Open source projects could sell SBOM fragments

#1

Post by Tomte » Mon, Feb 17, 2025, 4:09 PM UTC

Open source projects could sell SBOM fragments
thomas-huehn.com

Re: Open source projects could sell SBOM fragments

#2

Post by hiatus » Mon, Feb 17, 2025, 4:55 PM UTC

This doesn't make much sense to me. Why would someone want to pay each and every open source project to see the SBoM when they could pay a single provider or use an open source tool to get that info for all of their dependencies?

Re: Open source projects could sell SBOM fragments

#3

Post by transpute » Mon, Feb 17, 2025, 5:00 PM UTC

How would transitive dependencies be handled?

EU CRA is trying to mandate certification of some dependencies, which may result in fees going to 3rd-party certifying orgs, rather than OSS projects.

In theory, customers with budget for improving their OSS supply chain could configure an OSS micropayment allocator to parse a graph of dependent:

  • SBOMs
  • roadmaps
  • requirements
  • bug reports
  • test reports 
  • compliance rules

then distribute funds based on performance metrics defined by each customer. That could move SBOMs from cost center to revenue/operations center, without centralization.

LF OpenSSF 2024 report covers centralized efforts to improve OSS supply chains, https://openssf.org/download-the-2024-openssf-annual-report/

Re: Open source projects could sell SBOM fragments

#4

Post by The28thDuck » Mon, Feb 17, 2025, 5:03 PM UTC

Why not have some sort of VCS provider do something similar to Medium/Substack/etc. where access is generally free but frequently prompts you to subscribe/donate before access?

Re: Open source projects could sell SBOM fragments

#5

Post by hyperpape » Mon, Feb 17, 2025, 5:05 PM UTC

hiatus wrote: post #2

This doesn't make much sense to me. Why would someone want to pay each and every open source project to see the SBoM when they could pay a single provider or use an open source tool to get that info for all of their dependencies?

Right. A significant part of the reason open source wins so handily isn't that the money for a proprietary solution is always more than it's worth, it's that you can just pull open source dependencies without going through purchasing.

Re: Open source projects could sell SBOM fragments

#6

Post by _zagj » Mon, Feb 17, 2025, 5:19 PM UTC

Github or some other third party would Hoover up whatever money could made from this. Also, a lot of projects can be surprisingly sloppy when it comes to this. (For example, treating MIT-licensed code as if it's public domain and neglecting to include the license and copyright notice.)

Re: Open source projects could sell SBOM fragments

#7

Post by andrewflnr » Mon, Feb 17, 2025, 5:33 PM UTC

The28thDuck wrote: post #4

Why not have some sort of VCS provider do something similar to Medium/Substack/etc. where access is generally free but frequently prompts you to subscribe/donate before access?

Because tooling would route around it immediately. Among other reasons, you can't have interactive prompts for support gumming up your CI (and if they're not interactive, then they're trivial to ignore). NPM does something close to this, but it's much more opt-in for the user.