Skip to content

SBOM grader link #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jasinner wants to merge 2 commits into
base: main
Choose a base branch
from
Open

SBOM grader link #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
36776e0
Revert "Add SBOM compliance checker script (SPDX/CycloneDX, scores 1-…
jasinner May 29, 2026
e057dce
Link to SBOM-Grader as the official compliance validation tool
jasinner May 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions docs/sbom.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -764,6 +764,13 @@ A relationship between a component and the product it is a part of can be repres
}
```

## Compliance Validation

To validate an SBOM against the guidelines in this document, use
[SBOM-Grader](https://github.com/BorekZnovustvoritel/SBOM-Grader), a tool developed by the Red Hat
SBOM team in collaboration with Red Hat Product Security. It supports both SPDX and CycloneDX formats
and checks compliance against the rules defined here.
Comment on lines +769 to +772

@coderabbitai coderabbitai Bot May 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Read-only verification: check whether SBOM-Grader has tags/releases that can be pinned in docs.
set -euo pipefail

echo "Latest releases:"
curl -fsSL https://api.github.com/repos/BorekZnovustvoritel/SBOM-Grader/releases?per_page=5 | \
  jq -r '.[] | [.tag_name, .published_at] | `@tsv`'

echo
echo "Latest tags:"
curl -fsSL https://api.github.com/repos/BorekZnovustvoritel/SBOM-Grader/tags?per_page=10 | \
  jq -r '.[] | [.name, .commit.sha] | `@tsv`'

Repository: RedHatProductSecurity/security-data-guidelines

Length of output: 741

Pin SBOM-Grader to a specific release/tag for reproducible compliance results.

docs/sbom.md links to the SBOM-Grader repo without pinning, so compliance behavior could drift over time. SBOM-Grader publishes versioned releases/tags (e.g., v0.2.5, v0.2.4, etc.), so update the docs to reference a specific release tag (or commit SHA) and add a brief policy for when to bump the pinned version.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/sbom.md` around lines 769 - 772, Update the SBOM-Grader link in the docs
text that currently points to the repo homepage (the "SBOM-Grader" link) to a
specific release tag or commit SHA (e.g., replace the repo URL with the GitHub
release/tag URL for a chosen version), and add one short sentence after that
link stating the pinning policy: how to bump the pinned tag (who approves,
frequency, and test/validate step) and to record the new tag/sha in the document
when updated; ensure the change references "SBOM-Grader" so reviewers can easily
locate and verify the pinned URL and policy.


## Additional Notes

The guidelines highlighted in this document represent an ideal state across all of Red Hat-published security data
Expand Down
Loading
Loading