Services profile
summary
A Services profile for SPDX 3.1 is under active development to record service-level metadata not covered by software SBOMs, aiming to capture certificate authority validity and other security signals. The working group meets biweekly and stays synced with CISA, and it classifies requirements into three requirement categories: customer data governance, supplier infrastructure governance, regulatory compliance. The project focuses on cross-organization sharing, plans to vote on use cases in 1–2 months, then define fields, classes and models for 3.1.
AI-written summary · about
related talks
31mSoftware Bill of Materials (SBoM) for dummies
07mTooling and Sharing Traceability Discussion
38mBuilding Service Ownership Using Documentation, Telemetry, and a Chance to Make
46mIntroduction to Profiling
40mFHIR Profiling: Overview & Introduction
16mranslate FOSS licenses into code
27mClearlyDefined: A Crowdsourced Database of Licensing Metadata
31mReverse Engineering Compliance