Skip to content

Commit 33b93f3

Browse files
Merge branch 'main' into guide_sbom_improv_dependency-graph
2 parents c937f6b + 169af89 commit 33b93f3

10 files changed

+176
-122
lines changed

Attestations/en/0x01-Frontispiece.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,15 @@ Copyright © 2024 The OWASP Foundation.
2020
This document is released under the [Creative Commons Attribution 4.0 International](https://creativecommons.org/licenses/by/4.0/).
2121
For any reuse or distribution, you must make clear to others the license terms of this work.
2222

23-
First Edition, 26 March 2024
23+
First Edition, 02 April 2024
2424

2525
<div style="page-break-after: always; visibility: hidden">
2626
\emptyparagraph
2727
</div>
2828

2929
| Version | Changes | Updated On | Updated By |
3030
|---------------|-----------------|------------|-------------------------------------------------|
31-
| First Edition | Initial Release | 2024-03-26 | CycloneDX Feature Working Group on Attestations |
31+
| First Edition | Initial Release | 2024-04-02 | CycloneDX Feature Working Group on Attestations |
3232

3333
<div style="page-break-after: always; visibility: hidden">
3434
\newpage

CBOM/en/0x01-Frontispiece.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ supply chain security field. This guide would not be possible without valuable f
1111
Working Group (IWG), the CycloneDX Core Working Group (CWG), the many CycloneDX Feature Working Groups (FWG),
1212
Ecma International Technical Committee 54, and a global network of contributors and supporters.
1313

14-
Portions of this guide were contributed by IBM under the Apache License Version 2.0.
15-
1614
## Copyright and License
1715

1816
![license](../../images/license.svg)
@@ -22,15 +20,17 @@ Copyright © 2024 The OWASP Foundation.
2220
This document is released under the [Creative Commons Attribution 4.0 International](https://creativecommons.org/licenses/by/4.0/).
2321
For any reuse or distribution, you must make clear to others the license terms of this work.
2422

25-
First Edition, 26 March 2024
23+
Portions of this guide were contributed by IBM under the Apache License Version 2.0.
24+
25+
First Edition, 02 April 2024
2626

2727
<div style="page-break-after: always; visibility: hidden">
2828
\emptyparagraph
2929
</div>
3030

3131
| Version | Changes | Updated On | Updated By |
3232
|---------------|-----------------|------------|-------------------------------------------------|
33-
| First Edition | Initial Release | 2024-03-26 | CycloneDX Feature Working Group on Cryptography |
33+
| First Edition | Initial Release | 2024-04-02 | CycloneDX Feature Working Group on Cryptography |
3434

3535
<div style="page-break-after: always; visibility: hidden">
3636
\newpage

SBOM/en/0x01-Frontispiece.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,15 @@ Copyright © 2024 The OWASP Foundation.
2020
This document is released under the [Creative Commons Attribution 4.0 International](https://creativecommons.org/licenses/by/4.0/).
2121
For any reuse or distribution, you must make clear to others the license terms of this work.
2222

23-
Second Edition, 26 March 2024
23+
Second Edition, 02 April 2024
2424

2525
<div style="page-break-after: always; visibility: hidden">
2626
\emptyparagraph
2727
</div>
2828

2929
| Version | Changes | Updated On | Updated By |
3030
|----------------|----------------------------|------------|------------------------------|
31-
| Second Edition | Updated for CycloneDX v1.6 | 2024-03-26 | CycloneDX Core Working Group |
31+
| Second Edition | Updated for CycloneDX v1.6 | 2024-04-02 | CycloneDX Core Working Group |
3232
| First Edition | Initial Release | 2023-06-25 | CycloneDX Core Working Group |
3333

3434
<div style="page-break-after: always; visibility: hidden">

SBOM/en/0x30-Use_Cases.md

+2-108
Original file line numberDiff line numberDiff line change
@@ -256,122 +256,16 @@ The following example illustrates the use of enveloped signing using JSF.
256256
```
257257

258258
## License Compliance
259-
CycloneDX can be used for open-source and commercial license compliance. By leveraging the licensing capabilities of
259+
CycloneDX is ideal for both open-source and commercial license compliance. By leveraging the licensing capabilities of
260260
CycloneDX, organizations can identify any licenses that may be incompatible or require specific compliance obligations,
261-
such as attribution or sharing of source code.
261+
such as attribution or sharing of source code. CycloneDX supports declared, observed, and concluded licenses.
262262

263-
### Open Source Licensing
264-
The following is an example of a components license. CycloneDX communicates this information using the SPDX license IDs
265-
along with optionally including a Base64 encoded representation of the full license text.
266-
267-
```json
268-
"licenses": [
269-
{
270-
"license": {
271-
"id": "Apache-2.0",
272-
"text": {
273-
"contentType": "text/plain",
274-
"encoding": "base64",
275-
"content": "RW5jb2RlZCBsaWNlbnNlIHRleHQgZ29lcyBoZXJlLg=="
276-
},
277-
"url": "https://www.apache.org/licenses/LICENSE-2.0.txt"
278-
}
279-
}
280-
]
281-
```
282-
283-
SPDX license expressions are also fully supported.
284-
285-
```json
286-
"licenses": [
287-
{
288-
"expression": "(LGPL-2.1 OR BSD-3-Clause AND MIT)"
289-
}
290-
]
291-
```
292-
293-
In addition to asserting the license(s) of a component, CycloneDX also supports evidence of other licenses and copyrights
294-
found in a given component. For example:
295-
296-
```json
297-
"evidence": {
298-
"licenses": [
299-
{ "license": { "id": "Apache-2.0" } },
300-
{ "license": { "id": "LGPL-2.1-only" } }
301-
],
302-
"copyright": [
303-
{ "text": "Copyright 2012 Acme Inc. All Rights Reserved." },
304-
{ "text": "Copyright (C) 2004,2005 University of Example" }
305-
]
306-
}
307-
```
308-
Refer to the "Evidence" chapter for more information.
309-
310-
### Commercial Licensing
311263
CycloneDX can also help organizations manage their commercial software licenses by providing a clear understanding of
312264
what licenses are in use and which ones require renewal or additional purchases, which may impact the operational aspects
313265
of applications or systems. By leveraging CycloneDX for commercial license compliance, organizations can reduce the risks
314266
associated with license violations, enhance their license management practices, and align their SBOM practice with
315267
Software Asset Management (SAM) and IT Asset Management (ITAM) systems for enterprise visibility.
316268

317-
The following example illustrates a commercial license for a given component.
318-
319-
```json
320-
"licenses": [
321-
{
322-
"license": {
323-
"name": "Acme Commercial License",
324-
"licensing": {
325-
"licensor": {
326-
"organization": {
327-
"name": "Acme Inc",
328-
}
329-
},
330-
"licensee": {
331-
"organization": {
332-
"name": "Example Co."
333-
}
334-
},
335-
"purchaser": {
336-
"individual": {
337-
"name": "Samantha Wright",
338-
"email": "samantha.wright@gmail.com",
339-
"phone": "800-555-1212"
340-
}
341-
},
342-
"purchaseOrder": "PO-12345",
343-
"licenseTypes": [ "appliance" ],
344-
"lastRenewal": "2022-04-13T20:20:39+00:00",
345-
"expiration": "2023-04-13T20:20:39+00:00"
346-
}
347-
}
348-
}
349-
]
350-
```
351-
352-
All commercial license fields are optional. The licensor, licensee, and purchaser may be an organization or individual.
353-
Multiple license types may be specified and include:
354-
355-
| **License Type** | **Description** |
356-
|------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
357-
| academic | A license that grants use of software solely for the purpose of education or research. |
358-
| appliance | A license covering use of software embedded in a specific piece of hardware. |
359-
| client-access | A Client Access License (CAL) allows client computers to access services provided by server software. |
360-
| concurrent-user | A Concurrent User license (aka floating license) limits the number of licenses for a software application and licenses are shared among a larger number of users. |
361-
| core-points | A license where the core of a computer's processor is assigned a specific number of points. |
362-
| custom-metric | A license for which consumption is measured by non-standard metrics. |
363-
| device | A license that covers a defined number of installations on computers and other types of devices. |
364-
| evaluation | A license that grants permission to install and use software for trial purposes. |
365-
| named-user | A license that grants access to the software to one or more pre-defined users. |
366-
| node-locked | A license that grants access to the software on one or more pre-defined computers or devices. |
367-
| oem | An Original Equipment Manufacturer license that is delivered with hardware, cannot be transferred to other hardware, and is valid for the life of the hardware. |
368-
| perpetual | A license where the software is sold on a one-time basis and the licensee can use a copy of the software indefinitely. |
369-
| processor-points | A license where each installation consumes points per processor. |
370-
| subscription | A license where the licensee pays a fee to use the software or service. |
371-
| user | A license that grants access to the software or service by a specified number of users. |
372-
| other | Another license type. |
373-
374-
375269
Solutions supporting the Software Development Life Cycle (SDLC) typically involve open-source license compliance or
376270
intellectual property use cases. Whereas Software Asset Management (SAM) is primarily concerned with commercial license
377271
and procurement use cases. OWASP CycloneDX has extensive support for both and can be applied to any component or service

SBOM/en/0x45-Cryptographic_Components.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Leveraging Cryptographic Components
1+
# Introduction to Cryptographic Components
22

33
CycloneDX can describe cryptographic assets and their dependencies. Discovering, managing, and reporting on cryptographic
44
assets is necessary as the first step on the migration journey to quantum-safe systems and applications. Cryptography is

SBOM/en/0x49-Licenses.md

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
# License Compliance
2+
CycloneDX can be used for open-source and commercial license compliance. By leveraging the licensing capabilities of
3+
CycloneDX, organizations can identify any licenses that may be incompatible or require specific compliance obligations,
4+
such as attribution or sharing of source code.
5+
6+
## Open Source Licensing
7+
The following is an example of a components license. CycloneDX communicates this information using the SPDX license IDs
8+
along with optionally including a Base64 encoded representation of the full license text.
9+
10+
```json
11+
"licenses": [
12+
{
13+
"license": {
14+
"id": "Apache-2.0",
15+
"acknowledgement": "declared",
16+
"text": {
17+
"contentType": "text/plain",
18+
"encoding": "base64",
19+
"content": "RW5jb2RlZCBsaWNlbnNlIHRleHQgZ29lcyBoZXJlLg=="
20+
},
21+
"url": "https://www.apache.org/licenses/LICENSE-2.0.txt"
22+
}
23+
}
24+
]
25+
```
26+
27+
SPDX license expressions are also fully supported.
28+
29+
```json
30+
"licenses": [
31+
{
32+
"expression": "(LGPL-2.1 OR BSD-3-Clause AND MIT)",
33+
"acknowledgement": "declared"
34+
}
35+
]
36+
```
37+
38+
## Declared and Concluded Licenses
39+
Declared licenses and concluded licenses represent two different stages in the licensing process within software
40+
development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms
41+
under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis
42+
of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from
43+
the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions,
44+
concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper
45+
compliance and risk management.
46+
47+
| Acknowledgement | Description |
48+
|-----------------|------------------------------------------------------------------------------------------------------------|
49+
| declared | Declared licenses represent the initial intentions of authors regarding the licensing terms of their code. |
50+
| concluded | Concluded licenses are verified and confirmed. |
51+
52+
53+
## Using Evidence To Substantiate Concluded Licenses and Track Copyrights
54+
In addition to asserting the declared or concluded license(s) of a component, CycloneDX also supports evidence of other
55+
licenses and copyrights found in a given component. These licenses are "observed" in the course of analyzing a
56+
software project and form the necessary evidence to substantiate a "concluded" license. For example:
57+
58+
```json
59+
"evidence": {
60+
"licenses": [
61+
{ "license": { "id": "Apache-2.0" } },
62+
{ "license": { "id": "LGPL-2.1-only" } }
63+
],
64+
"copyright": [
65+
{ "text": "Copyright 2012 Acme Inc. All Rights Reserved." },
66+
{ "text": "Copyright (C) 2004,2005 University of Example" }
67+
]
68+
}
69+
```
70+
Refer to the "Evidence" chapter for more information.
71+
72+
73+
## Commercial Licensing
74+
CycloneDX can also help organizations manage their commercial software licenses by providing a clear understanding of
75+
what licenses are in use and which ones require renewal or additional purchases, which may impact the operational aspects
76+
of applications or systems. By leveraging CycloneDX for commercial license compliance, organizations can reduce the risks
77+
associated with license violations, enhance their license management practices, and align their SBOM practice with
78+
Software Asset Management (SAM) and IT Asset Management (ITAM) systems for enterprise visibility.
79+
80+
The following example illustrates a commercial license for a given component.
81+
82+
```json
83+
"licenses": [
84+
{
85+
"license": {
86+
"name": "Acme Commercial License",
87+
"licensing": {
88+
"licensor": {
89+
"organization": { "name": "Acme Inc" }
90+
},
91+
"licensee": {
92+
"organization": { "name": "Example Co." }
93+
},
94+
"purchaser": {
95+
"individual": {
96+
"name": "Samantha Wright",
97+
"email": "samantha.wright@gmail.com",
98+
"phone": "800-555-1212"
99+
}
100+
},
101+
"purchaseOrder": "PO-12345",
102+
"licenseTypes": [ "appliance" ],
103+
"lastRenewal": "2022-04-13T20:20:39+00:00",
104+
"expiration": "2023-04-13T20:20:39+00:00"
105+
}
106+
}
107+
}
108+
]
109+
```
110+
111+
All commercial license fields are optional. The licensor, licensee, and purchaser may be an organization or individual.
112+
Multiple license types may be specified and include:
113+
114+
| **License Type** | **Description** |
115+
|------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
116+
| academic | A license that grants use of software solely for the purpose of education or research. |
117+
| appliance | A license covering use of software embedded in a specific piece of hardware. |
118+
| client-access | A Client Access License (CAL) allows client computers to access services provided by server software. |
119+
| concurrent-user | A Concurrent User license (aka floating license) limits the number of licenses for a software application and licenses are shared among a larger number of users. |
120+
| core-points | A license where the core of a computer's processor is assigned a specific number of points. |
121+
| custom-metric | A license for which consumption is measured by non-standard metrics. |
122+
| device | A license that covers a defined number of installations on computers and other types of devices. |
123+
| evaluation | A license that grants permission to install and use software for trial purposes. |
124+
| named-user | A license that grants access to the software to one or more pre-defined users. |
125+
| node-locked | A license that grants access to the software on one or more pre-defined computers or devices. |
126+
| oem | An Original Equipment Manufacturer license that is delivered with hardware, cannot be transferred to other hardware, and is valid for the life of the hardware. |
127+
| perpetual | A license where the software is sold on a one-time basis and the licensee can use a copy of the software indefinitely. |
128+
| processor-points | A license where each installation consumes points per processor. |
129+
| subscription | A license where the licensee pays a fee to use the software or service. |
130+
| user | A license that grants access to the software or service by a specified number of users. |
131+
| other | Another license type. |
132+
133+
134+
Solutions supporting the Software Development Life Cycle (SDLC) typically involve open-source license compliance or
135+
intellectual property use cases. Whereas Software Asset Management (SAM) is primarily concerned with commercial license
136+
and procurement use cases. OWASP CycloneDX has extensive support for both and can be applied to any component or service
137+
within a BOM.
138+
139+
<div style="page-break-after: always; visibility: hidden">
140+
\newpage
141+
</div>

0 commit comments

Comments
 (0)