Minting and collecting SWID tags
summary
Describes using the SWID 2015 standard (XML schema) to answer “what software is installed” by generating tags that include tag IDs, names, versions, entity creators, file lists and checksums, and supplemental relationships; shows a working tool rpm-to-swid that converts installed RPMs or packages into SWID XML and a dnf plugin to export tags from repositories; notes signed and unsigned examples, NIST validator issues with arbitrary arch values, and ongoing work to finalize repository XML namespace and signature validation.
AI-written summary · about
chapters (4)
related talks
36mSW360 SBOM: Managing Vulnerability Information, SPDX Documents and New Depen...
26mEffective Software Supply Chain Monitoring
31mSoftware Bill of Materials (SBoM) for dummies
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
36mAll you wanted to know about sw vulnerabilities…but were too busy to look into
14mWhat Have I Modified in SELinux: a new addition to your SELinux toolbox
13mSW360 SBOM and License Obligation Management
51mUsing SWUpdate to Upgrade Your System