Have ScanCode output conformant to OpenChain Telco SBOM Guide

[vargenau]

Short Description

OpenChain Telco SBOM Guide is available at https://openchainproject.org/news/2024/09/10/nokia-contributes-validator-for-the-openchain-telco-sbom-guide

To make it conformant, the following information should be added.

Currently, we have (in tag:value):

Creator: Tool: scancode-toolkit 32.2.1

We should have:

Creator: Tool: scancode-toolkit 32.2.1
Creator: Organization: nexB

And add the CISA SBOM type:

CreatorComment: CISA SBOM type: Source

Possible Labels

• easy

Select Category

• Enhancement
• Add License/Copyright
• Scan Feature
• Packaging
• Documentation
• Expand Support
• Other

[mjherzog]

ScanCode Toolkit is not limited to scanning source so setting a CISA SBOM Type would depend on what codebase was scanned.

[vargenau]

@mjherzog
What are the other use cases?
Which CISA SBOM Type should be selected in these cases?

[mjherzog]

I am not sure about how much code scanning will make sense for the Design SBOM Type, but SCTK could be used for the Source, Build, Analyzed or Deployed SBOM Types so it seems that this would need to be a variable set from the commands to run SCTK. In ScanCode.io it could be a variable set when you generate the SBOM output from data stored in SCIO.

It seems likely that this is just one of many SBOM-related data values that ScanCode (SCTK or SCIO) cannot determine from the scanned codebase or from the scan. For example, I would also argue that the Creator: Organization: should not be nexB unless it is an SBOM that nexB actually creates. The SBOM creator should be the organization (or person) who ran ScanCode.

[mjherzog]

@vargenau Please see also aboutcode-org/dejacode#175. This issue starts a discussion about defining a new data structure in DejaCode for SBOMs separate from Products. This does not directly impact SCTK because we do not have a Product entity in the SCTK data structures, but it is related because we want/try to implement a shared/common data model across AboutCode modules, especially SCTK, ScanCode.io, DejaCode, VulnerableCode and PURL-DB.