Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add optional XML Signature support #10

Closed
stevespringett opened this issue Feb 5, 2019 · 2 comments
Closed

Add optional XML Signature support #10

stevespringett opened this issue Feb 5, 2019 · 2 comments
Assignees
@stevespringett
Labels
ready for review request for comment validated
Milestone
1.1

Comments

@stevespringett
Copy link
Member

This is an enhancement proposal to the CycloneDX specification to add optional support for XML Signature. Signed BOMs can provide integrity validation to ensure the BOM has not been tampered with. This proposal is to add a global <Signature> element in the bom after the list of components. The signature is optional.
@stevespringett stevespringett added this to the 1.1 milestone Feb 5, 2019
@stevespringett stevespringett self-assigned this Feb 5, 2019
stevespringett added a commit that referenced this issue Feb 6, 2019
@stevespringett
#12 #10 Added optional support for XML signature to bom element
9d32f46
stevespringett added a commit that referenced this issue Feb 22, 2019
@stevespringett
#10 #12 Changed explicit allowance of Signature element into allowing…
f4e4aa3 
… any element (in a bom or component) to be included as long as it's within a different namespace. This includes support for XML Signature
@stevespringett
Copy link
Member Author

Included in CycloneDX 1.1

@lock
Copy link

lock bot commented Mar 10, 2020

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@lock lock bot locked as resolved and limited conversation to collaborators Mar 10, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@stevespringett stevespringett

Labels
ready for review request for comment validated
Projects
None yet
Milestone
1.1
Development

No branches or pull requests
1 participant
@stevespringett