SBOM Catalog
Looking for the right SBOM tooling? Explore our interactive catalog.
diff --git a/404.html b/404.html new file mode 100644 index 0000000..dbaf6ac --- /dev/null +++ b/404.html @@ -0,0 +1,21 @@ + + +
+ + +Home of the OpenSSF SBOM Everywhere SIG. We're glad you're here!
The mobilization plan defines scope as By focusing on tools and advocacy, we can remove the barriers to generation, consumption, and overall adoption of SBOMs everywhere, we can improve the security posture of the entire open source ecosystem: producers, consumers, and maintainers.
For the purposes of establishing ubiquity to ensure sustainability for SBOM related tooling, and future solutions for consumption, “supported” formats must be defined. At this time there are two supported formats that will be in scope for the purposes of this group: CycloneDX and SPDX.
Utilization of these specifications would likely be discretionary and interchangeable depending on the use case and SBOM type and the requirements of individual organizations and internal tooling.
This group's interpretation is
The Federal Government exists at every point of the Software Delivery Lifecycle, hence their minimum requirements are good guides to establish a baseline scope.
To provide a better overview of the available tooling and their capabilities, this group maintains an SBOM Catalog which can be found under the following link:
https://ossf.github.io/sbom-everywhere/
If you want to get involved, please see the document here
NTIA's legwork has been a guiding source having done the most comprehensive research to date.
The CHARTER.md outlines the scope and governance of our group activities.
',39),n=[r];function s(l,h,c,u,d,m){return a(),t("div",null,n)}const g=e(o,[["render",s]]);export{p as __pageData,g as default}; diff --git a/assets/about-us.md.FE-Wmkxw.lean.js b/assets/about-us.md.FE-Wmkxw.lean.js new file mode 100644 index 0000000..b500ac6 --- /dev/null +++ b/assets/about-us.md.FE-Wmkxw.lean.js @@ -0,0 +1 @@ +import{_ as e,c as t,o as a,a3 as i}from"./chunks/framework.Bsyxd66g.js";const p=JSON.parse('{"title":"SBOM Everywhere SIG (About us)","description":"","frontmatter":{},"headers":[],"relativePath":"about-us.md","filePath":"about-us.md"}'),o={name:"about-us.md"},r=i("",39),n=[r];function s(l,h,c,u,d,m){return a(),t("div",null,n)}const g=e(o,[["render",s]]);export{p as __pageData,g as default}; diff --git a/assets/app.DW00HJpo.js b/assets/app.DW00HJpo.js new file mode 100644 index 0000000..f22b0a2 --- /dev/null +++ b/assets/app.DW00HJpo.js @@ -0,0 +1 @@ +import{U as o,a4 as p,a5 as u,a6 as l,a7 as c,a8 as f,a9 as d,aa as m,ab as h,ac as g,ad as A,d as P,u as v,y,x as w,ae as C,af as R,ag as b,ah as E}from"./chunks/framework.Bsyxd66g.js";import{R as S}from"./chunks/theme.DnbsOCOH.js";function i(e){if(e.extends){const a=i(e.extends);return{...a,...e,async enhanceApp(t){a.enhanceApp&&await a.enhanceApp(t),e.enhanceApp&&await e.enhanceApp(t)}}}return e}const s=i(S),T=P({name:"VitePressApp",setup(){const{site:e,lang:a,dir:t}=v();return y(()=>{w(()=>{document.documentElement.lang=a.value,document.documentElement.dir=t.value})}),e.value.router.prefetchLinks&&C(),R(),b(),s.setup&&s.setup(),()=>E(s.Layout)}});async function _(){globalThis.__VITEPRESS__=!0;const e=D(),a=x();a.provide(u,e);const t=l(e.route);return a.provide(c,t),a.component("Content",f),a.component("ClientOnly",d),Object.defineProperties(a.config.globalProperties,{$frontmatter:{get(){return t.frontmatter.value}},$params:{get(){return t.page.value.params}}}),s.enhanceApp&&await s.enhanceApp({app:a,router:e,siteData:m}),{app:a,router:e,data:t}}function x(){return h(T)}function D(){let e=o,a;return g(t=>{let n=A(t),r=null;return n&&(e&&(a=n),(e||a===n)&&(n=n.replace(/\.js$/,".lean.js")),r=import(n)),o&&(e=!1),r},s.NotFound)}o&&_().then(({app:e,router:a,data:t})=>{a.go().then(()=>{p(a.route,t.site),e.mount("#app")})});export{_ as createApp}; diff --git a/assets/basics.md.CA6xcvcx.js b/assets/basics.md.CA6xcvcx.js new file mode 100644 index 0000000..242f642 --- /dev/null +++ b/assets/basics.md.CA6xcvcx.js @@ -0,0 +1 @@ +import{_ as a,c as e,o as t,j as s,a as c}from"./chunks/framework.Bsyxd66g.js";const u=JSON.parse('{"title":"Basics","description":"","frontmatter":{},"headers":[],"relativePath":"basics.md","filePath":"basics.md"}'),o={name:"basics.md"},i=s("h1",{id:"basics",tabindex:"-1"},[c("Basics "),s("a",{class:"header-anchor",href:"#basics","aria-label":'Permalink to "Basics"'},"")],-1),r=s("div",{class:"warning custom-block"},[s("p",{class:"custom-block-title"},"Work in Progress"),s("p",null,"This site is Work in progress and just a concept.")],-1),n=[i,r];function d(l,_,p,h,m,b){return t(),e("div",null,n)}const k=a(o,[["render",d]]);export{u as __pageData,k as default}; diff --git a/assets/basics.md.CA6xcvcx.lean.js b/assets/basics.md.CA6xcvcx.lean.js new file mode 100644 index 0000000..242f642 --- /dev/null +++ b/assets/basics.md.CA6xcvcx.lean.js @@ -0,0 +1 @@ +import{_ as a,c as e,o as t,j as s,a as c}from"./chunks/framework.Bsyxd66g.js";const u=JSON.parse('{"title":"Basics","description":"","frontmatter":{},"headers":[],"relativePath":"basics.md","filePath":"basics.md"}'),o={name:"basics.md"},i=s("h1",{id:"basics",tabindex:"-1"},[c("Basics "),s("a",{class:"header-anchor",href:"#basics","aria-label":'Permalink to "Basics"'},"")],-1),r=s("div",{class:"warning custom-block"},[s("p",{class:"custom-block-title"},"Work in Progress"),s("p",null,"This site is Work in progress and just a concept.")],-1),n=[i,r];function d(l,_,p,h,m,b){return t(),e("div",null,n)}const k=a(o,[["render",d]]);export{u as __pageData,k as default}; diff --git a/assets/catalog_index.md.D3h8koQV.js b/assets/catalog_index.md.D3h8koQV.js new file mode 100644 index 0000000..593b046 --- /dev/null +++ b/assets/catalog_index.md.D3h8koQV.js @@ -0,0 +1 @@ +import{_ as t,c as a,o,j as e}from"./chunks/framework.Bsyxd66g.js";const O=JSON.parse('{"title":"","description":"","frontmatter":{},"headers":[],"relativePath":"catalog/index.md","filePath":"catalog/index.md"}'),s={name:"catalog/index.md"},c=e("div",{class:"warning custom-block"},[e("p",{class:"custom-block-title"},"WARNING"),e("p",null,"THIS IS A PLACEHOLDER FOR THE SBOM CATALOG THAT GETS DEPLOYED HERE. DONT USE THIS PATH FOR OTHER RESOURCES!")],-1),n=[c];function r(i,l,d,_,p,E){return o(),a("div",null,n)}const T=t(s,[["render",r]]);export{O as __pageData,T as default}; diff --git a/assets/catalog_index.md.D3h8koQV.lean.js b/assets/catalog_index.md.D3h8koQV.lean.js new file mode 100644 index 0000000..593b046 --- /dev/null +++ b/assets/catalog_index.md.D3h8koQV.lean.js @@ -0,0 +1 @@ +import{_ as t,c as a,o,j as e}from"./chunks/framework.Bsyxd66g.js";const O=JSON.parse('{"title":"","description":"","frontmatter":{},"headers":[],"relativePath":"catalog/index.md","filePath":"catalog/index.md"}'),s={name:"catalog/index.md"},c=e("div",{class:"warning custom-block"},[e("p",{class:"custom-block-title"},"WARNING"),e("p",null,"THIS IS A PLACEHOLDER FOR THE SBOM CATALOG THAT GETS DEPLOYED HERE. DONT USE THIS PATH FOR OTHER RESOURCES!")],-1),n=[c];function r(i,l,d,_,p,E){return o(),a("div",null,n)}const T=t(s,[["render",r]]);export{O as __pageData,T as default}; diff --git a/assets/chunks/@localSearchIndexroot.-NK0HcVv.js b/assets/chunks/@localSearchIndexroot.-NK0HcVv.js new file mode 100644 index 0000000..7e035ee --- /dev/null +++ b/assets/chunks/@localSearchIndexroot.-NK0HcVv.js @@ -0,0 +1 @@ +const e='{"documentCount":73,"nextId":73,"documentIds":{"0":"/about-us.html#sbom-everywhere-sig-about-us","1":"/about-us.html#ossf-sbom-everywhere-sig","2":"/about-us.html#get-involved","3":"/about-us.html#meeting-times","4":"/about-us.html#motivation","5":"/about-us.html#objective","6":"/about-us.html#the-3-overarching-goals-from-the-white-house-meeting","7":"/about-us.html#the-goals-for-this-group-as-defined-in-the-mobilization-plan","8":"/about-us.html#scope","9":"/about-us.html#formatting-specifications","10":"/about-us.html#sbom-catalog","11":"/about-us.html#prior-work","12":"/about-us.html#ntia","13":"/about-us.html#cisa","14":"/about-us.html#owasp-scvs","15":"/about-us.html#tickets-related-to-bom-maturity-model","16":"/about-us.html#governance","17":"/basics.html#basics","18":"/example-integrations.html#example-integrations","19":"/faq.html#frequently-asked-questions","20":"/getting-started.html#getting-started","21":"/getting-started.html#select-an-sbom-generation-phase","22":"/getting-started.html#choose-a-generation-methodology","23":"/getting-started.html#sbom-generation-in-the-build-process","24":"/getting-started.html#sbom-generation-with-a-separate-tool","25":"/getting-started.html#select-an-sbom-tool","26":"/getting-started.html#integrate-into-your-build","27":"/getting-started.html#publish-with-your-artifacts","28":"/glossery.html#glossery","29":"/glossery.html#sbom","30":"/glossery.html#spdx","31":"/glossery.html#cyclonedx","32":"/glossery.html#swid","33":"/sbom-compliance.html#sbom-in-compliance","34":"/sbom-compliance.html#eu-cyber-resiliance-act","35":"/sbom-compliance.html#guide-of-introduction-of-sbom-for-software-management","36":"/sbom-compliance.html#technical-guideline-tr-03183","37":"/sbom-compliance.html#sbom-startersgids-🇳🇱","38":"/sbom-compliance.html#the-minimum-elements-for-a-sbom","39":"/sbom-compliance.html#white-house-executive-order-14028","40":"/sbom-naming.html#best-practices-for-naming-and-directory-conventions-for-sboms-software-bill-of-materials-in-open-source-projects","41":"/sbom-naming.html#scope","42":"/sbom-naming.html#consistent-naming-conventions","43":"/sbom-naming.html#acknowledgements","44":"/sbom-types.html#types-of-software-bill-of-material-sbom-documents","45":"/sbom-types.html#introduction","46":"/sbom-types.html#definitions-and-discussions","47":"/sbom-types.html#sbom-type-definition-and-composition","48":"/sbom-types.html#understanding-the-benefits-and-limitations-of-sbom-types","49":"/sbom-types.html#conclusion","50":"/sbom-working-groups.html#sbom-working-groups","51":"/sbom-working-groups.html#cyclonedx","52":"/sbom-working-groups.html#spdx","53":"/sbom-working-groups.html#general-meeting-first-thursday-of-the-month-11am-et","54":"/sbom-working-groups.html#tech-team-meetings-thursday-12am-et","55":"/sbom-working-groups.html#legal-team-meetings-every-other-thursday-12am-et","56":"/sbom-working-groups.html#outreach-team-meetings-monday-10am-et","57":"/sbom-working-groups.html#sub-groups-for-specific-topics","58":"/sbom-working-groups.html#security-profile-group-meetings-wednesdays-2pm-et","59":"/sbom-working-groups.html#implementers-group-meetings-wednesdays-11am-et","60":"/sbom-working-groups.html#ai-and-data-profiles-group-meetings-wednesdays-3pm-et","61":"/sbom-working-groups.html#functional-safety-profile-group-meetings-friday-12am-et","62":"/sbom-working-groups.html#serialisation-focus-group-meetings-thursday-11am-et","63":"/sbom-working-groups.html#software-as-a-service-profile-group-meetings-every-other-monday-1pm-et","64":"/sbom-working-groups.html#hardware-profile-group-meetings-friday-9am-et","65":"/sbom-working-groups.html#operations-group-meetings-friday-9-30am-et","66":"/sbom-working-groups.html#cisa","67":"/sbom-working-groups.html#sbom-community-central-meeting-monday-11am-et","68":"/sbom-working-groups.html#vex-sub-group-monday-10am-et","69":"/sbom-working-groups.html#sbom-adoption-work-stream-tuesday-12pm-et","70":"/sbom-working-groups.html#sbom-tooling-work-stream-thursday-3pm-et","71":"/sbom-working-groups.html#openssf-sbom-everywhere-every-other-tuesday-11am-et","72":"/sbom-working-groups.html#anchore-oss-community-meeting-every-other-thursday-11am-et"},"fieldIds":{"title":0,"titles":1,"text":2},"fieldLength":{"0":[6,1,1],"1":[4,1,13],"2":[2,4,29],"3":[2,6,37],"4":[1,4,47],"5":[1,4,1],"6":[9,5,40],"7":[11,5,40],"8":[1,4,36],"9":[2,5,163],"10":[2,4,42],"11":[2,4,1],"12":[1,6,39],"13":[1,6,4],"14":[2,6,4],"15":[7,8,9],"16":[1,4,13],"17":[1,1,12],"18":[2,1,12],"19":[3,1,12],"20":[2,1,1],"21":[5,2,76],"22":[4,2,33],"23":[6,6,97],"24":[6,6,121],"25":[4,2,10],"26":[4,2,46],"27":[4,2,31],"28":[1,1,12],"29":[1,1,47],"30":[1,1,1],"31":[1,1,1],"32":[1,1,1],"33":[3,1,1],"34":[5,3,57],"35":[7,3,52],"36":[5,3,61],"37":[3,3,64],"38":[7,3,86],"39":[6,3,51],"40":[16,1,49],"41":[1,16,135],"42":[3,16,111],"43":[1,16,37],"44":[7,1,17],"45":[1,7,65],"46":[3,7,51],"47":[5,7,142],"48":[8,7,219],"49":[1,7,71],"50":[3,1,1],"51":[1,3,20],"52":[1,3,11],"53":[9,4,32],"54":[6,4,24],"55":[8,4,31],"56":[6,4,17],"57":[5,4,1],"58":[7,8,25],"59":[6,8,20],"60":[9,8,25],"61":[8,8,22],"62":[7,8,19],"63":[12,8,19],"64":[7,8,31],"65":[7,8,33],"66":[1,3,44],"67":[7,4,6],"68":[6,4,10],"69":[7,4,10],"70":[7,4,13],"71":[8,3,43],"72":[9,3,19]},"averageFieldLength":[4.520547945205478,4.493150684931505,38.04109589041096],"storedFields":{"0":{"title":"SBOM Everywhere SIG (About us)","titles":[]},"1":{"title":"OSSF SBOM Everywhere SIG","titles":[]},"2":{"title":"Get Involved","titles":["OSSF SBOM Everywhere SIG"]},"3":{"title":"Meeting times","titles":["OSSF SBOM Everywhere SIG","Get Involved"]},"4":{"title":"Motivation","titles":["OSSF SBOM Everywhere SIG"]},"5":{"title":"Objective","titles":["OSSF SBOM Everywhere SIG"]},"6":{"title":"The 3 overarching goals from the White House meeting","titles":["OSSF SBOM Everywhere SIG","Objective"]},"7":{"title":"The goals for this group as defined in the mobilization plan","titles":["OSSF SBOM Everywhere SIG","Objective"]},"8":{"title":"Scope","titles":["OSSF SBOM Everywhere SIG"]},"9":{"title":"Formatting Specifications","titles":["OSSF SBOM Everywhere SIG","Scope"]},"10":{"title":"SBOM Catalog","titles":["OSSF SBOM Everywhere SIG"]},"11":{"title":"Prior Work","titles":["OSSF SBOM Everywhere SIG"]},"12":{"title":"NTIA","titles":["OSSF SBOM Everywhere SIG","Prior Work"]},"13":{"title":"CISA","titles":["OSSF SBOM Everywhere SIG","Prior Work"]},"14":{"title":"OWASP SCVS","titles":["OSSF SBOM Everywhere SIG","Prior Work"]},"15":{"title":"Tickets related to BOM Maturity model:","titles":["OSSF SBOM Everywhere SIG","Prior Work","OWASP SCVS"]},"16":{"title":"Governance","titles":["OSSF SBOM Everywhere SIG"]},"17":{"title":"Basics","titles":[]},"18":{"title":"Example integrations","titles":[]},"19":{"title":"Frequently asked questions","titles":[]},"20":{"title":"Getting Started","titles":[]},"21":{"title":"Select an SBOM-Generation Phase","titles":["Getting Started"]},"22":{"title":"Choose a Generation Methodology","titles":["Getting Started"]},"23":{"title":"SBOM Generation in the Build Process","titles":["Getting Started","Choose a Generation Methodology"]},"24":{"title":"SBOM Generation with a Separate Tool","titles":["Getting Started","Choose a Generation Methodology"]},"25":{"title":"Select an SBOM Tool","titles":["Getting Started"]},"26":{"title":"Integrate into Your Build","titles":["Getting Started"]},"27":{"title":"Publish with Your Artifacts","titles":["Getting Started"]},"28":{"title":"Glossery","titles":[]},"29":{"title":"SBOM","titles":["Glossery"]},"30":{"title":"SPDX","titles":["Glossery"]},"31":{"title":"CycloneDX","titles":["Glossery"]},"32":{"title":"SWID","titles":["Glossery"]},"33":{"title":"SBOM in compliance","titles":[]},"34":{"title":"EU Cyber Resiliance Act 🇪🇺","titles":["SBOM in compliance"]},"35":{"title":"Guide of Introduction of SBOM for Software Management🇯🇵","titles":["SBOM in compliance"]},"36":{"title":"Technical Guideline TR-03183 🇩🇪","titles":["SBOM in compliance"]},"37":{"title":"SBOM startersgids 🇳🇱","titles":["SBOM in compliance"]},"38":{"title":"The Minimum Elements for a SBOM 🇺🇸","titles":["SBOM in compliance"]},"39":{"title":"White House Executive Order 14028 🇺🇸","titles":["SBOM in compliance"]},"40":{"title":"Best Practices for Naming and Directory Conventions for SBOMs (Software Bill of Materials) in Open Source Projects","titles":[]},"41":{"title":"Scope","titles":["Best Practices for Naming and Directory Conventions for SBOMs (Software Bill of Materials) in Open Source Projects"]},"42":{"title":"Consistent Naming Conventions","titles":["Best Practices for Naming and Directory Conventions for SBOMs (Software Bill of Materials) in Open Source Projects"]},"43":{"title":"Acknowledgements","titles":["Best Practices for Naming and Directory Conventions for SBOMs (Software Bill of Materials) in Open Source Projects"]},"44":{"title":"Types of Software Bill of Material (SBOM) Documents","titles":[]},"45":{"title":"Introduction","titles":["Types of Software Bill of Material (SBOM) Documents"]},"46":{"title":"Definitions and Discussions","titles":["Types of Software Bill of Material (SBOM) Documents"]},"47":{"title":"SBOM Type Definition and Composition","titles":["Types of Software Bill of Material (SBOM) Documents"]},"48":{"title":"Understanding the Benefits and Limitations of SBOM Types","titles":["Types of Software Bill of Material (SBOM) Documents"]},"49":{"title":"Conclusion","titles":["Types of Software Bill of Material (SBOM) Documents"]},"50":{"title":"SBOM working groups","titles":[]},"51":{"title":"CycloneDX","titles":["SBOM working groups"]},"52":{"title":"SPDX","titles":["SBOM working groups"]},"53":{"title":"General meeting First Thursday of the month @11am ET","titles":["SBOM working groups","SPDX"]},"54":{"title":"Tech Team meetings Thursday @12am ET","titles":["SBOM working groups","SPDX"]},"55":{"title":"Legal Team meetings Every other Thursday @12am ET","titles":["SBOM working groups","SPDX"]},"56":{"title":"Outreach Team meetings Monday @10am ET","titles":["SBOM working groups","SPDX"]},"57":{"title":"Sub-groups for specific topics","titles":["SBOM working groups","SPDX"]},"58":{"title":"Security Profile group meetings Wednesdays @2pm ET","titles":["SBOM working groups","SPDX","Sub-groups for specific topics"]},"59":{"title":"Implementers group meetings Wednesdays @11am ET","titles":["SBOM working groups","SPDX","Sub-groups for specific topics"]},"60":{"title":"AI and Data Profiles group meetings Wednesdays @3pm ET","titles":["SBOM working groups","SPDX","Sub-groups for specific topics"]},"61":{"title":"Functional Safety Profile group meetings Friday @12am ET","titles":["SBOM working groups","SPDX","Sub-groups for specific topics"]},"62":{"title":"Serialisation Focus Group meetings Thursday @11am ET","titles":["SBOM working groups","SPDX","Sub-groups for specific topics"]},"63":{"title":"Software as a Service Profile group meetings Every other Monday @1pm ET","titles":["SBOM working groups","SPDX","Sub-groups for specific topics"]},"64":{"title":"Hardware Profile group meetings Friday @9am ET","titles":["SBOM working groups","SPDX","Sub-groups for specific topics"]},"65":{"title":"Operations group meetings Friday @9:30am ET","titles":["SBOM working groups","SPDX","Sub-groups for specific topics"]},"66":{"title":"CISA","titles":["SBOM working groups"]},"67":{"title":"SBOM Community Central Meeting Monday @11am ET","titles":["SBOM working groups","CISA"]},"68":{"title":"VEX sub-group Monday @10am ET","titles":["SBOM working groups","CISA"]},"69":{"title":"SBOM adoption work stream Tuesday @12pm ET","titles":["SBOM working groups","CISA"]},"70":{"title":"SBOM tooling work stream Thursday @3pm ET","titles":["SBOM working groups","CISA"]},"71":{"title":"OpenSSF (SBOM everywhere) Every other Tuesday @11am ET","titles":["SBOM working groups"]},"72":{"title":"Anchore OSS Community Meeting Every other Thursday @11am ET","titles":["SBOM working groups"]}},"dirtCount":0,"index":[["9",{"0":{"65":1}}],["9am",{"0":{"64":1}}],["kinds",{"2":{"49":1}}],["xml",{"2":{"42":6}}],["+",{"2":{"42":1}}],["zip",{"2":{"41":1}}],["🇺🇸",{"0":{"38":1,"39":1}}],["🇳🇱",{"0":{"37":1}}],["🇩🇪",{"0":{"36":1}}],["🇪🇺",{"0":{"34":1}}],["2pm",{"0":{"58":1}}],["2",{"2":{"36":1}}],["28",{"2":{"35":1}}],["2021",{"2":{"38":1,"39":1}}],["2023",{"2":{"35":1,"36":1,"37":1}}],["2024",{"2":{"34":1}}],["jitsi",{"2":{"53":1,"54":1,"56":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1}}],["join",{"2":{"51":1}}],["josh",{"2":{"43":1}}],["json",{"2":{"42":7}}],["japanese",{"2":{"35":1}}],["japan",{"2":{"35":1}}],["just",{"2":{"17":1,"18":1,"19":1,"28":1,"48":1}}],["0",{"2":{"42":28}}],["05",{"2":{"37":1,"39":1}}],["05am",{"2":{"3":1}}],["07",{"2":{"35":1,"36":1,"37":1,"38":1}}],["03183",{"0":{"36":1},"2":{"36":2}}],["03",{"2":{"34":1}}],["quality",{"2":{"21":1,"24":1}}],["questions",{"0":{"19":1}}],["language",{"2":{"48":2}}],["larson",{"2":{"43":1}}],["lays",{"2":{"34":1}}],["loaded",{"2":{"47":1,"48":1}}],["lockheed",{"2":{"43":1}}],["lot",{"2":{"23":1}}],["legal",{"0":{"55":1}}],["legacy",{"2":{"48":1}}],["legwork",{"2":{"12":1}}],["learning",{"2":{"60":1}}],["learn",{"2":{"49":1}}],["least",{"2":{"38":1}}],["lead",{"2":{"23":1}}],["libraries",{"2":{"48":1,"54":1}}],["licensing",{"2":{"48":1}}],["licenses",{"2":{"38":1}}],["license",{"2":{"24":1,"55":3}}],["limitations",{"0":{"48":1},"2":{"46":1,"48":1}}],["like",{"2":{"22":1,"24":1,"29":1,"38":1,"48":1,"49":1}}],["likely",{"2":{"9":1,"34":1,"41":1}}],["linked",{"2":{"48":1}}],["link",{"2":{"10":1,"67":1,"68":1,"69":1,"70":1}}],["lifecycle",{"2":{"9":1,"21":1,"46":4}}],["lie",{"2":{"9":1}}],["lists",{"2":{"2":1}}],["list",{"2":{"2":1,"29":1,"42":1,"46":1,"48":1,"55":2}}],["1pm",{"0":{"63":1}}],["10am",{"0":{"56":1,"68":1}}],["12pm",{"0":{"69":1}}],["12am",{"0":{"54":1,"55":1,"61":1}}],["12",{"2":{"34":1,"36":1,"38":1,"39":1}}],["14028",{"0":{"39":1},"2":{"9":1}}],["1",{"2":{"9":1,"42":14}}],["161",{"2":{"9":1}}],["11am",{"0":{"53":1,"59":1,"62":1,"67":1,"71":1,"72":1}}],["11",{"2":{"3":1}}],["800",{"2":{"9":1}}],["yml",{"2":{"42":1}}],["yaml",{"2":{"42":2}}],["yet",{"2":{"9":1,"45":1}}],["your",{"0":{"26":1,"27":1},"2":{"2":1,"3":1}}],["you",{"2":{"1":1,"3":1,"10":1,"24":1,"44":1,"49":1,"51":1}}],["rfp",{"2":{"47":1}}],["rdf",{"2":{"42":3}}],["rpm",{"2":{"41":1}}],["run",{"2":{"48":3}}],["running",{"2":{"41":1,"47":2,"48":2,"71":1}}],["runtime",{"2":{"9":1,"41":1,"47":1,"48":5}}],["rather",{"2":{"41":1}}],["ranges",{"2":{"23":1,"24":1}}],["role",{"2":{"40":1}}],["risks",{"2":{"34":1}}],["risk",{"2":{"9":1,"12":1,"48":1}}],["reach",{"2":{"49":1,"66":1}}],["readily",{"2":{"7":1}}],["refining",{"2":{"49":1}}],["reflect",{"2":{"48":1}}],["references",{"2":{"48":1}}],["referred",{"2":{"47":2}}],["recognize",{"2":{"48":1}}],["recommended",{"2":{"36":1,"48":1}}],["recording",{"2":{"47":1}}],["record",{"2":{"29":2,"39":1,"47":1}}],["regular",{"2":{"54":1,"55":1,"56":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1}}],["regulations",{"2":{"24":2}}],["regulated",{"2":{"9":1}}],["regarding",{"2":{"34":1}}],["releasable",{"2":{"47":1}}],["releases",{"2":{"41":1}}],["release",{"2":{"41":1,"42":3,"47":1}}],["released",{"2":{"41":1}}],["relations",{"2":{"56":1}}],["relationship",{"2":{"38":1}}],["relationships",{"2":{"29":1,"39":1}}],["related",{"0":{"15":1},"2":{"2":1,"9":1,"12":1,"55":3,"66":1}}],["relying",{"2":{"24":1}}],["requirement",{"2":{"42":1}}],["requirements",{"2":{"7":2,"9":2,"24":2,"34":2,"36":2,"39":1,"41":1,"42":2}}],["requires",{"2":{"38":1,"47":1,"48":1}}],["require",{"2":{"34":1,"48":3,"49":2}}],["required",{"2":{"24":1,"49":1}}],["requiring",{"2":{"23":1}}],["replaced",{"2":{"48":1}}],["reporting",{"2":{"34":1}}],["reports",{"2":{"24":1}}],["report",{"2":{"23":1}}],["repository",{"2":{"22":1,"24":1,"52":1}}],["representation",{"2":{"48":1,"58":1}}],["represent",{"2":{"23":1}}],["reside",{"2":{"48":1}}],["resilience",{"2":{"34":2,"36":2}}],["resiliance",{"0":{"34":1}}],["responsibility",{"2":{"34":1}}],["response",{"2":{"6":2}}],["resolve",{"2":{"24":1}}],["resolving",{"2":{"23":1}}],["resources",{"2":{"12":1,"13":1,"14":1}}],["results",{"2":{"23":3,"24":2,"45":1}}],["research",{"2":{"12":1}}],["reviewed",{"2":{"44":1}}],["rev",{"2":{"9":1}}],["reveal",{"2":{"4":1}}],["remain",{"2":{"21":1}}],["remove",{"2":{"8":1}}],["remediations",{"2":{"58":1}}],["remediation",{"2":{"6":1,"48":1}}],["re",{"2":{"1":2}}],["30am",{"0":{"65":1}}],["3pm",{"0":{"60":1,"70":1}}],["36",{"2":{"15":1}}],["35",{"2":{"15":1}}],["34",{"2":{"15":1}}],["3rd",{"2":{"7":1,"47":2}}],["3",{"0":{"6":1}}],["varying",{"2":{"49":1}}],["vary",{"2":{"45":1,"46":1}}],["variety",{"2":{"47":1}}],["variables",{"2":{"23":1,"24":1}}],["various",{"2":{"2":1,"29":1,"39":1}}],["value",{"2":{"42":1,"45":1}}],["view",{"2":{"48":1}}],["virtual",{"2":{"47":1,"64":1}}],["visibility",{"2":{"40":1,"48":4}}],["vital",{"2":{"40":1}}],["via",{"2":{"4":1,"23":1,"41":1}}],["vex",{"0":{"68":1},"2":{"49":1,"68":1}}],["vendors",{"2":{"37":1,"39":1}}],["verify",{"2":{"48":1}}],["verification",{"2":{"15":3}}],["very",{"2":{"23":1,"48":1}}],["versions",{"2":{"24":1,"29":1,"48":1,"54":1}}],["version",{"2":{"23":1,"24":1,"38":1}}],["vulnerability",{"2":{"6":1,"34":1,"35":1,"37":1,"40":1,"49":1,"58":2}}],["vulnerabilities",{"2":{"6":1,"34":1,"38":1,"48":2}}],["u",{"2":{"39":1}}],["utilized",{"2":{"37":1}}],["utilization",{"2":{"9":1}}],["ultimately",{"2":{"29":1}}],["upcoming",{"2":{"66":1}}],["updates",{"2":{"53":2}}],["uploaded",{"2":{"41":2}}],["up",{"2":{"29":1}}],["ubiquity",{"2":{"9":1}}],["until",{"2":{"48":1}}],["unable",{"2":{"48":1}}],["unlikely",{"2":{"48":1}}],["unique",{"2":{"38":1}}],["universal",{"2":{"4":1}}],["understand",{"2":{"48":1}}],["understanding",{"0":{"48":1},"2":{"29":1}}],["understood",{"2":{"7":1}}],["under",{"2":{"10":1}}],["using",{"2":{"7":1,"24":1,"26":1,"37":1,"40":1,"53":1}}],["uses",{"2":{"41":1,"49":1}}],["user",{"2":{"21":1}}],["users",{"2":{"9":1}}],["useful",{"2":{"21":1,"46":1}}],["used",{"2":{"21":1,"24":1,"39":1,"42":1,"45":1,"47":1,"48":2}}],["use",{"2":{"4":1,"7":1,"9":3,"34":1,"35":1,"38":1,"41":2,"45":1,"48":2,"60":1,"62":1,"63":1}}],["us",{"0":{"0":1},"2":{"24":1,"71":1}}],["ways",{"2":{"45":1}}],["was",{"2":{"38":1,"44":1}}],["want",{"2":{"10":1}}],["wrong",{"2":{"24":1}}],["workstreams",{"2":{"52":1,"66":1}}],["working",{"0":{"50":1},"1":{"51":1,"52":1,"53":1,"54":1,"55":1,"56":1,"57":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1,"66":1,"67":1,"68":1,"69":1,"70":1,"71":1,"72":1},"2":{"66":1}}],["workflow",{"2":{"48":1}}],["work",{"0":{"11":1,"69":1,"70":1},"1":{"12":1,"13":1,"14":1,"15":1},"2":{"17":2,"18":2,"19":2,"28":2,"54":1,"55":1}}],["worry",{"2":{"9":1}}],["would",{"2":{"9":1,"34":1,"41":1,"49":1}}],["when",{"2":{"26":1,"38":1,"40":1,"48":1}}],["whether",{"2":{"22":1,"48":1}}],["where",{"2":{"9":2,"41":1}}],["while",{"2":{"21":1,"24":1,"36":1,"46":1,"48":1}}],["which",{"2":{"10":1,"21":1,"35":1,"41":1,"42":1,"47":1,"48":3}}],["white",{"0":{"6":1,"39":1},"2":{"39":1}}],["what",{"2":{"9":1,"41":1,"48":2}}],["wish",{"2":{"65":1}}],["widely",{"2":{"45":1}}],["without",{"2":{"24":1,"42":1,"48":2}}],["with",{"0":{"24":1,"27":1},"2":{"9":1,"21":1,"23":1,"24":1,"27":1,"29":1,"35":1,"36":1,"37":2,"38":2,"42":1,"45":1,"47":2,"49":1,"51":1,"53":1,"65":1}}],["within",{"2":{"4":1,"24":1,"29":1,"36":1,"46":1,"65":1}}],["will",{"2":{"9":1,"36":1,"38":1,"41":2}}],["weekly",{"2":{"66":1}}],["wednesdays",{"0":{"58":1,"59":1,"60":1}}],["well",{"2":{"47":1}}],["we",{"2":{"1":1,"2":1,"8":2,"9":3}}],["blocks",{"2":{"64":1}}],["bressers",{"2":{"43":1}}],["broad",{"2":{"38":1}}],["biebel",{"2":{"43":1}}],["binaries",{"2":{"42":1}}],["binary",{"2":{"9":1}}],["bill",{"0":{"40":1,"44":1},"1":{"41":1,"42":1,"43":1,"45":1,"46":1,"47":1,"48":1,"49":1},"2":{"12":1,"29":1,"34":1,"36":1,"39":1,"40":1,"45":1}}],["basic",{"2":{"38":1}}],["basics",{"0":{"17":1}}],["basis",{"2":{"36":1,"66":1}}],["based",{"2":{"21":1,"23":1}}],["baseline",{"2":{"9":1}}],["barriers",{"2":{"8":1}}],["business",{"2":{"65":1}}],["built",{"2":{"26":1,"41":1,"42":1,"47":1}}],["building",{"2":{"39":1,"47":1}}],["build",{"0":{"23":1,"26":1},"2":{"7":1,"9":1,"21":3,"22":4,"23":6,"24":3,"38":1,"41":3,"47":6,"48":8}}],["but",{"2":{"23":1,"24":1,"36":1,"41":2}}],["burden",{"2":{"9":1}}],["by",{"2":{"8":1,"21":1,"24":1,"27":1,"36":1,"41":3,"44":1,"47":2,"48":3}}],["boards",{"2":{"64":1}}],["bolster",{"2":{"35":1}}],["both",{"2":{"24":1,"36":1}}],["bom",{"0":{"15":1}}],["box",{"2":{"4":1}}],["born",{"2":{"4":1}}],["behavior",{"2":{"47":1}}],["being",{"2":{"41":1,"42":1}}],["benefits",{"0":{"48":1},"2":{"35":1,"46":1,"48":1}}],["beneficial",{"2":{"21":1}}],["because",{"2":{"23":1}}],["best",{"0":{"40":1},"1":{"41":1,"42":1,"43":1},"2":{"23":2,"24":1,"40":1,"41":1,"51":1}}],["before",{"2":{"21":1}}],["been",{"2":{"12":1,"47":2,"48":1}}],["better",{"2":{"10":1,"29":1,"42":1,"60":1,"61":1,"63":1}}],["beyond",{"2":{"4":1}}],["be",{"2":{"3":1,"9":4,"10":1,"21":2,"22":3,"23":1,"24":8,"27":2,"36":1,"37":1,"41":3,"42":4,"45":1,"46":3,"47":3,"48":6,"49":1,"66":1}}],["npm",{"2":{"41":1}}],["ncsc",{"2":{"37":1}}],["national",{"2":{"37":1}}],["naming",{"0":{"40":1,"42":1},"1":{"41":1,"42":1,"43":1},"2":{"27":1,"40":1}}],["name",{"2":{"3":1,"38":1}}],["no",{"2":{"24":1,"42":1}}],["none",{"2":{"23":1}}],["notes",{"2":{"59":1,"66":1,"67":1,"68":1,"69":1,"70":1,"71":1,"72":1}}],["not",{"2":{"9":1,"24":1,"26":1,"36":1,"41":5,"46":1,"47":1,"48":4}}],["ntia",{"0":{"12":1},"2":{"12":2,"24":1,"38":1}}],["nist",{"2":{"9":1}}],["never",{"2":{"48":1}}],["nevertheless",{"2":{"24":1}}],["new",{"2":{"39":1,"47":1,"54":1}}],["necessitating",{"2":{"23":1}}],["need",{"2":{"48":1}}],["needs",{"2":{"9":1}}],["needed",{"2":{"7":1}}],["next",{"2":{"3":1}}],["physical",{"2":{"64":1}}],["phases",{"2":{"21":1,"46":1}}],["phase",{"0":{"21":1},"2":{"21":1,"46":2}}],["people",{"2":{"53":1}}],["period",{"2":{"48":1}}],["python",{"2":{"43":1}}],["pypi",{"2":{"41":1}}],["potentially",{"2":{"47":1,"48":1}}],["point",{"2":{"9":1,"49":1}}],["policy",{"2":{"9":1}}],["posture",{"2":{"8":1}}],["public",{"2":{"56":1}}],["published",{"2":{"27":1,"35":1,"37":1,"44":1,"52":1}}],["publish",{"0":{"27":1},"2":{"27":1}}],["purchase",{"2":{"48":1}}],["purl",{"2":{"38":1}}],["purposes",{"2":{"9":2}}],["put",{"2":{"3":1}}],["page",{"2":{"51":1}}],["package",{"2":{"38":1,"47":1,"65":1}}],["packages",{"2":{"6":1,"47":1}}],["participate",{"2":{"51":1}}],["parts",{"2":{"48":1}}],["partnership",{"2":{"12":1}}],["part",{"2":{"9":1,"22":1,"36":1,"41":1,"42":1,"47":2}}],["party",{"2":{"7":1,"47":2}}],["patching",{"2":{"6":1}}],["preferences",{"2":{"62":1}}],["preferred",{"2":{"21":1}}],["precisely",{"2":{"48":1}}],["preclude",{"2":{"41":1}}],["presentations",{"2":{"53":1}}],["present",{"2":{"47":3}}],["presented",{"2":{"45":1,"46":1}}],["prescribe",{"2":{"41":1}}],["pre",{"2":{"42":1}}],["preventing",{"2":{"6":1}}],["prior",{"0":{"11":1},"1":{"12":1,"13":1,"14":1,"15":1}}],["practices",{"0":{"40":1},"1":{"41":1,"42":1,"43":1},"2":{"9":1,"34":1,"40":1,"41":1}}],["profiles",{"0":{"60":1}}],["profile",{"0":{"58":1,"61":1,"63":1,"64":1}}],["prone",{"2":{"48":1}}],["provenance",{"2":{"42":1}}],["providing",{"2":{"21":1,"40":1}}],["provided",{"2":{"27":2,"51":1}}],["provides",{"2":{"21":1,"36":1,"47":1,"48":4}}],["provide",{"2":{"10":1,"21":1,"26":1,"36":1,"45":1,"48":1}}],["prospective",{"2":{"41":1}}],["promote",{"2":{"35":1}}],["protect",{"2":{"34":1}}],["proposed",{"2":{"34":1}}],["project",{"2":{"21":2,"22":1,"23":3,"24":2,"26":3,"41":1}}],["projects",{"0":{"40":1},"1":{"41":1,"42":1,"43":1},"2":{"21":1,"24":1,"41":1,"55":1,"56":1,"72":1}}],["progress",{"2":{"17":2,"18":2,"19":2,"28":2,"49":1}}],["productivity",{"2":{"35":1}}],["production",{"2":{"6":1}}],["product",{"2":{"29":2,"45":1,"47":1,"48":2}}],["products",{"2":{"26":1,"36":1}}],["produces",{"2":{"26":1}}],["produce",{"2":{"22":1,"23":2,"24":1}}],["produced",{"2":{"21":1}}],["producers",{"2":{"8":1,"9":2}}],["processes",{"2":{"37":1,"48":2}}],["process",{"0":{"23":1},"2":{"6":1,"22":1,"23":3,"24":1,"47":3,"48":3}}],["plus",{"2":{"24":1}}],["plugins",{"2":{"23":5}}],["plugin",{"2":{"22":1,"48":1}}],["platform",{"2":{"48":1}}],["platforms",{"2":{"26":1}}],["plays",{"2":{"40":1}}],["place",{"2":{"6":1}}],["plans",{"2":{"61":1}}],["plan",{"0":{"7":1},"2":{"4":1,"8":1,"12":1,"71":1}}],["please",{"2":{"3":1,"10":1}}],["fpgas",{"2":{"64":1}}],["factors",{"2":{"48":1}}],["facilitate",{"2":{"48":1}}],["flat",{"2":{"42":1}}],["functional",{"0":{"61":1},"2":{"61":1}}],["functionality",{"2":{"48":1}}],["functions",{"2":{"29":1}}],["further",{"2":{"27":1,"51":1,"66":1,"71":1}}],["future",{"2":{"9":1,"36":1}}],["few",{"2":{"23":1}}],["federal",{"2":{"9":2}}],["feel",{"2":{"3":1}}],["firmware",{"2":{"48":1,"64":1}}],["first",{"0":{"53":1},"2":{"6":1}}],["file",{"2":{"42":2}}],["filename",{"2":{"42":4}}],["files",{"2":{"42":3,"47":2,"55":1}}],["fields",{"2":{"38":1}}],["final",{"2":{"29":1,"47":1}}],["find",{"2":{"24":1,"44":1,"48":1}}],["findings",{"2":{"23":1}}],["finding",{"2":{"6":1}}],["fit",{"2":{"9":1}}],["fixes",{"2":{"6":1}}],["fixing",{"2":{"6":1}}],["friday",{"0":{"61":1,"64":1,"65":1}}],["friction",{"2":{"7":1}}],["frameworks",{"2":{"37":1}}],["frequently",{"0":{"19":1}}],["free",{"2":{"3":1,"7":1}}],["from",{"0":{"6":1},"2":{"4":2,"24":2,"27":1,"42":2,"45":1,"47":5,"48":1,"53":1,"71":1}}],["fourth",{"2":{"55":1}}],["foundation",{"2":{"43":1}}],["found",{"2":{"3":1,"10":1,"48":1,"66":1}}],["follows",{"2":{"42":1}}],["following",{"2":{"10":1,"38":1,"42":1,"43":1,"46":1,"52":1}}],["focuses",{"2":{"71":1}}],["focused",{"2":{"65":1}}],["focusing",{"2":{"8":1}}],["focus",{"0":{"62":1},"2":{"6":1}}],["forms",{"2":{"45":1}}],["formerly",{"2":{"43":1}}],["formal",{"2":{"39":1}}],["format",{"2":{"34":1,"42":4}}],["formats",{"2":{"9":3,"42":2,"62":1}}],["formatting",{"0":{"9":1}}],["formation",{"2":{"4":1}}],["form",{"2":{"34":1}}],["for",{"0":{"7":1,"35":1,"38":1,"40":2,"57":1},"1":{"41":2,"42":2,"43":2,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1},"2":{"2":1,"4":1,"6":2,"9":6,"21":1,"22":1,"23":1,"24":1,"26":3,"34":1,"35":1,"36":3,"37":2,"38":3,"39":1,"40":1,"41":4,"42":5,"45":2,"47":2,"48":3,"49":2,"55":1,"59":1,"62":2,"65":1,"66":1,"72":1}}],["drive",{"2":{"71":1}}],["drafting",{"2":{"54":1}}],["dhs",{"2":{"49":1,"66":1}}],["dan",{"2":{"43":1}}],["data",{"0":{"60":1},"2":{"24":1,"38":2,"45":2,"46":1,"47":2,"48":1}}],["date",{"2":{"12":1,"38":1}}],["due",{"2":{"48":1}}],["dunbar",{"2":{"43":1}}],["dutch",{"2":{"37":1}}],["during",{"2":{"22":1,"41":1,"48":1}}],["dynamically",{"2":{"47":1,"48":2}}],["dynamic",{"2":{"23":1,"47":1,"48":1}}],["difficult",{"2":{"48":2}}],["different",{"2":{"21":1,"23":1,"26":1,"45":3,"46":1,"49":2}}],["directories",{"2":{"42":1}}],["directory",{"0":{"40":1},"1":{"41":1,"42":1,"43":1},"2":{"40":1,"42":1}}],["directly",{"2":{"23":2,"41":1,"47":1}}],["dives",{"2":{"37":1}}],["diverging",{"2":{"26":1}}],["disparate",{"2":{"45":1}}],["distributions",{"2":{"41":1}}],["distributing",{"2":{"6":1,"41":2}}],["distribute",{"2":{"41":1}}],["distributed",{"2":{"41":1,"42":1}}],["discuss",{"2":{"54":1,"55":1,"56":1,"58":1,"60":1,"61":1,"62":1,"63":1,"64":1}}],["discussions",{"0":{"46":1}}],["discussion",{"2":{"2":1,"36":1}}],["discretionary",{"2":{"9":1}}],["discovery",{"2":{"6":1}}],["download",{"2":{"41":1}}],["done",{"2":{"12":1}}],["don",{"2":{"9":1}}],["does",{"2":{"9":2,"41":1,"48":1}}],["do",{"2":{"9":4}}],["documentation",{"2":{"54":1}}],["documents",{"0":{"44":1},"1":{"45":1,"46":1,"47":1,"48":1,"49":1},"2":{"42":2}}],["documented",{"2":{"7":1}}],["document",{"2":{"3":1,"10":1,"27":1,"41":4,"44":3,"45":2,"49":1}}],["determining",{"2":{"62":1}}],["detailed",{"2":{"48":2}}],["detailing",{"2":{"29":1}}],["detail",{"2":{"21":1,"48":1}}],["details",{"2":{"9":1,"21":1,"35":1,"39":1}}],["design",{"2":{"47":3,"48":1}}],["desired",{"2":{"42":1}}],["descriptions",{"2":{"54":1,"55":1,"56":1,"65":1}}],["description",{"2":{"47":1,"53":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1}}],["described",{"2":{"42":1}}],["describing",{"2":{"41":1}}],["deb",{"2":{"41":1}}],["developer",{"2":{"48":1}}],["develop",{"2":{"37":1}}],["development",{"2":{"21":1,"34":1,"35":1,"47":1,"48":1}}],["derived",{"2":{"24":1,"47":1}}],["decompose",{"2":{"48":1}}],["decided",{"2":{"22":1}}],["decision",{"2":{"9":1}}],["declassification",{"2":{"12":1}}],["delivery",{"2":{"9":1}}],["depend",{"2":{"48":1}}],["dependent",{"2":{"48":1}}],["dependency",{"2":{"23":1,"38":1,"40":1,"48":1}}],["dependencies",{"2":{"23":1,"24":1,"26":1,"47":2,"48":3,"49":1}}],["depending",{"2":{"9":1,"21":1,"24":1,"46":1,"48":2}}],["deployed",{"2":{"47":1,"48":2}}],["deployment",{"2":{"41":1,"47":1,"48":1}}],["deploy",{"2":{"9":1,"48":1}}],["definitions",{"0":{"46":1},"2":{"49":1}}],["definition",{"0":{"47":1},"2":{"45":1,"47":1}}],["defining",{"2":{"9":1}}],["define",{"2":{"9":1}}],["defines",{"2":{"8":1,"39":1,"48":1}}],["defined",{"0":{"7":1},"2":{"9":1,"41":1,"42":1}}],["defects",{"2":{"6":2}}],["ip",{"2":{"64":1}}],["ics",{"2":{"55":1}}],["i",{"2":{"49":1}}],["identify",{"2":{"48":1}}],["identifiers",{"2":{"38":1,"58":1}}],["identifies",{"2":{"29":1}}],["identification",{"2":{"34":1,"38":1}}],["images",{"2":{"47":1}}],["importance",{"2":{"39":1}}],["important",{"2":{"26":2}}],["imposed",{"2":{"36":1}}],["improved",{"2":{"29":1}}],["improve",{"2":{"8":1,"35":1}}],["improving",{"2":{"6":2,"71":1}}],["implementers",{"0":{"59":1}}],["implemented",{"2":{"7":1}}],["implementation",{"2":{"7":1}}],["implementing",{"2":{"6":1,"35":1,"37":1,"59":1}}],["ian",{"2":{"43":1}}],["ie",{"2":{"41":1}}],["it",{"2":{"21":2,"22":1,"24":1,"26":2,"27":2,"29":1,"36":2,"37":1,"38":1,"39":1,"41":1,"71":1}}],["its",{"2":{"21":1,"23":1,"26":1,"27":1,"47":1}}],["items",{"2":{"3":2}}],["if",{"2":{"10":1,"22":1,"23":1,"24":1,"26":2,"42":1,"48":1,"49":1}}],["io",{"2":{"10":1}}],["innovation",{"2":{"49":1}}],["inaccessible",{"2":{"48":1}}],["initiative",{"2":{"35":1}}],["initial",{"2":{"4":1,"47":1}}],["increased",{"2":{"48":1}}],["increases",{"2":{"48":1}}],["incompatible",{"2":{"48":1}}],["incorrect",{"2":{"24":1}}],["included",{"2":{"47":2,"48":2}}],["include",{"2":{"41":1,"48":2}}],["includes",{"2":{"34":1,"39":1}}],["including",{"2":{"34":1,"48":2,"58":1}}],["ingredients",{"2":{"29":1}}],["instrumented",{"2":{"47":1}}],["instrumenting",{"2":{"47":1}}],["install",{"2":{"48":1}}],["installed",{"2":{"47":1,"48":1}}],["installation",{"2":{"41":1}}],["instances",{"2":{"41":1}}],["instead",{"2":{"41":1}}],["inseparable",{"2":{"27":1}}],["inside",{"2":{"27":1}}],["insights",{"2":{"21":1,"37":1}}],["introduction",{"0":{"35":1,"45":1}}],["into",{"0":{"26":1},"2":{"21":2,"23":2,"26":1,"37":1,"40":1,"48":2}}],["intelligence",{"2":{"60":1}}],["intended",{"2":{"46":1,"47":1}}],["integrated",{"2":{"47":1}}],["integrate",{"0":{"26":1},"2":{"24":2}}],["integration",{"2":{"23":1,"24":1,"48":1}}],["integrations",{"0":{"18":1}}],["integrating",{"2":{"23":2,"26":1}}],["integral",{"2":{"4":1}}],["interest",{"2":{"71":1}}],["interacting",{"2":{"47":1}}],["intermediate",{"2":{"47":1}}],["interoperability",{"2":{"40":1}}],["interrelated",{"2":{"38":1}}],["internationally",{"2":{"36":1}}],["internal",{"2":{"9":1}}],["interpretation",{"2":{"9":1}}],["interchangeable",{"2":{"9":1}}],["information",{"2":{"12":1,"23":1,"24":1,"38":1,"41":2,"45":2,"47":1,"48":3,"51":1,"65":1,"66":1,"71":1}}],["indirect",{"2":{"48":1}}],["individual",{"2":{"9":1}}],["industries",{"2":{"35":1}}],["industry",{"2":{"9":1,"35":1,"45":1,"46":1}}],["in",{"0":{"7":1,"23":1,"33":1,"40":1},"1":{"34":1,"35":1,"36":1,"37":1,"38":1,"39":1,"41":1,"42":1,"43":1},"2":{"3":1,"6":2,"7":1,"9":4,"17":2,"18":2,"19":2,"21":3,"23":1,"24":3,"28":2,"29":1,"34":1,"35":1,"37":1,"39":1,"40":1,"41":3,"45":2,"46":1,"47":5,"48":5,"49":1,"51":1,"52":1,"58":1,"64":1,"71":1}}],["invitation",{"2":{"70":1}}],["invites",{"2":{"55":1}}],["invite",{"2":{"3":1,"66":1}}],["inventory",{"2":{"38":1,"47":1}}],["involved",{"0":{"2":1},"1":{"3":1},"2":{"10":1,"37":1}}],["issue",{"2":{"26":1}}],["is",{"2":{"3":1,"4":2,"7":1,"9":1,"17":1,"18":1,"19":1,"21":3,"22":1,"23":2,"24":1,"26":4,"27":1,"28":1,"29":1,"36":1,"41":7,"42":4,"45":1,"46":1,"47":1,"48":5,"51":1,"72":1}}],["et",{"0":{"53":1,"54":1,"55":1,"56":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1,"67":1,"68":1,"69":1,"70":1,"71":1,"72":1}}],["etc",{"2":{"41":1,"53":1}}],["events",{"2":{"66":2}}],["every",{"0":{"55":1,"63":1,"71":1,"72":1},"2":{"3":1,"9":1}}],["everywhere",{"0":{"0":1,"1":1,"71":1},"1":{"2":1,"3":1,"4":1,"5":1,"6":1,"7":1,"8":1,"9":1,"10":1,"11":1,"12":1,"13":1,"14":1,"15":1,"16":1},"2":{"1":1,"4":1,"8":1,"9":1,"10":1,"71":2}}],["evolve",{"2":{"49":1}}],["errors",{"2":{"48":1}}],["ephemeral",{"2":{"47":1}}],["e",{"2":{"47":2,"49":1,"53":1}}],["edu",{"2":{"43":1}}],["education",{"2":{"7":1}}],["effective",{"2":{"65":1}}],["effectively",{"2":{"37":1}}],["efforts",{"2":{"56":1}}],["efficient",{"2":{"40":1}}],["emphasizes",{"2":{"39":1}}],["essential",{"2":{"36":1}}],["establish",{"2":{"9":1,"37":1}}],["establishing",{"2":{"9":1}}],["est",{"2":{"3":1}}],["economy",{"2":{"35":1}}],["ecosystems",{"2":{"41":2}}],["ecosystem",{"2":{"6":1,"8":1,"41":2,"48":2}}],["european",{"2":{"34":2}}],["eu",{"0":{"34":1},"2":{"24":2,"36":2}}],["easy",{"2":{"24":1}}],["easier",{"2":{"24":2}}],["each",{"2":{"23":1,"26":2,"38":1,"45":1,"46":1,"53":1}}],["elements",{"0":{"38":1},"2":{"12":1,"24":1,"38":3}}],["exercised",{"2":{"48":1}}],["executed",{"2":{"47":1,"48":1}}],["execution",{"2":{"47":1}}],["executive",{"0":{"39":1},"2":{"9":1,"39":2}}],["executables",{"2":{"47":1}}],["executable",{"2":{"47":1}}],["extend",{"2":{"64":1}}],["extensions",{"2":{"42":2}}],["extension",{"2":{"42":2}}],["external",{"2":{"47":1,"48":1}}],["examination",{"2":{"47":1}}],["example",{"0":{"18":1},"2":{"26":1}}],["exist",{"2":{"47":1}}],["exists",{"2":{"9":1}}],["exchange2",{"2":{"49":1}}],["exchange",{"2":{"38":1}}],["expected",{"2":{"41":1}}],["expectations",{"2":{"9":1}}],["exploitability",{"2":{"49":1}}],["explores",{"2":{"37":1}}],["exploration",{"2":{"4":1}}],["explained",{"2":{"21":1}}],["enumerating",{"2":{"62":1}}],["environments",{"2":{"64":1}}],["environment",{"2":{"47":3,"48":3}}],["enhancing",{"2":{"39":1}}],["enhance",{"2":{"35":1}}],["enable",{"2":{"38":1}}],["enabling",{"2":{"29":1,"48":1}}],["end",{"2":{"9":1}}],["enforcement",{"2":{"9":1}}],["encourage",{"2":{"9":2}}],["ensures",{"2":{"40":1}}],["ensure",{"2":{"9":1,"26":1}}],["entire",{"2":{"8":1}}],["much",{"2":{"48":1}}],["multiple",{"2":{"45":1,"46":1}}],["must",{"2":{"9":1,"38":1}}],["meant",{"2":{"49":1}}],["means",{"2":{"34":1}}],["members",{"2":{"43":1}}],["methods",{"2":{"49":1}}],["methodology",{"0":{"22":1},"1":{"23":1,"24":1}}],["metadata",{"2":{"41":1,"58":1}}],["meti",{"2":{"35":2}}],["merging",{"2":{"23":1,"24":1}}],["meet",{"2":{"7":1,"24":1,"42":1,"59":1,"66":1}}],["meetings",{"0":{"54":1,"55":1,"56":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1}}],["meeting",{"0":{"3":1,"6":1,"53":1,"67":1,"72":1},"2":{"3":1,"53":2,"54":3,"55":2,"56":3,"58":3,"59":3,"60":3,"61":3,"62":2,"63":2,"64":3,"65":3,"66":1,"67":1,"68":1,"69":1,"70":1,"71":1,"72":2}}],["microsoft",{"2":{"70":1}}],["mitigations",{"2":{"58":1}}],["missed",{"2":{"48":1}}],["missing",{"2":{"24":2}}],["might",{"2":{"21":1,"23":3,"24":5,"48":1}}],["ministry",{"2":{"35":1}}],["minimum",{"0":{"38":1},"2":{"9":2,"24":1,"38":3,"45":2}}],["minutes",{"2":{"3":1,"53":1,"54":1,"55":1,"56":1,"58":1,"59":1,"60":1,"61":1,"64":1,"65":1}}],["md",{"2":{"16":1}}],["monday",{"0":{"56":1,"63":1,"67":1,"68":1}}],["month",{"0":{"53":1}}],["monorepository",{"2":{"26":1}}],["more",{"2":{"21":1,"24":1,"48":1,"49":2}}],["model",{"0":{"15":1}}],["most",{"2":{"12":1,"21":1,"23":2}}],["mobilization",{"0":{"7":1},"2":{"4":1,"8":1,"71":1}}],["motivation",{"0":{"4":1},"2":{"4":1}}],["machine",{"2":{"47":1,"60":1}}],["maximilian",{"2":{"43":1}}],["martin",{"2":{"43":1}}],["marius",{"2":{"43":1}}],["made",{"2":{"41":1}}],["maven",{"2":{"41":2}}],["make",{"2":{"27":1,"29":1}}],["manual",{"2":{"47":1}}],["manufacturers",{"2":{"36":2}}],["mandatory",{"2":{"42":1}}],["managing",{"2":{"40":1}}],["managers",{"2":{"37":1}}],["management🇯🇵",{"0":{"35":1}}],["management",{"2":{"9":1,"29":1,"34":1,"35":1,"37":1,"38":1,"40":1,"65":1}}],["manage",{"2":{"2":1,"37":1}}],["manner",{"2":{"24":1}}],["may",{"2":{"23":1,"41":1,"45":4,"46":3,"47":5,"48":14,"49":5,"65":1}}],["material",{"0":{"44":1},"1":{"45":1,"46":1,"47":1,"48":1,"49":1},"2":{"45":1}}],["materials",{"0":{"40":1},"1":{"41":1,"42":1,"43":1},"2":{"12":1,"29":1,"34":1,"36":1,"39":1,"40":1}}],["maturity",{"0":{"15":1}}],["maintains",{"2":{"10":1}}],["maintainers",{"2":{"8":1,"9":1,"41":1}}],["mailing",{"2":{"2":2}}],["cd",{"2":{"48":1}}],["cdx",{"2":{"42":3}}],["cdxgen",{"2":{"24":1}}],["ci",{"2":{"48":1}}],["cisa",{"0":{"13":1,"66":1},"1":{"67":1,"68":1,"69":1,"70":1},"2":{"13":1,"44":1,"49":1,"66":3,"68":1,"69":1,"70":1}}],["clarifying",{"2":{"49":1}}],["clarifications",{"2":{"47":1}}],["clearances",{"2":{"12":1}}],["clearly",{"2":{"7":1,"9":1}}],["curated",{"2":{"41":1}}],["current",{"2":{"7":1,"56":1}}],["cpe",{"2":{"38":1}}],["central",{"0":{"67":1}}],["center",{"2":{"37":1}}],["certification",{"2":{"34":1}}],["creators",{"2":{"59":1}}],["creation",{"2":{"48":1}}],["creating",{"2":{"36":1,"40":1}}],["created",{"2":{"47":1}}],["create",{"2":{"9":1,"37":1,"45":1,"47":1,"49":2}}],["cra",{"2":{"24":1,"34":1,"36":1}}],["cyber",{"0":{"34":1},"2":{"34":1,"36":2,"37":1}}],["cybersecurity",{"2":{"9":1,"34":2,"35":1,"37":1,"39":1}}],["cyclonedx",{"0":{"31":1,"51":1},"2":{"9":1,"23":1,"24":1,"38":1,"40":1,"42":4,"51":3}}],["choice",{"2":{"23":1}}],["choose",{"0":{"22":1},"1":{"23":1,"24":1}}],["challenging",{"2":{"23":1}}],["changing",{"2":{"48":1}}],["change",{"2":{"48":1}}],["changes",{"2":{"23":1}}],["channel",{"2":{"2":1}}],["charter",{"2":{"16":1}}],["chain",{"2":{"9":1,"12":1,"29":1,"34":1,"39":2,"40":1}}],["check",{"2":{"4":1,"25":1}}],["cores",{"2":{"64":1}}],["correct",{"2":{"48":2}}],["corresponding",{"2":{"23":1,"42":2}}],["coordinate",{"2":{"56":1}}],["collected",{"2":{"45":1}}],["could",{"2":{"41":1}}],["covers",{"2":{"41":1}}],["cover",{"2":{"23":1,"24":1}}],["conclusion",{"0":{"49":1}}],["concerns",{"2":{"35":1}}],["concept",{"2":{"17":1,"18":1,"19":1,"28":1,"47":1}}],["connections",{"2":{"48":1}}],["confidence",{"2":{"48":1}}],["configurations",{"2":{"48":1}}],["configuration",{"2":{"47":2}}],["continuous",{"2":{"48":2}}],["contribute",{"2":{"43":1}}],["content",{"2":{"45":1}}],["contents",{"2":{"41":1}}],["contexts",{"2":{"47":2}}],["context",{"2":{"41":1,"48":1}}],["containers",{"2":{"47":1}}],["contain",{"2":{"41":1,"45":1,"48":1}}],["containing",{"2":{"39":1}}],["conventions",{"0":{"40":1,"42":1},"1":{"41":1,"42":1,"43":1},"2":{"40":1}}],["conversations",{"2":{"9":1}}],["congress",{"2":{"12":1}}],["consulting",{"2":{"43":1}}],["consumer",{"2":{"21":1}}],["consumers",{"2":{"8":1,"9":2,"41":1}}],["consumption",{"2":{"8":1,"9":3}}],["consist",{"2":{"47":1}}],["consistent",{"0":{"42":1}}],["considered",{"2":{"27":1,"42":2}}],["considerations",{"2":{"12":1,"38":1}}],["constraints",{"2":{"23":1}}],["constructs",{"2":{"4":1}}],["consensus",{"2":{"4":1}}],["code",{"2":{"6":1,"41":1,"48":3}}],["combines",{"2":{"47":1}}],["combine",{"2":{"45":1}}],["common",{"2":{"45":1}}],["community",{"0":{"67":1,"72":1},"2":{"3":1,"4":1,"43":1,"51":1,"71":1,"72":2}}],["communications",{"2":{"2":1,"12":1}}],["compare",{"2":{"59":1}}],["complete",{"2":{"48":1}}],["completeness",{"2":{"48":1}}],["complexities",{"2":{"23":1}}],["complexity",{"2":{"23":2}}],["comply",{"2":{"38":1}}],["complicate",{"2":{"23":1}}],["compliance",{"0":{"33":1},"1":{"34":1,"35":1,"36":1,"37":1,"38":1,"39":1},"2":{"4":1,"9":1}}],["compiled",{"2":{"21":1,"48":1}}],["composed",{"2":{"23":1}}],["composition",{"0":{"47":1},"2":{"21":2,"47":1}}],["components",{"2":{"29":2,"39":1,"47":4,"48":11}}],["component",{"2":{"15":3,"38":2,"48":1}}],["comprehensive",{"2":{"12":1}}],["com",{"2":{"9":1}}],["came",{"2":{"71":1}}],["call",{"2":{"47":1,"53":1}}],["calendar",{"2":{"3":1,"66":2,"71":1,"72":1}}],["capture",{"2":{"47":1,"48":1}}],["captured",{"2":{"41":1}}],["capabilities",{"2":{"10":1}}],["catalog",{"0":{"10":1},"2":{"10":1,"25":1}}],["case",{"2":{"9":1,"41":1}}],["cases",{"2":{"4":1,"7":1,"9":1,"38":1,"45":1,"60":1,"62":1,"63":1}}],["can",{"2":{"3":1,"8":2,"10":1,"21":3,"23":5,"24":6,"27":1,"37":2,"44":1,"45":1,"48":5,"60":1,"61":1,"63":1,"64":1,"66":1}}],["ai",{"0":{"60":1}}],["aims",{"2":{"35":1,"36":1}}],["among",{"2":{"49":1}}],["amp",{"2":{"6":1,"40":1}}],["ahead",{"2":{"48":1}}],["approaches",{"2":{"49":1}}],["approximations",{"2":{"48":1}}],["approved",{"2":{"48":1}}],["appserver",{"2":{"48":1}}],["appelquist",{"2":{"43":1}}],["appending",{"2":{"42":1}}],["application",{"2":{"48":1}}],["applied",{"2":{"22":1,"24":1}}],["apply",{"2":{"23":1}}],["after",{"2":{"41":1,"47":1,"48":1}}],["affect",{"2":{"21":1}}],["audience",{"2":{"41":1}}],["automation",{"2":{"38":1}}],["author",{"2":{"38":1}}],["agreements",{"2":{"37":1}}],["agendas",{"2":{"53":1,"54":1,"55":1,"56":1,"58":1,"59":1,"60":1,"61":1,"64":1,"65":1}}],["agenda",{"2":{"3":1}}],["always",{"2":{"42":1}}],["all",{"2":{"41":1,"66":1}}],["alongside",{"2":{"41":1}}],["along",{"2":{"27":1,"38":1,"45":1}}],["also",{"2":{"21":1,"23":1,"24":1,"27":1,"37":1,"41":2,"42":1,"46":1,"47":2,"71":1}}],["able",{"2":{"24":1}}],["about",{"0":{"0":1},"2":{"9":5,"41":2,"48":1,"49":1,"71":1}}],["artificial",{"2":{"60":1}}],["artifact",{"2":{"21":2,"26":2,"27":2,"41":1,"42":16,"47":4,"48":2}}],["artifacts",{"0":{"27":1},"2":{"9":1,"27":1,"41":4,"42":1,"45":1,"47":4,"48":1,"65":1}}],["around",{"2":{"49":1}}],["archives",{"2":{"41":1}}],["archive",{"2":{"41":1}}],["areas",{"2":{"38":1}}],["are",{"2":{"7":2,"9":3,"21":1,"24":3,"40":1,"41":3,"42":4,"48":3,"49":1,"53":1}}],["analyzed",{"2":{"47":1,"48":2}}],["analysis",{"2":{"9":1,"21":1,"47":5}}],["anchore",{"0":{"72":1},"2":{"43":1,"72":1}}],["anchored",{"2":{"34":1}}],["any",{"2":{"38":1}}],["an",{"0":{"21":1,"25":1},"2":{"10":1,"21":4,"24":1,"26":2,"27":3,"29":1,"36":1,"38":3,"39":1,"41":2,"45":2,"46":1,"47":4,"48":2,"65":1,"66":1}}],["and",{"0":{"40":1,"46":1,"47":1,"48":1,"60":1},"1":{"41":1,"42":1,"43":1},"2":{"4":1,"6":4,"7":3,"8":3,"9":11,"10":1,"12":2,"16":1,"17":1,"18":1,"19":1,"23":3,"24":6,"28":1,"29":3,"34":6,"35":3,"36":2,"37":3,"38":3,"39":1,"40":4,"41":4,"42":6,"44":1,"46":4,"47":7,"48":7,"49":4,"53":2,"54":3,"55":2,"56":2,"58":2,"59":2,"60":3,"61":2,"62":1,"63":1,"64":2,"65":1,"66":1,"71":1,"72":1}}],["attestations",{"2":{"42":1}}],["attestation",{"2":{"9":2}}],["at",{"2":{"9":2,"38":1,"48":2}}],["awareness",{"2":{"7":1}}],["acquisition",{"2":{"48":1}}],["across",{"2":{"46":1}}],["acknowledgements",{"0":{"43":1}}],["active",{"2":{"48":2}}],["activities",{"2":{"2":1,"16":1}}],["actions",{"2":{"34":1}}],["act",{"0":{"34":1},"2":{"34":2,"36":1}}],["accompanying",{"2":{"41":1}}],["accountability",{"2":{"9":1}}],["accurately",{"2":{"48":1}}],["accurate",{"2":{"24":1,"40":1}}],["access",{"2":{"21":1,"36":1,"48":2}}],["accessible",{"2":{"7":1}}],["aspects",{"2":{"55":1}}],["associate",{"2":{"65":1}}],["associated",{"2":{"49":1}}],["assembly",{"2":{"47":1}}],["assist",{"2":{"37":1}}],["assuming",{"2":{"22":1}}],["asked",{"0":{"19":1}}],["as",{"0":{"7":1,"63":1},"2":{"8":1,"23":1,"36":1,"38":1,"39":1,"40":1,"41":5,"42":2,"47":7,"48":5,"49":2}}],["adopting",{"2":{"49":1}}],["adoption",{"0":{"69":1},"2":{"4":1,"8":1,"9":1,"69":1,"71":1}}],["advance",{"2":{"36":1}}],["advocacy",{"2":{"8":1,"9":1}}],["addition",{"2":{"49":1}}],["additional",{"2":{"23":2,"37":1,"48":1,"49":1,"65":1}}],["additionally",{"2":{"23":1}}],["adding",{"2":{"23":1}}],["added",{"2":{"22":1}}],["add",{"2":{"3":2,"23":1}}],["available",{"2":{"3":1,"10":1,"41":1,"42":2,"46":2,"48":2}}],["a",{"0":{"22":1,"24":1,"38":1,"63":1},"1":{"23":1,"24":1},"2":{"2":1,"4":1,"9":2,"10":1,"12":1,"17":1,"18":1,"19":1,"21":4,"22":4,"23":3,"24":5,"25":1,"26":2,"28":1,"29":4,"34":1,"35":1,"36":1,"37":1,"38":1,"39":1,"40":1,"41":3,"42":5,"45":2,"47":11,"48":3,"49":1,"65":1,"66":2,"72":1}}],["tng",{"2":{"43":1}}],["tgz",{"2":{"41":2}}],["typically",{"2":{"41":1,"42":1,"45":1,"47":6}}],["types",{"0":{"44":1,"48":1},"1":{"45":1,"46":1,"47":1,"48":1,"49":1},"2":{"9":1,"21":1,"41":2,"45":2,"46":3,"48":1,"49":4}}],["type",{"0":{"47":1},"2":{"9":1,"41":1,"45":1,"46":2,"47":1,"48":2,"49":1}}],["talks",{"2":{"53":1}}],["tables",{"2":{"46":1}}],["tag",{"2":{"42":1}}],["tags",{"2":{"38":1}}],["tar",{"2":{"42":14}}],["tarballs",{"2":{"42":1}}],["targets",{"2":{"35":1}}],["tech",{"0":{"54":1}}],["technologies",{"2":{"23":1,"24":1}}],["technology",{"2":{"21":1,"24":1,"43":1}}],["technical",{"0":{"36":1},"2":{"9":1,"36":2,"54":1}}],["teams",{"2":{"70":1}}],["team",{"0":{"54":1,"55":1,"56":1},"2":{"53":1}}],["test",{"2":{"24":1}}],["trust",{"2":{"48":1}}],["tree",{"2":{"48":1}}],["tr",{"0":{"36":1},"2":{"36":2}}],["trivy",{"2":{"24":1}}],["training",{"2":{"71":1}}],["trade",{"2":{"35":1}}],["transparency",{"2":{"29":1,"40":1}}],["traversing",{"2":{"23":1,"24":1}}],["tracking",{"2":{"40":1}}],["track",{"2":{"9":1,"60":1,"61":1,"63":1}}],["tied",{"2":{"46":1}}],["tightly",{"2":{"46":1}}],["tickets",{"0":{"15":1}}],["time",{"2":{"6":2,"9":1,"38":1,"48":1}}],["times",{"0":{"3":1}}],["t",{"2":{"9":1}}],["two",{"2":{"9":1,"23":2,"46":1}}],["thursdays",{"2":{"55":2}}],["thursday",{"0":{"53":1,"54":1,"55":1,"62":1,"70":1,"72":1}}],["think",{"2":{"42":1}}],["this",{"0":{"7":1},"2":{"3":1,"9":6,"10":1,"17":1,"18":1,"19":1,"21":1,"23":1,"24":1,"26":1,"28":1,"29":1,"35":2,"37":1,"38":1,"41":7,"43":1,"44":1,"45":1,"46":1,"47":3,"48":2,"49":1,"71":1}}],["those",{"2":{"41":1}}],["than",{"2":{"41":1,"42":1,"48":1}}],["that",{"2":{"4":1,"7":2,"9":1,"21":1,"24":1,"26":1,"29":2,"36":1,"38":1,"41":3,"42":1,"45":1,"47":4,"48":2,"49":1,"65":1,"66":1}}],["three",{"2":{"38":1}}],["through",{"2":{"37":1,"39":1,"47":3}}],["they",{"2":{"24":3,"48":1}}],["their",{"2":{"9":1,"10":1,"21":1,"29":2,"37":1,"42":1,"49":1,"52":1,"72":1}}],["these",{"2":{"7":1,"9":2,"23":2,"41":1,"42":1,"49":1,"65":1}}],["therefore",{"2":{"23":1}}],["there",{"2":{"7":2,"9":1,"24":1,"41":1,"45":1}}],["them",{"2":{"6":1,"26":1,"37":1}}],["themselves",{"2":{"4":1}}],["the",{"0":{"6":2,"7":2,"23":1,"38":1,"48":1,"53":1},"2":{"1":1,"2":1,"3":2,"4":6,"6":3,"7":1,"8":4,"9":10,"10":3,"12":2,"16":2,"21":10,"22":6,"23":14,"24":13,"26":2,"27":2,"29":4,"34":8,"35":1,"36":5,"37":1,"38":5,"39":6,"40":2,"41":16,"42":13,"43":1,"44":1,"45":6,"46":6,"47":8,"48":20,"49":3,"51":3,"52":1,"54":1,"55":1,"58":1,"59":1,"60":1,"61":1,"62":2,"63":1,"64":1,"65":1,"66":1,"71":3}}],["tuesday",{"0":{"69":1,"71":1},"2":{"3":1}}],["topics",{"0":{"57":1},"1":{"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1}}],["touch",{"2":{"51":1}}],["today",{"2":{"45":2}}],["toto",{"2":{"9":1}}],["tool",{"0":{"24":1,"25":1},"2":{"22":1,"24":1,"25":1,"42":1,"48":1,"59":1}}],["tooling",{"0":{"70":1},"2":{"9":3,"10":1,"21":1,"22":1,"23":1,"25":1,"47":3,"49":3,"70":1,"71":1}}],["tools",{"2":{"7":1,"8":1,"9":3,"24":2,"45":1,"48":1}}],["to",{"0":{"15":1},"2":{"2":1,"3":2,"4":1,"7":1,"8":1,"9":4,"10":2,"12":3,"21":2,"22":3,"23":4,"24":5,"25":1,"26":2,"27":2,"34":1,"35":2,"36":2,"37":1,"39":1,"41":6,"42":3,"43":1,"44":1,"46":2,"47":6,"48":15,"49":3,"51":1,"54":2,"55":2,"56":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":2,"65":1,"66":2,"67":1,"68":1,"69":1,"70":1,"71":1}}],["grype",{"2":{"72":1}}],["growing",{"2":{"35":1}}],["groups",{"0":{"50":1,"57":1},"1":{"51":1,"52":1,"53":1,"54":1,"55":1,"56":1,"57":1,"58":2,"59":2,"60":2,"61":2,"62":2,"63":2,"64":2,"65":2,"66":1,"67":1,"68":1,"69":1,"70":1,"71":1,"72":1},"2":{"66":1}}],["group",{"0":{"7":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1,"68":1},"2":{"9":2,"10":1,"16":1,"68":1,"69":1,"70":1,"71":1}}],["gsoc",{"2":{"53":1}}],["guest",{"2":{"53":1}}],["guideline",{"0":{"36":1},"2":{"36":2}}],["guide",{"0":{"35":1},"2":{"35":2,"37":2}}],["guides",{"2":{"9":1}}],["guiding",{"2":{"12":1}}],["guidance",{"2":{"7":1,"27":1,"36":1,"41":1,"42":3,"43":1}}],["g",{"2":{"47":2,"53":1}}],["gz",{"2":{"42":14}}],["glossery",{"0":{"28":1},"1":{"29":1,"30":1,"31":1,"32":1}}],["glad",{"2":{"1":1}}],["given",{"2":{"45":1}}],["giving",{"2":{"21":1}}],["gitlab",{"2":{"42":1}}],["github",{"2":{"9":1,"10":1,"42":1,"52":1}}],["general",{"0":{"53":1},"2":{"53":2}}],["generally",{"2":{"47":1}}],["generator",{"2":{"26":1}}],["generating",{"2":{"24":1}}],["generation",{"0":{"21":1,"22":1,"23":1,"24":1},"1":{"23":1,"24":1},"2":{"8":1,"9":1,"22":1,"23":4}}],["generated",{"2":{"21":1,"38":1,"41":1,"47":8}}],["generate",{"2":{"7":1,"48":3}}],["gets",{"2":{"26":1}}],["getting",{"0":{"20":1},"1":{"21":1,"22":1,"23":1,"24":1,"25":1,"26":1,"27":1}}],["get",{"0":{"2":1},"1":{"3":1},"2":{"10":1,"51":1,"66":1}}],["gov",{"2":{"49":1,"66":1}}],["governance",{"0":{"16":1},"2":{"16":1}}],["government",{"2":{"9":2,"39":1}}],["go",{"2":{"44":1}}],["goal",{"2":{"22":1}}],["goals",{"0":{"6":1,"7":1}}],["good",{"2":{"9":1,"24":1}}],["google",{"2":{"3":1,"67":1,"68":2,"69":2,"70":2}}],["huber",{"2":{"43":1}}],["hm",{"2":{"43":1}}],["highly",{"2":{"48":1}}],["highlights",{"2":{"48":1}}],["highlight",{"2":{"48":2}}],["highlighting",{"2":{"35":1}}],["hierarchy",{"2":{"48":1}}],["hidden",{"2":{"21":1,"48":1}}],["hardware",{"0":{"64":1},"2":{"64":1}}],["harder",{"2":{"24":1}}],["hall",{"2":{"43":1}}],["having",{"2":{"12":1}}],["have",{"2":{"2":1,"41":1,"47":2,"48":2}}],["has",{"2":{"12":1,"37":1,"48":2}}],["heuristics",{"2":{"47":1,"48":1}}],["help",{"2":{"48":1}}],["helped",{"2":{"43":1}}],["helps",{"2":{"29":1}}],["hence",{"2":{"9":1}}],["here",{"2":{"1":1,"10":1,"24":1,"40":1,"44":1,"66":1}}],["https",{"2":{"9":1,"10":1}}],["hosting",{"2":{"72":1}}],["hosts",{"2":{"66":1}}],["holding",{"2":{"26":1}}],["however",{"2":{"23":2,"26":1,"41":1,"45":1}}],["how",{"2":{"9":2,"37":2,"41":1,"53":1,"60":1,"61":1,"63":1,"64":1}}],["house",{"0":{"6":1,"39":1},"2":{"39":1}}],["home",{"2":{"1":1}}],["omissions",{"2":{"48":1}}],["options",{"2":{"42":1,"47":1}}],["operations",{"0":{"65":1},"2":{"65":1}}],["operational",{"2":{"38":1}}],["operate",{"2":{"24":1}}],["open",{"0":{"40":1},"1":{"41":1,"42":1,"43":1},"2":{"2":1,"4":2,"6":1,"7":1,"8":1,"21":1,"41":3,"52":1,"64":1,"71":1,"72":1}}],["openssf",{"0":{"71":1},"2":{"1":1,"2":1,"3":1,"4":1,"71":2,"72":1}}],["obligatory",{"2":{"36":1}}],["objective",{"0":{"5":1},"1":{"6":1,"7":1}}],["own",{"2":{"23":1,"26":1}}],["owasp",{"0":{"14":1},"1":{"15":1},"2":{"14":1,"15":3}}],["outreach",{"0":{"56":1}}],["outs",{"2":{"47":1}}],["out",{"2":{"25":1,"34":1,"48":1,"49":1,"66":1}}],["outlines",{"2":{"16":1}}],["our",{"2":{"16":1,"25":1}}],["overhead",{"2":{"48":1}}],["overview",{"2":{"10":1}}],["overall",{"2":{"8":1,"35":1}}],["overarching",{"0":{"6":1}}],["original",{"2":{"44":2,"66":1}}],["organization",{"2":{"37":1,"65":1}}],["organizations",{"2":{"9":2,"37":1}}],["or",{"2":{"21":1,"22":2,"23":4,"24":5,"38":2,"41":5,"42":4,"47":5,"48":10,"66":1}}],["order",{"0":{"39":1},"2":{"9":1,"39":2}}],["oss",{"0":{"72":1},"2":{"6":1}}],["ossf",{"0":{"1":1},"1":{"2":1,"3":1,"4":1,"5":1,"6":1,"7":1,"8":1,"9":1,"10":1,"11":1,"12":1,"13":1,"14":1,"15":1,"16":1},"2":{"4":1,"10":1}}],["otherwise",{"2":{"21":1}}],["others",{"2":{"9":1,"46":1,"49":1}}],["other",{"0":{"55":1,"63":1,"71":1,"72":1},"2":{"3":1,"41":2,"42":2,"47":2,"48":5,"55":2}}],["one",{"2":{"23":2,"26":1,"38":1,"46":1}}],["only",{"2":{"23":2,"26":1,"41":2,"46":1,"47":1,"48":1}}],["on",{"2":{"2":1,"3":1,"6":1,"8":1,"9":2,"12":1,"21":2,"23":1,"24":3,"38":1,"39":1,"42":1,"46":1,"47":2,"48":5,"51":1,"53":1,"54":1,"65":1,"66":1,"71":1}}],["occur",{"2":{"2":1}}],["offers",{"2":{"37":1}}],["official",{"2":{"2":1,"54":1}}],["often",{"2":{"24":1}}],["of",{"0":{"35":2,"40":1,"44":2,"48":1,"53":1},"1":{"41":1,"42":1,"43":1,"45":2,"46":2,"47":2,"48":2,"49":2},"2":{"1":1,"4":3,"8":2,"9":8,"10":1,"12":1,"16":1,"21":4,"22":1,"23":7,"24":3,"26":1,"29":2,"34":4,"35":1,"36":1,"38":5,"39":3,"40":1,"41":11,"42":6,"45":6,"46":3,"47":15,"48":7,"49":4,"54":1,"55":1,"58":1,"65":1}}],["saas",{"2":{"63":1}}],["safety",{"0":{"61":1},"2":{"61":1}}],["samsung",{"2":{"43":1}}],["same",{"2":{"23":1,"24":1,"48":1,"49":1}}],["snyk",{"2":{"43":1}}],["snapshot",{"2":{"41":1}}],["slak",{"2":{"51":1}}],["slack",{"2":{"2":1}}],["slsa",{"2":{"42":1}}],["share",{"2":{"37":1}}],["show",{"2":{"38":1}}],["should",{"2":{"22":3,"27":1,"41":1,"42":3}}],["shorten",{"2":{"6":2}}],["swid",{"0":{"32":1},"2":{"38":2}}],["student",{"2":{"53":1}}],["steps",{"2":{"35":1}}],["stream",{"0":{"69":1,"70":1}}],["structures",{"2":{"42":1}}],["structured",{"2":{"29":1}}],["strong",{"2":{"37":1}}],["strategy",{"2":{"37":1}}],["strategies",{"2":{"34":1}}],["still",{"2":{"24":1,"45":1}}],["stakeholder",{"2":{"62":1}}],["status",{"2":{"58":1}}],["stamp",{"2":{"38":1}}],["starting",{"2":{"49":1}}],["starter",{"2":{"37":1}}],["startersgids",{"0":{"37":1}}],["started",{"0":{"20":1},"1":{"21":1,"22":1,"23":1,"24":1,"25":1,"26":1,"27":1}}],["start",{"2":{"24":1}}],["stack",{"2":{"21":1,"24":1}}],["standard",{"2":{"15":3,"23":1,"42":2}}],["standards",{"2":{"9":1,"23":1,"24":1,"38":1,"40":1,"42":1}}],["standardization",{"2":{"4":1}}],["system",{"2":{"47":4,"48":5}}],["systems",{"2":{"9":1,"47":1}}],["syft",{"2":{"24":1,"72":1}}],["simulated",{"2":{"47":1}}],["side",{"2":{"24":1}}],["site",{"2":{"17":1,"18":1,"19":1,"28":1,"71":1}}],["signing",{"2":{"48":1}}],["significantly",{"2":{"21":1}}],["sig",{"0":{"0":1,"1":1},"1":{"2":1,"3":1,"4":1,"5":1,"6":1,"7":1,"8":1,"9":1,"10":1,"11":1,"12":1,"13":1,"14":1,"15":1,"16":1},"2":{"1":1,"2":1,"4":1,"71":1}}],["sca",{"2":{"47":1}}],["scheme",{"2":{"34":1}}],["scvs",{"0":{"14":1},"1":{"15":1},"2":{"14":1}}],["scope",{"0":{"8":1,"41":1},"1":{"9":1},"2":{"8":1,"9":2,"16":1}}],["serialisation",{"0":{"62":1},"2":{"62":2}}],["service",{"0":{"63":1},"2":{"49":1}}],["serves",{"2":{"36":1}}],["section",{"2":{"71":1}}],["second",{"2":{"55":1}}],["secure",{"2":{"34":1}}],["securing",{"2":{"6":1}}],["security",{"0":{"58":1},"2":{"4":1,"6":1,"8":1,"29":1,"35":1,"37":1,"39":2,"71":1}}],["selling",{"2":{"39":1}}],["select",{"0":{"21":1,"25":1},"2":{"25":1}}],["seth",{"2":{"43":1}}],["set",{"2":{"24":1}}],["setup",{"2":{"24":1}}],["several",{"2":{"23":1,"24":1,"26":1,"66":1}}],["separately",{"2":{"23":1}}],["separate",{"0":{"24":1},"2":{"22":1,"24":1,"26":1,"41":1}}],["see",{"2":{"10":1}}],["special",{"2":{"71":1}}],["specifying",{"2":{"34":1}}],["specification",{"2":{"47":1,"54":1,"55":1,"58":1,"59":1,"60":1,"61":1,"63":1,"64":1}}],["specifications",{"0":{"9":1},"2":{"7":1,"9":1}}],["specific",{"0":{"57":1},"1":{"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1},"2":{"34":1,"41":2,"48":1}}],["speakers",{"2":{"53":1}}],["sp",{"2":{"9":1}}],["spdx",{"0":{"30":1,"52":1},"1":{"53":1,"54":1,"55":1,"56":1,"57":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1},"2":{"9":1,"23":1,"24":1,"38":1,"40":1,"42":13,"52":1,"53":1,"54":2,"55":2,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1}}],["sub",{"0":{"57":1,"68":1},"1":{"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1}}],["submissions",{"2":{"55":1}}],["subscriptions",{"2":{"2":1}}],["summarize",{"2":{"46":1}}],["summarizes",{"2":{"45":1}}],["summary",{"2":{"23":1,"24":1}}],["such",{"2":{"21":1,"23":1,"38":1,"40":1,"41":3,"47":2,"48":1}}],["supplier",{"2":{"38":1}}],["suppliers",{"2":{"35":1}}],["supply",{"2":{"9":1,"12":1,"29":1,"34":1,"39":2,"40":1}}],["supporting",{"2":{"37":1}}],["supported",{"2":{"9":2}}],["support",{"2":{"7":1,"23":1,"24":1,"38":1,"42":1,"60":1,"61":1,"63":1,"64":1}}],["sustainability",{"2":{"9":1}}],["socs",{"2":{"64":1}}],["sometimes",{"2":{"53":1}}],["something",{"2":{"9":4}}],["some",{"2":{"24":1,"40":1,"45":1,"46":1,"47":3,"48":1}}],["solutions",{"2":{"9":1}}],["software",{"0":{"35":1,"40":1,"44":1,"63":1},"1":{"41":1,"42":1,"43":1,"45":1,"46":1,"47":1,"48":1,"49":1},"2":{"4":1,"9":1,"12":1,"15":3,"21":1,"29":6,"34":3,"35":3,"36":1,"38":4,"39":5,"40":2,"41":6,"42":1,"43":1,"45":1,"46":2,"47":5,"48":3,"49":1,"58":1,"71":1}}],["sourced",{"2":{"42":1,"45":1}}],["sources",{"2":{"24":1,"48":1}}],["source",{"0":{"40":1},"1":{"41":1,"42":1,"43":1},"2":{"4":2,"6":1,"7":1,"8":1,"9":1,"12":1,"21":2,"22":1,"41":7,"42":1,"47":4,"48":3,"71":1,"72":1}}],["s",{"2":{"4":1,"9":1,"12":1,"35":1,"37":1,"39":1,"46":1,"48":1,"71":2}}],["ssf",{"2":{"2":1}}],["sboms",{"0":{"40":1},"1":{"41":1,"42":1,"43":1},"2":{"7":2,"8":1,"9":2,"26":1,"35":1,"37":3,"38":2,"40":1,"41":3,"42":1,"45":1,"46":1,"47":4,"48":1,"49":4}}],["sbom",{"0":{"0":1,"1":1,"10":1,"21":1,"23":1,"24":1,"25":1,"29":1,"33":1,"35":1,"37":1,"38":1,"44":1,"47":1,"48":1,"50":1,"67":1,"69":1,"70":1,"71":1},"1":{"2":1,"3":1,"4":1,"5":1,"6":1,"7":1,"8":1,"9":1,"10":1,"11":1,"12":1,"13":1,"14":1,"15":1,"16":1,"34":1,"35":1,"36":1,"37":1,"38":1,"39":1,"45":1,"46":1,"47":1,"48":1,"49":1,"51":1,"52":1,"53":1,"54":1,"55":1,"56":1,"57":1,"58":1,"59":1,"60":1,"61":1,"62":1,"63":1,"64":1,"65":1,"66":1,"67":1,"68":1,"69":1,"70":1,"71":1,"72":1},"2":{"1":1,"2":2,"4":2,"7":1,"9":2,"10":2,"12":1,"13":1,"21":5,"22":2,"23":8,"24":5,"26":2,"27":3,"29":1,"34":2,"35":1,"36":2,"37":1,"38":4,"39":2,"40":2,"41":3,"42":4,"45":6,"46":3,"47":9,"48":6,"49":5,"66":3,"68":1,"69":1,"70":1,"71":3}}]],"serializationVersion":2}';export{e as default}; diff --git a/assets/chunks/VPLocalSearchBox.49QHyXFg.js b/assets/chunks/VPLocalSearchBox.49QHyXFg.js new file mode 100644 index 0000000..f7f2fa5 --- /dev/null +++ b/assets/chunks/VPLocalSearchBox.49QHyXFg.js @@ -0,0 +1,7 @@ +var Ct=Object.defineProperty;var It=(o,e,t)=>e in o?Ct(o,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):o[e]=t;var Oe=(o,e,t)=>It(o,typeof e!="symbol"?e+"":e,t);import{X as Dt,s as oe,v as $e,ai as kt,aj as Ot,d as Rt,G as xe,ak as tt,h as Fe,al as _t,am as Mt,x as Lt,an as Pt,y as Re,R as de,Q as Ee,ao as zt,ap as Bt,Y as Vt,U as $t,aq as Wt,o as ee,b as Kt,j as k,a1 as Jt,k as j,ar as Ut,as as jt,at as Gt,c as re,n as rt,e as Se,E as at,F as nt,a as ve,t as pe,au as Qt,p as qt,l as Ht,av as it,aw as Yt,a7 as Zt,ad as Xt,ax as er,_ as tr}from"./framework.Bsyxd66g.js";import{u as rr,c as ar}from"./theme.DnbsOCOH.js";const nr={root:()=>Dt(()=>import("./@localSearchIndexroot.-NK0HcVv.js"),[])};/*! +* tabbable 6.2.0 +* @license MIT, https://github.com/focus-trap/tabbable/blob/master/LICENSE +*/var yt=["input:not([inert])","select:not([inert])","textarea:not([inert])","a[href]:not([inert])","button:not([inert])","[tabindex]:not(slot):not([inert])","audio[controls]:not([inert])","video[controls]:not([inert])",'[contenteditable]:not([contenteditable="false"]):not([inert])',"details>summary:first-of-type:not([inert])","details:not([inert])"],Ne=yt.join(","),mt=typeof Element>"u",ue=mt?function(){}:Element.prototype.matches||Element.prototype.msMatchesSelector||Element.prototype.webkitMatchesSelector,Ce=!mt&&Element.prototype.getRootNode?function(o){var e;return o==null||(e=o.getRootNode)===null||e===void 0?void 0:e.call(o)}:function(o){return o==null?void 0:o.ownerDocument},Ie=function o(e,t){var r;t===void 0&&(t=!0);var n=e==null||(r=e.getAttribute)===null||r===void 0?void 0:r.call(e,"inert"),a=n===""||n==="true",i=a||t&&e&&o(e.parentNode);return i},ir=function(e){var t,r=e==null||(t=e.getAttribute)===null||t===void 0?void 0:t.call(e,"contenteditable");return r===""||r==="true"},gt=function(e,t,r){if(Ie(e))return[];var n=Array.prototype.slice.apply(e.querySelectorAll(Ne));return t&&ue.call(e,Ne)&&n.unshift(e),n=n.filter(r),n},bt=function o(e,t,r){for(var n=[],a=Array.from(e);a.length;){var i=a.shift();if(!Ie(i,!1))if(i.tagName==="SLOT"){var s=i.assignedElements(),u=s.length?s:i.children,l=o(u,!0,r);r.flatten?n.push.apply(n,l):n.push({scopeParent:i,candidates:l})}else{var h=ue.call(i,Ne);h&&r.filter(i)&&(t||!e.includes(i))&&n.push(i);var d=i.shadowRoot||typeof r.getShadowRoot=="function"&&r.getShadowRoot(i),v=!Ie(d,!1)&&(!r.shadowRootFilter||r.shadowRootFilter(i));if(d&&v){var y=o(d===!0?i.children:d.children,!0,r);r.flatten?n.push.apply(n,y):n.push({scopeParent:i,candidates:y})}else a.unshift.apply(a,i.children)}}return n},wt=function(e){return!isNaN(parseInt(e.getAttribute("tabindex"),10))},se=function(e){if(!e)throw new Error("No node provided");return e.tabIndex<0&&(/^(AUDIO|VIDEO|DETAILS)$/.test(e.tagName)||ir(e))&&!wt(e)?0:e.tabIndex},or=function(e,t){var r=se(e);return r<0&&t&&!wt(e)?0:r},sr=function(e,t){return e.tabIndex===t.tabIndex?e.documentOrder-t.documentOrder:e.tabIndex-t.tabIndex},xt=function(e){return e.tagName==="INPUT"},ur=function(e){return xt(e)&&e.type==="hidden"},lr=function(e){var t=e.tagName==="DETAILS"&&Array.prototype.slice.apply(e.children).some(function(r){return r.tagName==="SUMMARY"});return t},cr=function(e,t){for(var r=0;r=0)c=r.activeElement;else{var f=i.tabbableGroups[0],p=f&&f.firstTabbableNode;c=p||h("fallbackFocus")}if(!c)throw new Error("Your focus-trap needs to have at least one focusable element");return c},v=function(){if(i.containerGroups=i.containers.map(function(c){var f=br(c,a.tabbableOptions),p=wr(c,a.tabbableOptions),C=f.length>0?f[0]:void 0,I=f.length>0?f[f.length-1]:void 0,M=p.find(function(m){return le(m)}),P=p.slice().reverse().find(function(m){return le(m)}),z=!!f.find(function(m){return se(m)>0});return{container:c,tabbableNodes:f,focusableNodes:p,posTabIndexesFound:z,firstTabbableNode:C,lastTabbableNode:I,firstDomTabbableNode:M,lastDomTabbableNode:P,nextTabbableNode:function(x){var $=arguments.length>1&&arguments[1]!==void 0?arguments[1]:!0,K=f.indexOf(x);return K<0?$?p.slice(p.indexOf(x)+1).find(function(Q){return le(Q)}):p.slice(0,p.indexOf(x)).reverse().find(function(Q){return le(Q)}):f[K+($?1:-1)]}}}),i.tabbableGroups=i.containerGroups.filter(function(c){return c.tabbableNodes.length>0}),i.tabbableGroups.length<=0&&!h("fallbackFocus"))throw new Error("Your focus-trap must have at least one container with at least one tabbable node in it at all times");if(i.containerGroups.find(function(c){return c.posTabIndexesFound})&&i.containerGroups.length>1)throw new Error("At least one node with a positive tabindex was found in one of your focus-trap's multiple containers. Positive tabindexes are only supported in single-container focus-traps.")},y=function w(c){var f=c.activeElement;if(f)return f.shadowRoot&&f.shadowRoot.activeElement!==null?w(f.shadowRoot):f},b=function w(c){if(c!==!1&&c!==y(document)){if(!c||!c.focus){w(d());return}c.focus({preventScroll:!!a.preventScroll}),i.mostRecentlyFocusedNode=c,Ar(c)&&c.select()}},E=function(c){var f=h("setReturnFocus",c);return f||(f===!1?!1:c)},g=function(c){var f=c.target,p=c.event,C=c.isBackward,I=C===void 0?!1:C;f=f||Ae(p),v();var M=null;if(i.tabbableGroups.length>0){var P=l(f,p),z=P>=0?i.containerGroups[P]:void 0;if(P<0)I?M=i.tabbableGroups[i.tabbableGroups.length-1].lastTabbableNode:M=i.tabbableGroups[0].firstTabbableNode;else if(I){var m=ft(i.tabbableGroups,function(B){var U=B.firstTabbableNode;return f===U});if(m<0&&(z.container===f||_e(f,a.tabbableOptions)&&!le(f,a.tabbableOptions)&&!z.nextTabbableNode(f,!1))&&(m=P),m>=0){var x=m===0?i.tabbableGroups.length-1:m-1,$=i.tabbableGroups[x];M=se(f)>=0?$.lastTabbableNode:$.lastDomTabbableNode}else ge(p)||(M=z.nextTabbableNode(f,!1))}else{var K=ft(i.tabbableGroups,function(B){var U=B.lastTabbableNode;return f===U});if(K<0&&(z.container===f||_e(f,a.tabbableOptions)&&!le(f,a.tabbableOptions)&&!z.nextTabbableNode(f))&&(K=P),K>=0){var Q=K===i.tabbableGroups.length-1?0:K+1,q=i.tabbableGroups[Q];M=se(f)>=0?q.firstTabbableNode:q.firstDomTabbableNode}else ge(p)||(M=z.nextTabbableNode(f))}}else M=h("fallbackFocus");return M},S=function(c){var f=Ae(c);if(!(l(f,c)>=0)){if(ye(a.clickOutsideDeactivates,c)){s.deactivate({returnFocus:a.returnFocusOnDeactivate});return}ye(a.allowOutsideClick,c)||c.preventDefault()}},T=function(c){var f=Ae(c),p=l(f,c)>=0;if(p||f instanceof Document)p&&(i.mostRecentlyFocusedNode=f);else{c.stopImmediatePropagation();var C,I=!0;if(i.mostRecentlyFocusedNode)if(se(i.mostRecentlyFocusedNode)>0){var M=l(i.mostRecentlyFocusedNode),P=i.containerGroups[M].tabbableNodes;if(P.length>0){var z=P.findIndex(function(m){return m===i.mostRecentlyFocusedNode});z>=0&&(a.isKeyForward(i.recentNavEvent)?z+1
j)for(;E<=B;)Le(u[E],b,S,!0),E++;else{const q=E,X=E,ee=new Map;for(E=X;E<=j;E++){const be=d[E]=R?Ge(d[E]):Ae(d[E]);be.key!=null&&ee.set(be.key,E)}let Q,ae=0;const Te=j-X+1;let ht=!1,Xr=0;const St=new Array(Te);for(E=0;E {const{el:S,type:O,transition:x,children:R,shapeFlag:E}=u;if(E&6){nt(u.component.subTree,d,g,v);return}if(E&128){u.suspense.move(d,g,v);return}if(E&64){O.move(u,d,g,dt);return}if(O===_e){r(S,d,g);for(let B=0;B Depending on the technology stack used, the phase of the software development lifecycle in which an SBOM is generated can significantly affect its quality. The different phases are explained in more detail in the SBOM types. For open-source projects, it is most beneficial to provide a source or a build SBOM, giving the consumer insights into the composition of a project build before it is compiled into an artifact. This provides access to details of the project composition that might otherwise remain hidden. While providing an SBOM based on the analysis of a build artifact can also be useful, such an SBOM can be produced by the user with their preferred tooling. Assuming the goal is to produce a source or build SBOM for a project, it should be decided whether the SBOM generation should be part of the build process (like a plugin added to the build tooling) or if a separate tool should be applied to the repository during the build. Adding SBOM generation directly to the build process might produce the best results. The SBOM is based on the build information directly and can therefore represent most of the complexity, such as traversing dependencies or dynamic dependency resolving with variables or version ranges. However, integrating SBOM generation into the build process can complicate changes. Additionally, if the project is composed of several technologies, each requiring its own build tooling and corresponding SBOM plugins, merging the SBOM generation results might be very challenging. Most build plugins only support one of the two SBOM standards, necessitating the choice of one standard or the integration of two SBOM plugins to cover SPDX and CycloneDX separately. This can also lead to additional complexity because these plugins can report different findings for the same project. In summary, integrating SBOM generation into the build process via plugins might produce the best results but can add a lot of additional complexities. However, only a few or none of these constraints may apply to a project. There are also tools that can be applied to the sources of a project without relying on a build integration. Tools like Syft, Trivy, or CdxGen can be used in this manner. While they are easier to integrate and operate within a project, they might not produce the best quality SBOM. Depending on the technology stack and build setup, it can be harder to resolve traversing dependencies, versions from version ranges or variables might be incorrect or missing, and license information might be wrong or missing (you can find some test reports here). On the plus side, they are easy to integrate, often support both SBOM standards (SPDX and CycloneDX), and can cover projects using several technologies in the same repository (no merging of SBOM data required). In summary, generating the SBOM with a separate tool is a good start and can be easier, but the results might be more accurate if derived from the build process. Nevertheless, the results might still be able to meet the requirements of the NTIA minimum elements for an SBOM (US regulations) or the requirements set by the EU CRA (EU regulations). To select a tool, check out our tooling catalog. When integrating an SBOM generator into a project, it is important to ensure that each artifact gets its own SBOM. This is not an issue if the project produces only one artifact. However, if the project is, for example, a monorepository holding several products built for different platforms using diverging dependencies, it is important to provide separate SBOMs for each of them. An SBOM should be published along with its artifacts. It can also be considered to publish an SBOM inside an artifact to make it inseparable from the provided artifact. Further guidance is provided by the SBOM naming document. Work in Progress This site is Work in progress and just a concept. A Software Bill of Materials (SBOM) is a structured record that identifies the components and their relationships within a software product. It functions like an ingredients list, detailing the various software components and their versions that make up a final software product. This record helps with transparency in the software supply chain, enabling better understanding, management, and ultimately, improved security of the software. The European Cyber Resilience Act (CRA) includes requirements for the identification and management of supply chain risks, and the proposed European Cybersecurity Certification Scheme would likely require the use of Software Bill of Materials (SBOM) and secure software development practices. The Cybersecurity Resilience Act lays out specific actions and strategies regarding the responsibility and the means to protect software vulnerabilities, including specifying vulnerability reporting format and requirements, anchored in the form of a SBOM. Japan's Ministry of Economy, Trade and Industry (METI) published a guide to promote SBOM use. Highlighting growing software security concerns, METI targets software suppliers with this guide, which details the benefits and steps for implementing SBOMs. This initiative aims to improve software vulnerability management, enhance development productivity, and bolster overall cybersecurity in Japanese industries. The Technical Guideline TR-03183: Cyber Resilience Requirements for Manufacturers and Products Part 2 Software Bill of Materials (SBOM) provides essential guidance for creating an SBOM. The Technical Guideline TR-03183 aims to provide manufacturers with advance access to the requirements that will be imposed by the future EU Cyber Resilience Act (CRA). While it is recommended (but not obligatory), it serves as a basis for discussion both within the EU and internationally. The Dutch National Cyber Security Center (NCSC) has published a SBOM Starter Guide to assist managers involved in their organization's cybersecurity strategy with implementing SBOMs. This guide explores how organizations can establish processes for using SBOMs, create, manage, and share them effectively, and develop strong agreements with vendors. It also dives into how SBOMs can be utilized for vulnerability management and offers additional insights through supporting frameworks. The NTIA Minimum Elements for an SBOM requires that SBOMs show, for each software component: supplier, component name, version, any unique identifiers like CPE SWID or PURL, dependency relationship, and the author of this information along with a time/date stamp when it was generated. The minimum elements of an SBOM build on three broad, interrelated areas: Data fields, Operational considerations, and Support for automation. SBOMs must comply with at least one of the following SBOM standards: Software Package Data eXchange (SPDX), CycloneDX, or Software Identification (SWID) tags. The minimum elements of an SBOM will enable basic use cases, such as management of vulnerabilities, software inventory, and licenses. The White House Executive Order on cybersecurity includes new security requirements for software vendors selling software to the U.S. government. It emphasizes the importance of enhancing software supply chain security through the Software Bill of Materials (SBOM). The Executive Order defines an SBOM as “a formal record containing the details and supply chain relationships of various components used in building software”. The Software Bill of Materials (SBOM) plays a vital role in providing visibility & transparency into the software supply chain. Using SBOM standards such as CycloneDX and SPDX ensures interoperability, accurate dependency tracking, and efficient vulnerability management. Here are some best practices for naming and directory conventions when creating and managing SBOMs. This document only covers SBOMs of Type Source and Build as SBOMs of other types are typically not curated by the maintainers of Open Source software but instead by consumers of Open Source software. The audience for this document is open source projects distributing artifacts directly rather than distributing artifacts via an ecosystem such as Maven or NPM. For Source and Build SBOMs, the contents of the SBOM describing the artifact will only include what is being distributed and will not contain information about prospective uses of the software during or after installation or running of the software. That information is captured in separate SBOM types (ie Deployment, Runtime). In the context of this document, the “source” is defined as a snapshot of the source code made available to download, such as in a tgz archive. The “build” is the artifacts that are built by the project and released. These could be tgz archives, but also other artifacts such as rpm, deb, or zip. This document does not prescribe best practices to specific software ecosystems (Maven, PyPI, etc) which are likely to have specific requirements about how to distribute accompanying metadata alongside software distributions, however this should not preclude the use of all or part of this guidance for this use-case. There may be instances where a release is also uploaded to an ecosystem. It is not expected that the SBOM generated for the releases would be uploaded to those ecosystems. For SBOMs which are distributed with source tarballs or pre-built binaries as a part of a defined release of the software, the requirements for “release” files is typically a flat list of files without directories (think GitHub or GitLab Release artifacts). To meet these requirements, no directory structures should be used. Following guidance from SLSA provenance attestations of appending a corresponding extension to the filename of the artifact that is being described. For the CycloneDX and SPDX SBOM standards and their file extension formats the guidance is as follows: The .spdx.* and .cdx.* extensions are sourced from the CycloneDX and SPDX guidance on filename extensions for SBOM documents of the corresponding standard and format. The JSON format files should be considered a mandatory requirement and are always available. The tool support for JSON documents is considered to be better than the other file format options. If other formats are desired, the JSON SBOM should also be available. The following community members helped contribute to this guidance Go to original document. This document was reviewed and published by CISA. You can find the original document here. Today there is a widely-used definition of the minimum content of a Software Bill of Material (SBOM). However, an SBOM may contain different forms of the minimum information sourced from different product artifacts. Given the disparate ways SBOM data can be collected, the results may vary, yet still provide value in different use cases. This document summarizes some common types of SBOMs that tools may create in the industry today, along with the data typically presented for each type of SBOM. An SBOM document may combine information for multiple SBOM types. The following two tables summarize the different types of SBOMs and the benefits and limitations of each type. This list of SBOM types is not intended to be tightly tied to the software lifecycle. Some SBOM types may be available and useful across multiple lifecycle phases, while others may be available only in one lifecycle phase. Also, the data presented within an SBOM type may vary, depending on the software’s lifecycle phase and industry. These definitions are meant as a starting point for clarifying SBOM types that varying tooling types and methods may create. Different tooling approaches may be required to create the same SBOM type for different kinds of software. This document may evolve as the innovation around SBOMs and their uses may require the addition of more SBOM types. Progress in adopting and refining Vulnerability Exploitability eXchange2 (i.e., VEX), service dependencies, and “SBOM of SBOMs,” among others, may require additional types of SBOMs. If you would like to learn more about tooling associated with SBOMs, reach out to SBOM@cisa.dhs.gov. To get in touch with the CycloneDX community you best join the CycloneDX Slak. Further information is provided on the CycloneDX participate page. SPDX published their open workstreams in the following Github repository CISA hosts several working groups that meet on a weekly basis. The original meeting notes can be found here. Reach out to SBOM@cisa.dhs.gov to get an invite or further information. The SBOM Everywhere Special Interest Group came from OpenSSF’s Open Source Software Security Mobilization Plan. The SBOM Everywhere SIG focuses on improving SBOM tooling and training to drive adoption. It's also running this site. Further information in the about us section. Anchore is hosting a community meeting for their open source projects Syft and Grype.Getting Started
Select an SBOM-Generation Phase
Choose a Generation Methodology
SBOM Generation in the Build Process
SBOM Generation with a Separate Tool
Select an SBOM Tool
Integrate into Your Build
Publish with Your Artifacts
Glossery
SBOM
SPDX
CycloneDX
SWID
',7),i=[r];function n(l,c,d,h,p,u){return t(),a("div",null,i)}const f=e(o,[["render",n]]);export{m as __pageData,f as default};
diff --git a/assets/glossery.md.B4QfDr4s.lean.js b/assets/glossery.md.B4QfDr4s.lean.js
new file mode 100644
index 0000000..1e22a96
--- /dev/null
+++ b/assets/glossery.md.B4QfDr4s.lean.js
@@ -0,0 +1 @@
+import{_ as e,c as a,o as t,a3 as s}from"./chunks/framework.Bsyxd66g.js";const m=JSON.parse('{"title":"Glossery","description":"","frontmatter":{},"headers":[],"relativePath":"glossery.md","filePath":"glossery.md"}'),o={name:"glossery.md"},r=s("",7),i=[r];function n(l,c,d,h,p,u){return t(),a("div",null,i)}const f=e(o,[["render",n]]);export{m as __pageData,f as default};
diff --git a/assets/index.md.DAk3DMt6.js b/assets/index.md.DAk3DMt6.js
new file mode 100644
index 0000000..220b106
--- /dev/null
+++ b/assets/index.md.DAk3DMt6.js
@@ -0,0 +1 @@
+import{_ as e,c as t,o}from"./chunks/framework.Bsyxd66g.js";const p=JSON.parse(`{"title":"","description":"","frontmatter":{"layout":"home","hero":{"name":"SBOM-Everywhere","text":"SBOMs in open source projects","tagline":"Adding SBOMs to Open Source Projects.","actions":[{"theme":"brand","text":"Getting started","link":"/getting-started"},{"theme":"brand","text":"Tooling Catalog","link":"https://sbom-catalog.openssf.org/catalog/"}],"image":{"src":"thumbnail.webp","alt":"SBOM catalog"}},"features":[{"title":"SBOM Catalog","details":"Looking for the right SBOM tooling? Explore our interactive catalog.","link":"https://sbom-catalog.openssf.org/catalog/"},{"title":"SBOM Types","details":"What types of SBOMs are there and what do I need?","link":"/sbom-types"},{"title":"SBOM Naming","details":"Wondering were to put and how to name your SBOMs? Look here for best practices.","link":"/sbom-naming"},{"title":"Examples","details":"Looking for examples and references, how other Open Source Projects integrated SBOM.","link":"/example-implementation"},{"title":"SBOM in compliance","details":"Wondering who requires SBOM and want to see a list referencing the sources? Here's a list of laws, guidelines and requirements mandating SBOMs.","link":"/sbom-compliance"},{"title":"Working Groups","details":"Do you want to join, contribute or ask questions. Her is a list of working groups.","link":"sbom-everywhere-sig"}]},"headers":[],"relativePath":"index.md","filePath":"index.md"}`),a={name:"index.md"};function n(i,s,r,l,c,d){return o(),t("div")}const m=e(a,[["render",n]]);export{p as __pageData,m as default};
diff --git a/assets/index.md.DAk3DMt6.lean.js b/assets/index.md.DAk3DMt6.lean.js
new file mode 100644
index 0000000..220b106
--- /dev/null
+++ b/assets/index.md.DAk3DMt6.lean.js
@@ -0,0 +1 @@
+import{_ as e,c as t,o}from"./chunks/framework.Bsyxd66g.js";const p=JSON.parse(`{"title":"","description":"","frontmatter":{"layout":"home","hero":{"name":"SBOM-Everywhere","text":"SBOMs in open source projects","tagline":"Adding SBOMs to Open Source Projects.","actions":[{"theme":"brand","text":"Getting started","link":"/getting-started"},{"theme":"brand","text":"Tooling Catalog","link":"https://sbom-catalog.openssf.org/catalog/"}],"image":{"src":"thumbnail.webp","alt":"SBOM catalog"}},"features":[{"title":"SBOM Catalog","details":"Looking for the right SBOM tooling? Explore our interactive catalog.","link":"https://sbom-catalog.openssf.org/catalog/"},{"title":"SBOM Types","details":"What types of SBOMs are there and what do I need?","link":"/sbom-types"},{"title":"SBOM Naming","details":"Wondering were to put and how to name your SBOMs? Look here for best practices.","link":"/sbom-naming"},{"title":"Examples","details":"Looking for examples and references, how other Open Source Projects integrated SBOM.","link":"/example-implementation"},{"title":"SBOM in compliance","details":"Wondering who requires SBOM and want to see a list referencing the sources? Here's a list of laws, guidelines and requirements mandating SBOMs.","link":"/sbom-compliance"},{"title":"Working Groups","details":"Do you want to join, contribute or ask questions. Her is a list of working groups.","link":"sbom-everywhere-sig"}]},"headers":[],"relativePath":"index.md","filePath":"index.md"}`),a={name:"index.md"};function n(i,s,r,l,c,d){return o(),t("div")}const m=e(a,[["render",n]]);export{p as __pageData,m as default};
diff --git a/assets/inter-italic-cyrillic-ext.r48I6akx.woff2 b/assets/inter-italic-cyrillic-ext.r48I6akx.woff2
new file mode 100644
index 0000000..b6b603d
Binary files /dev/null and b/assets/inter-italic-cyrillic-ext.r48I6akx.woff2 differ
diff --git a/assets/inter-italic-cyrillic.By2_1cv3.woff2 b/assets/inter-italic-cyrillic.By2_1cv3.woff2
new file mode 100644
index 0000000..def40a4
Binary files /dev/null and b/assets/inter-italic-cyrillic.By2_1cv3.woff2 differ
diff --git a/assets/inter-italic-greek-ext.1u6EdAuj.woff2 b/assets/inter-italic-greek-ext.1u6EdAuj.woff2
new file mode 100644
index 0000000..e070c3d
Binary files /dev/null and b/assets/inter-italic-greek-ext.1u6EdAuj.woff2 differ
diff --git a/assets/inter-italic-greek.DJ8dCoTZ.woff2 b/assets/inter-italic-greek.DJ8dCoTZ.woff2
new file mode 100644
index 0000000..a3c16ca
Binary files /dev/null and b/assets/inter-italic-greek.DJ8dCoTZ.woff2 differ
diff --git a/assets/inter-italic-latin-ext.CN1xVJS-.woff2 b/assets/inter-italic-latin-ext.CN1xVJS-.woff2
new file mode 100644
index 0000000..2210a89
Binary files /dev/null and b/assets/inter-italic-latin-ext.CN1xVJS-.woff2 differ
diff --git a/assets/inter-italic-latin.C2AdPX0b.woff2 b/assets/inter-italic-latin.C2AdPX0b.woff2
new file mode 100644
index 0000000..790d62d
Binary files /dev/null and b/assets/inter-italic-latin.C2AdPX0b.woff2 differ
diff --git a/assets/inter-italic-vietnamese.BSbpV94h.woff2 b/assets/inter-italic-vietnamese.BSbpV94h.woff2
new file mode 100644
index 0000000..1eec077
Binary files /dev/null and b/assets/inter-italic-vietnamese.BSbpV94h.woff2 differ
diff --git a/assets/inter-roman-cyrillic-ext.BBPuwvHQ.woff2 b/assets/inter-roman-cyrillic-ext.BBPuwvHQ.woff2
new file mode 100644
index 0000000..2cfe615
Binary files /dev/null and b/assets/inter-roman-cyrillic-ext.BBPuwvHQ.woff2 differ
diff --git a/assets/inter-roman-cyrillic.C5lxZ8CY.woff2 b/assets/inter-roman-cyrillic.C5lxZ8CY.woff2
new file mode 100644
index 0000000..e3886dd
Binary files /dev/null and b/assets/inter-roman-cyrillic.C5lxZ8CY.woff2 differ
diff --git a/assets/inter-roman-greek-ext.CqjqNYQ-.woff2 b/assets/inter-roman-greek-ext.CqjqNYQ-.woff2
new file mode 100644
index 0000000..36d6748
Binary files /dev/null and b/assets/inter-roman-greek-ext.CqjqNYQ-.woff2 differ
diff --git a/assets/inter-roman-greek.BBVDIX6e.woff2 b/assets/inter-roman-greek.BBVDIX6e.woff2
new file mode 100644
index 0000000..2bed1e8
Binary files /dev/null and b/assets/inter-roman-greek.BBVDIX6e.woff2 differ
diff --git a/assets/inter-roman-latin-ext.4ZJIpNVo.woff2 b/assets/inter-roman-latin-ext.4ZJIpNVo.woff2
new file mode 100644
index 0000000..9a8d1e2
Binary files /dev/null and b/assets/inter-roman-latin-ext.4ZJIpNVo.woff2 differ
diff --git a/assets/inter-roman-latin.Di8DUHzh.woff2 b/assets/inter-roman-latin.Di8DUHzh.woff2
new file mode 100644
index 0000000..07d3c53
Binary files /dev/null and b/assets/inter-roman-latin.Di8DUHzh.woff2 differ
diff --git a/assets/inter-roman-vietnamese.BjW4sHH5.woff2 b/assets/inter-roman-vietnamese.BjW4sHH5.woff2
new file mode 100644
index 0000000..57bdc22
Binary files /dev/null and b/assets/inter-roman-vietnamese.BjW4sHH5.woff2 differ
diff --git a/assets/sbom-compliance.md.Dluqbkoz.js b/assets/sbom-compliance.md.Dluqbkoz.js
new file mode 100644
index 0000000..de94537
--- /dev/null
+++ b/assets/sbom-compliance.md.Dluqbkoz.js
@@ -0,0 +1 @@
+import{_ as e,c as t,o as i,a3 as a}from"./chunks/framework.Bsyxd66g.js";const g=JSON.parse('{"title":"SBOM in compliance","description":"","frontmatter":{},"headers":[],"relativePath":"sbom-compliance.md","filePath":"sbom-compliance.md"}'),r={name:"sbom-compliance.md"},o=a('SBOM in compliance
EU Cyber Resiliance Act
Guide of Introduction of SBOM for Software Management
Technical Guideline TR-03183
SBOM startersgids
The Minimum Elements for a SBOM
White House Executive Order 14028
Best Practices for Naming and Directory Conventions for SBOMs (Software Bill of Materials) in Open Source Projects
Scope
Consistent Naming Conventions
Standard + Format Artifact Filename SBOM Filename CycloneDX JSON artifact-1.0.0.tar.gz artifact-1.0.0.tar.gz.cdx.json CycloneDX XML artifact-1.0.0.tar.gz artifact-1.0.0.tar.gz.cdx.xml SPDX TAG:VALUE artifact-1.0.0.tar.gz artifact-1.0.0.tar.gz.spdx SPDX JSON artifact-1.0.0.tar.gz artifact-1.0.0.tar.gz.spdx.json SPDX XML artifact-1.0.0.tar.gz artifact-1.0.0.tar.gz.spdx.xml SPDX YAML artifact-1.0.0.tar.gz artifact-1.0.0.tar.gz.spdx.yml (or .yaml) SPDX RDF XML artifact-1.0.0.tar.gz Artifact-1.0.0.tar.gz.spdx.rdf (or .rdf.xml) Acknowledgements
',18),s=[n];function i(d,c,l,h,f,p){return a(),t("div",null,s)}const b=e(o,[["render",i]]);export{m as __pageData,b as default};
diff --git a/assets/sbom-naming.md.r47E7vZU.lean.js b/assets/sbom-naming.md.r47E7vZU.lean.js
new file mode 100644
index 0000000..e283b8e
--- /dev/null
+++ b/assets/sbom-naming.md.r47E7vZU.lean.js
@@ -0,0 +1 @@
+import{_ as e,c as t,o as a,a3 as r}from"./chunks/framework.Bsyxd66g.js";const m=JSON.parse('{"title":"Best Practices for Naming and Directory Conventions for SBOMs (Software Bill of Materials) in Open Source Projects","description":"","frontmatter":{},"headers":[],"relativePath":"sbom-naming.md","filePath":"sbom-naming.md"}'),o={name:"sbom-naming.md"},n=r("",18),s=[n];function i(d,c,l,h,f,p){return a(),t("div",null,s)}const b=e(o,[["render",i]]);export{m as __pageData,b as default};
diff --git a/assets/sbom-types.md.CMr92bNf.js b/assets/sbom-types.md.CMr92bNf.js
new file mode 100644
index 0000000..5dc8acb
--- /dev/null
+++ b/assets/sbom-types.md.CMr92bNf.js
@@ -0,0 +1 @@
+import{_ as e,c as t,o as n,a3 as o}from"./chunks/framework.Bsyxd66g.js";const p=JSON.parse('{"title":"Types of Software Bill of Material (SBOM) Documents","description":"","frontmatter":{},"headers":[],"relativePath":"sbom-types.md","filePath":"sbom-types.md"}'),i={name:"sbom-types.md"},a=o('Types of Software Bill of Material (SBOM) Documents
Introduction
Definitions and Discussions
SBOM Type Definition and Composition
Type Definition Description Design SBOM of intended design of included components (some of which may not exist) for a new software artifact. Typically derived from a design specification, RFP, or initial concept. Source SBOM created directly from the development environment, source files, and included dependencies used to build an product artifact. Typically generated from software composition analysis (SCA) tooling, with manual clarifications. Build SBOM generated as part of the process of building the software to create a releasable artifact (e.g., executable or package) from data such as source files, dependencies, built components, build process ephemeral data, and other SBOMs. Typically generated as part of a build process. May consist of integrated intermediate Build and Source SBOMs for a final release artifact SBOM. Analyzed SBOM generated through analysis of artifacts (e.g., executables, packages, containers, and virtual machine images) after its build. Such analysis generally requires a variety of heuristics. In some contexts, this may also be referred to as a “3rd party” SBOM. Typically generated through analysis of artifacts by 3rd party tooling. Deployed SBOM provides an inventory of software that is present on a system. This may be an assembly of other SBOMs that combines analysis of configuration options, and examination of execution behavior in a (potentially simulated) deployment environment. Typically generated by recording the SBOMs and configuration information of artifacts that have been installed on systems. Runtime SBOM generated through instrumenting the system running the software, to capture only components present in the system, as well as external call-outs or dynamically loaded components. In some contexts, this may also be referred to as an “Instrumented” or “Dynamic” SBOM. Typically generated from tooling interacting with a system to record the artifacts present in a running environment and/or that have been executed. Understanding the Benefits and Limitations of SBOM Types
Type Benefits Limitations Design - Highlight incompatible components ahead of licensing purchase or acquisition.
- Defines approved or recommended included component list for developer use.- This may be very difficult to generate.
- Unlikely to identify as much detail as found in other SBOM types.Source - Provides visibility without access to build process.
- Can facilitate remediation of vulnerabilities at the source.
- Can provide a view into the dependency tree / hierarchy of the included components.- Can highlight components (which might have vulnerabilities) that never run or are compiled out in deployed code.
- Depending on language/ecosystem, may not include runtime, plugin, or dynamic components, like appserver or platform libraries.
- May require references to other SBOMs for completeness.Build - Increases confidence that the SBOM representation of the product artifact is correct due to information available during the build and/or Continuous Integration/Continuous Deployment (CI/CD) processes.
- Provides visibility into more components than just source code.
- Increased trust by enabling signing of the SBOM and product artifact by the same build workflow.- Potentially have to change the build process to generate this SBOM.
- Highly dependent on the build environment in which the build is executed.
- May be difficult to capture indirect and/or runtime dependencies.
- May not contain the correct versions of dynamically linked dependencies (as they may be replaced at runtime depending on language/ecosystem).Analyzed - Provides visibility without an active development environment, such as legacy firmware artifacts.
- Does not need access to the build process.
- Can help verify SBOM data from other sources.
- May find hidden dependencies missed by other SBOM type creation tools.- May be prone to omissions, errors, or approximations if the tool is unable to decompose or recognize the software components precisely.
- May depend on heuristics or context-specific risk factors.Deployed - Highlights software components installed on a system, including other configurations and system components used to run an application. - May require changing install and deploy processes to generate.
- May not accurately reflect the software’s runtime environment, as components may reside in inaccessible code.Runtime - Provides visibility to understand what is in use when the system is running, including dynamically loaded components and external connections.
- Can include detailed information about whether components are active and what parts are used.- Requires the system to be analyzed while running, which may require additional overhead.
- Some detailed information may be available only after the system has run for a period of time until the complete functionality has been exercised.Conclusion
SBOM working groups
CycloneDX
SPDX
General meeting
Tech Team meetings
Legal Team meetings
Outreach Team meetings
Sub-groups for specific topics
Security Profile group meetings
Implementers group meetings
AI and Data Profiles group meetings
Functional Safety Profile group meetings
Serialisation Focus Group meetings
Software as a Service Profile group meetings
Hardware Profile group meetings
Operations group meetings
CISA
SBOM Community Central Meeting
VEX sub-group
SBOM adoption work stream
SBOM tooling work stream
OpenSSF (SBOM everywhere)
Anchore OSS Community Meeting