Cloud Native Culture

Introduction   pyspdxtools is a Python library and command-line tool that provides utilities for working with Software Bill of Materials (SBOM) files in the SPDX (Software Package Data Exchange) format. SPDX is a widely adopted standard for documenting the open-source software components used in a project, along with associated metadata such as licenses, copyrights, and relationships between components.  Why Generate a Graph from an SBOM?    Visualizing an SBOM as a graph helps you quickly understand the relationships between components, dependencies, and packages. By generating a graph, you can: -  Identify Key Dependencies : Easily spot core libraries or components that are crucial to the software.  Understand Relationships : Visualize how different packages are connected, including dependencies and sub-dependencies. With this tutorial, you’ll be able to generate such a graph from your SPDX SBOM using `pyspdxtools`, making it easier to analyze and presen...

  Purpose SBOMs provides the foundation for transparency in software supply chain. Overview of NTIA and SBOM Intiatives The National Telecommunications and Information Administration(NTIA) is a U.S. government agency within the Department of Commerce, established to advise on telecommunication and information policy issue. In response to rising software supply chain threats, President Biden signed an Executive Order  in 2021. This step taken to being the "minimum elements" for a Software Bill Of Materials(SBOM).  The motive behind the initiative to bring a transparency in the complex modern software world. What is SBOM ? An SBOM is detailed description of all the dependencies on which your main software relies on. It provides two important information. One is supply chain relationship for your software. To be more precise, it let you know what all are the dependencies are present in your software. Second is information of each dependency in detail. From it's name, version...