Software Package Profile

Sharing and Distributing a Software Bill of Materials with DataTrails

Overview#

The DataTrails Software Package profile is a set of suggested Asset and Event attributes that enable the recording of an immutable and verifiable Software Bill of Materials (SBOM).

The NTIA describes a SBOM as “a formal record containing the details and supply chain relationships of various components used in building software.”

Software Package Profile Asset Attributes#

Note: Software Package Profile Attribute Namespace

The sbom_ prefix is used to designate attributes that are part of the profile. Some of these are interpreted by DataTrails and others are guidelines.

Public SBOM#

In the API, you must express public as an asset attribute and have true as a property to make an SBOM public. The default is ‘false’. In the UI this is done by setting Attest Publicly to On.

• UI
• YAML
• JSON

  <div class="modal-body">
    
    <img class="img-fluid lazyload responsive" data-sizes="auto" src="/developers/developer-patterns/software-package-profile/PublicCheck_hucf9fdc2f9e456a3fcdbf34fabe0159ca_44795_100x0_resize_box_3.png" data-srcset="https://docs.datatrails.ai/developers/developer-patterns/software-package-profile/PublicCheck_hucf9fdc2f9e456a3fcdbf34fabe0159ca_44795_900x0_resize_box_3.png 900w,https://docs.datatrails.ai/developers/developer-patterns/software-package-profile/PublicCheck_hucf9fdc2f9e456a3fcdbf34fabe0159ca_44795_800x0_resize_box_3.png 800w,https://docs.datatrails.ai/developers/developer-patterns/software-package-profile/PublicCheck_hucf9fdc2f9e456a3fcdbf34fabe0159ca_44795_500x0_resize_box_3.png 500w,https://docs.datatrails.ai/developers/developer-patterns/software-package-profile/PublicCheck_hucf9fdc2f9e456a3fcdbf34fabe0159ca_44795_200x0_resize_box_3.png 200w" width="843" height="488" alt="Rectangle">
  </div>

---
steps:
  - step:
      action: ASSETS_CREATE_IF_NOT_EXISTS
      description: Create an asset.
      asset_label: Publicly Attested Asset 
    selector: 
      - attributes: 
        - arc_display_name
    behaviours: 
      - RecordEvidence
    public: true
    attributes: 
      arc_display_name: Publicly Attested Asset 
      arc_display_type: Example
      arc_description: This example asset is publicly attested, so anyone with the link can access its details without signing in to DataTrails.
      some_custom_attribute: anything you like
    confirm: true

{
    "behaviours": ["RecordEvidence"],
    "attributes": {
        "arc_display_name": "Publicly Attested Asset",
        "arc_display_type": "Example",
        "arc_description": "This example asset is publicly attested, so anyone with the link can access its details without signing in to DataTrails."
    },
    "public": true
}

Software Package Profile Event Types and Attributes#

Release Event#

A Release is the event used by a Supplier to provide an SBOM for their Software Package in DataTrails.

The Release attributes tracked in DataTrails should minimally represent the base information required by the NTIA standard and be recorded in two, separate, lists of attributes; Asset Attributes would track details about the latest release of the SBOM at the time of the event creation, the Event Attributes then track details about the release of the SBOM that is being submitted.

Release Event Attribute Namespace#

The sbom_ prefix is used to designate attributes that are part of the event and asset. Some of these are interpreted by DataTrails and others are guidelines

Exception#

When used in tandem with Release Plan and Accepted events the exception is a useful record of when an emergency has caused a release to be pushed without needing an initial approval or plan.

Release Plan and Release Accepted#

Release events can be optionally enhanced by using ‘Release Plan’ and ‘Release Accepted’ events alongside them.

Release Plan events demonstrate an intent to introduce a new release, it should describe which version you want to release and who wants to release it. For example, it could include draft release notes explaining what is being updated and why it should be updated.

Release Accepted events demonstrate an approval on a Release Plan to go forward, it may be that the plan details a need to introduce a fix for a specific vulnerability and the security team is needed to sign off the release going forward.

These events are not essential to the process so can be omitted in a standard or minimal deployment but they are actively encouraged. As they should not affect the information about the latest Software Package Release there should be no Asset Attributes included, other NTIA attributes may also not be necessary or not available until release (e.g. Component Hash).

The Key Attribute that should be recorded is the version of the release that is being planned and accepted.

Release Plan#

Release Plan Event Attribute Namespace#

The sbom_planned_ prefix is used to designate attributes that are part of the event. Some of these are interpreted by DataTrails and others are guidelines.

Release Accepted Event#

Release Accepted Event Attribute Namespace#

The sbom_accepted_ prefix is used to designate attributes that are part of the event. Some of these are interpreted by DataTrails and others are guidelines.

Patch Event#

Patches are often supplied to customer in an Out-Of-Band procedure to address critical bugs or vulnerabilities, usually with a short-term turnaround that can be outside the normal release cadence.

It is typically expected a Patch should contain its own SBOM separate to the Primary SBOM.

Patch Event Attribute Namespace#

The sbom_patch_ prefix is used to designate attributes that are part of the event. Some of these are interpreted by DataTrails and others are guidelines.

Vulnerability Disclosure and Update#

These Event types are used for vulnerability management. The first is to disclose knowledge of a vulnerability and the second is to update the status of the vulnerability after investigation is complete.

Vulnerability Disclosure Event Attribute Namespace#

The vuln_ prefix is used to designate attributes that are part of the event. All of these are interpreted by DataTrails.

Vulnerability Disclosure#

Vulnerability Update#

EOL Event#

EOL Event Attribute Namespace#

The sbom_eol_ prefix is used to designate attributes that are part of the event. All of these are interpreted by DataTrails.

An event to mark the Package as End of Life.