Skip to content

Commit 24f6043

Browse files
mjherzogmjherzog
committed
Updated software identification draft
Also reformatted headings for compliance and security Signed-off-by: Michael Herzog <mjherzog@nexb.com>
1 parent 49bf1f9 commit 24f6043

3 files changed

Lines changed: 61 additions & 16 deletions

File tree

‎website/docs/getting_started/getting_started-compliance.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
# Compliance
22

3-
**Identify licenses for software and for data**
3+
## Identify licenses for software and for data
44

5-
**Apply usage policies**
5+
## Apply license usage policies**
66

7-
**Generate SBOMs**
7+
## Produce SBOMs
88

9-
**Automate compliance**
10-
- Generate compliance artifacts (e.g. attribution notices)
9+
## Automate compliance
1110

11+
- Generate compliance artifacts (e.g. attribution notices)

‎website/docs/getting_started/getting_started-security.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
# Security
22

3-
**Identify vulnerabilities**
3+
## Identify vulnerabilities
4+
- VERS
45

5-
**Triage vulnerabilities**
6+
## Triage vulnerabilities
7+
- Risk scoring
68

7-
**Manage risks with aggregated vuln data**
9+
## Manage risks with aggregated vuln data
810

9-
**Report exploitability (VEX)**
11+
## Report exploitability with VEX
1012

‎website/docs/getting_started/getting_started-software-identification.md‎

Lines changed: 50 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ Platform Enumeration) and SWID (SoftWare IDentification). Neither has been
1414
successful and neither was suitable for open source software which now
1515
represents approximately 80% of software in use according to most surveys.
1616

17+
## Package-URL
18+
1719
The AboutCode team identified this problem in 2018 in the context of working
1820
on our ScanCode and VulnerableCode projects. The solution was and is the PURL (Package-URL) specification which has become the most widely used software
1921
identifier for open source software. PURL is now an Ecma standard - [ECMA-427](https://ecma-tc54.github.io/ECMA-427/), and it is on a fast track to become
@@ -27,6 +29,10 @@ specification which will be submitted to Ecma as a standard in 2026.
2729

2830
See the [Package-URL website](https://package-url.github.io/www.packageurl.org/) for more information about PURL and VERS.
2931

32+
See the Package-URL (PURL) projects section of the Home page for more
33+
information about AboutCode tools that provide PURL- and VERS-specific
34+
capabilities.
35+
3036
## Identify software packages and components
3137
For the basic use case of identifying software packages and components,
3238
AboutCode offers the DejaCode and ScanCode tools, the PURLDB database and the PURL standard.
@@ -76,7 +82,7 @@ Dependencies (from package manifest files). The scan data also includes
7682
detailed information about image layers and their file content.
7783

7884
If you conclude that the ScanCode.io inventory is accurate, you can
79-
export the data CycloneDX or SPDX SBOM format, or in JSON or XLSX format
85+
export the data in CycloneDX or SPDX SBOM format, or in JSON or XLSX format
8086
for use in another application.
8187

8288
If you need to update or enhance the scan data before you produce an SBOM, DejaCode provides several options.
@@ -97,17 +103,54 @@ then:
97103
used in the ScanCode.io `analyze_docker_image` pipeline for the layer analysis,
98104
but you can also use it as a command line utility.
99105

106+
## Consume or produce SBOMs
107+
The EU CRA (Cyber Resilience Act) and other regulatory initiatives have
108+
dramatically raised the importance of SBOMs (Software Bills of Materials) for
109+
compliance with security risk management laws and regulations. A key challenge in using SBOMs is the reliable identification of software packages so that someone else in your software supply chain (upstream or downstream) will recognize the same package identity. The PURL (Package-URL) standard [ECMA-427](https://ecma-tc54.github.io/ECMA-427/) provides the most popular solution.
110+
111+
**DejaCode** and **ScanCode.io** both provide full capabilities to import or export SBOMs in CycloneDX or SPDX format using PURL as the standard software
112+
identifier.
113+
114+
## Match binaries to source
115+
One of the most difficult software identification tasks is to match the "binary" files that you distribute or deploy (on a device or the cloud) to the corresponding "source" files from your development/build systems. In the
116+
AboutCode community we consider binary-source matching to be a subset of the
117+
much larger domain of matching "deploy" files to "devel" files. This matching challenge includes:
118+
119+
- [ScanCode.io](https://scancodeio.readthedocs.io/en/latest/) supports "deploy-to-devel" matching with the `map_deploy_to_develop` pipeline.
120+
This pipeline currently handles:
121+
122+
- Matching Linux ELF, Windows, MacOS or Rust binaries to source
123+
- Matching Go binaries to source
124+
- Matching Java `jar` or `class` files to corresponding Java, Kotlin or
125+
Scala source files
126+
- Matching minified JavaScript to corresponding TS or JS files
127+
- And other use cases
128+
129+
- [MatchCode Toolkit](https://github.com/aboutcode-org/matchcode-toolkit/blob/main/README.rst) is a Python library that provides the file and directory fingerprinting functionality for ScanCode Toolkit and ScanCode.io using
130+
the HaloHash algorithm. You can use the **MatchCode Toolkit** as a library.
131+
132+
- ScanCode uses several AboutCode libraries to analyze "deploy" files
133+
including:
134+
- [binary-inspector](https://github.com/aboutcode-org/binary-inspector/blob/main/README.rst) extracts symbols from binaries in ELF, Mach-O, WinPe and
135+
other formats
136+
- [elf-inspector](https://github.com/aboutcode-org/elf-inspector/blob/main/README.rst) collects data from ELF binaries
137+
- [go-inspector](https://github.com/aboutcode-org/go-inspector/blob/main/README.rst) extracts dependencies and symbols from Go binaries
138+
- [rust-inspector](https://github.com/aboutcode-org/rust-inspector/blob/main/README.rst) extracts dependencies and symbols from Rust binaries
139+
- [source-inspector]https://github.com/aboutcode-org/source-inspector/blob/main/README.rst() collects code symbols, strings and comments from source files
140+
141+
These are all Python utilities that can also be used independently.
100142

101-
## Match binaries to sources
102-
103-
143+
## Identify software dependencies
144+
There are many use cases that include identification of package software
145+
dependencies
104146

147+
- ScanCode
148+
- dependency inspector
149+
- nuget-inspector
150+
- python-inspector
105151

106-
## Identify software dependencies
107-
inspectors
108152

109153

110-
## Consume or produce SBOMs
111154

112155

113156

0 commit comments

Comments
 (0)