclipse-langium/langium/blob/main/.github/workflows/generate-sbom.yml) |
15+
| Eclipse SysON | Maven | [generate-maven-sbom.yml](https://github.com/eclipse-syson/syson/blob/main/.github/workflows/generate-maven-sbom.yml) |
16+
| Eclipse JKube | Maven | [generate-maven-sbom.yml](https://github.com/eclipse-jkube/jkube/blob/master/.github/workflows/generate-maven-sbom.yml) |
17+
| Eclipse Che | Maven | [generate-maven-sbom.yml](https://github.com/eclipse-che/che-server/blob/main/.github/workflows/generate-maven-sbom.yml)|
18+
| Eclipse Milo | Maven | [generate-maven-sbom.yml](https://github.com/eclipse-milo/milo/blob/main/.github/workflows/generate-maven-sbom.yml) |
19+
| Eclipse Store | Maven | [generate-maven-sbom.yml](https://github.com/eclipse-store/store/blob/main/.github/workflows/generate-maven-sbom.yml) |
20+
| Eclipse Serializer | Maven | [generate-maven-sbom.yml](https://github.com/eclipse-serializer/serializer/blob/main/.github/workflows/generate-maven-sbom.yml) |
21+
| Eclipse Kura | Maven, Tycho | [target-platform-sbom.yml](https://github.com/eclipse-kura/kura/blob/develop/.github/workflows/target-platform-sbom.yml)|
22+
| Eclipse CSI | Python | [generate-sbom.yml](https://github.com/eclipse-csi/otterdog/blob/main/.github/workflows/generate-sbom.yml) |
23+
| Eclipse Kuksa | Python | [generate-python-sbom.yml](https://github.com/eclipse-kuksa/kuksa-python-sdk/blob/main/.github/workflows/generate-python-sbom.yml) |
24+
| Eclipse LMOS | Gradle | [generate-gradle-sbom.yml](https://github.com/eclipse-lmos/arc/blob/main/.github/workflows/generate-gradle-sbom.yml) |
1925

20-
We strongly encourage all projects to take an active role in implementing SBOM in their own release processes. While our initiative provides examples and resources to help projects get started independently, we also maintain a queue of early adopter projects that we are directly supporting. If your project would benefit from our guidance, we welcome you to reach out to the Eclipse Foundation Security Team with the details below.
26+
We strongly encourage all projects to take an active role in integrating SBOM generation into their release processes. To support this, we provide a comprehensive set of internally developed resources, including detailed documentation, implementation examples, and plug-and-play integrations, enabling projects to adopt SBOM practices independently.
27+
28+
Should a project require additional guidance or hands-on assistance, the Eclipse Foundation Security Team is available to provide support. Please feel free to reach out with the following details:
2129
- **Sent to**: security@eclipse-foundation.org
2230
- **Subject**: "SBOM Early Adopters"
2331
- **Project context**:
@@ -27,5 +35,4 @@ We strongly encourage all projects to take an active role in implementing SBOM i
2735
- Ecosystems
2836
- Versioning strategy
2937
- Release process
30-
3138
Please note that support availability may depend on current capacity, but we are always happy to engage and assist where possible.

0 commit comments

Comments
 (0)