Clément SAILLANT
124906d084
- Introduced multiple guides for workflows including Evidence Pack Validation, Incident Response, Model Validation, Performance & HIL, Release Signing, SBOM Validation, Secret Scanning, and Supply Chain Attestation. - Created dynamic badges for each workflow to reflect their status and compliance. - Implemented a checklist for validating CI/CD workflows and evidence packs. - Developed scripts for building firmware, testing, collecting evidence, and generating audit reports. - Added tools for generating community, documentation, quality, and security badges based on various reports. - Established endpoints for dynamic badges to be integrated into documentation and README files. - Enhanced the overall structure and traceability of CI/CD processes with evidence packs and automated checks.
840 B
840 B
Guide Workflow SBOM Validation
Objectif
Assurer la transparence et la conformité des dépendances logicielles via la génération et la validation d’un SBOM (Software Bill of Materials).
Outils utilisés
- CycloneDX
- SPDX
- Trivy
- Snyk
Logique du workflow
- Génération du SBOM à chaque build
- Analyse de vulnérabilités et conformité des dépendances
- Publication du SBOM et des rapports
Critères de conformité
- SBOM généré et accessible
- Dépendances sans vulnérabilités critiques
- Evidence pack mis à jour
Badge dynamique
- Endpoint JSON : docs/badges/sbom_validation_badge.json
- Intégration dans README
Vérification
- Le badge doit afficher le statut SBOM et vulnérabilités
- Les rapports sont accessibles dans les artefacts CI