Welcome to sbomqs Discussions!

[riteshnoronha]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[purin-tavilsup]

Hi, I'm a software engineer working on software supply chain security. SBOMQS is really useful for evaluating quality of sboms. At this point, I'm using sbomqs regularly on my local machines. I'm wondering if we could extend this CLI to a self-contained REST API that we can run in CI/CD pipelines. We could make a request to an endpoint that would evaluate an sbom in a request and return score in a response .

[riteshnoronha]

@purin-tavilsup glad to hear you are using sbomqs and its proving useful.

For our open-source tool, currently we have no plans in supporting this. A couple of workarounds would be to run sbomqs in ci/cd, produce the result in json format, and apply policies, if that is something that would be doable.

We have a commercial offering, which provides this feature set to you. If you would be interested, we can setup some time to demo and show u.

[riteshnoronha]

@purin-tavilsup did u find any workaround of this.. or do u need any help with this.