Phase-1 Ecosystem Improvement Tracking

[idunbarh]

This issue is used to keep a running list of issues we create on projects used within phase 1.

Please include links to issues this team creates.

[idunbarh]

aquasecurity/trivy#7626 - request to generate multiple SBOM documents in different formats from a single call of trivy.

[VinodAnandan]

kubernetes-sigs/bom#100 - Request to provide support for CycloneDX

[VinodAnandan]

fluxcd/flux2#2430 - Request to publish CycloneDX SBOM

[vpetersson]

fluxcd/flux2#2430 - Request to publish CycloneDX SBOM

I can have a chat with the ControlPlane guys, but it really is just a switch that needs to be added. Thus I'm not sure this is a good project for this group.

[tiegz]

snyk/parlay#78 - @goneall 's PR to add supplier data to parlay

[idunbarh]

anchore/syft#3397 answering the request from Josh to create an issue on the syft repo to merge sbom generation and augmentation.

[vpetersson]

• Sbomasm (sbomasm should probably add itself as a tool interlynk-io/sbomasm#115)
• Parlay (Parlay should add itself as a tool in the SBOM snyk/parlay#82)
• Trivy (Allow users to set primary component metadata as part of the generation aquasecurity/trivy#7872)