feat: Add AIBoMGen tooling

[wiebe-vandendriessche]

Adds three CycloneDX tool entries for the AIBoMGen project by IDLab, Ghent University, imec:

• AIBoMGen: proof-of-concept platform for generating trustworthy AIBOMs during distributed AI model training
• AIBoMGen CLI: Go CLI tool for scanning repositories for Hugging Face model usage and generating CycloneDX AIBOMs
• AIBoMGen CLI Action: GitHub Action wrapping the AIBoMGen CLI for use in CI/CD pipelines

All three target the CycloneDX AI/ML-BOM capability.

[jkowalleck]

I dont see how an SBOM generator acts as a transformer.
could you elaborate on this?

https://cyclonedx.github.io/tool-center/#tools_items_functions

Tools that can analyze CycloneDX BOMs.

[wiebe-vandendriessche]

This cli tool is able to generate AI/ML BOMs in both xml and json format and is able to merge SBOMs with AI/ML BOM components. I understood that merging is a form of "transformation".

[jkowalleck]

I understood that merging is a form of "transformation".

but what about analysis?

[wiebe-vandendriessche]

The CLI tool can perform validation and check AIBOM completeness, returning a full report of missing or required fields and a completeness score.

[jkowalleck]

The CLI tool can perform validation and check AIBOM completeness, returning a full report of missing or required fields and a completeness score.

then please describe this capability in the description.

[wiebe-vandendriessche]

@jkowalleck updated the description

[wiebe-vandendriessche]

Hey @jkowalleck, quick note on the functions field across the three entries:
Current state:

Tool	Functions
AIBoMGen	AUTHOR, SIGNING/NOTARY
AIBoMGen CLI	AUTHOR, ANALYSIS, TRANSFORM
AIBoMGen CLI Action	AUTHOR

The schema defines AUTHOR as:

"Tools that human authors can use to create CycloneDX BOMs."

All three tools generate BOMs automatically (from training runs or repository scans) not interactively by a human author.
However AIBoMGen and AIBoMGen-cli tool are also able to "enrich" the BOMs with author defined metadata using a form.
Should I remove Author for all 3?

Proposed:

Tool	Functions
AIBoMGen	SIGNING/NOTARY (platform signs BOMs)
AIBoMGen CLI	ANALYSIS, TRANSFORM (validate, check completeness, merge with SBOM)
AIBoMGen CLI Action	N/A? (anything i can add here?)

[jkowalleck]

Should I remove Author for all 3?

yes, please.

[wiebe-vandendriessche]

Should I remove Author for all 3?

yes, please.

Sure, no problem! I'll remove AUTHOR from all three entries right away. Thanks for taking the time to review and clarify :)

[jkowalleck]

I understood that merging is a form of "transformation".

but what about analysis?

[wiebe-vandendriessche]

@jkowalleck
The CLI tool can perform validation and check AIBOM completeness, returning a full report of missing or required fields and a completeness score.

[wiebe-vandendriessche]

I really don’t want to rush you, but I was wondering if you might be able to merge this soon. I’d really love to highlight its inclusion in the CycloneDX Tool Center in an upcoming demo for a EU project I’m involved in.

[jkowalleck]

merged, tool center website was updated.

I’d really love to highlight its inclusion in the CycloneDX Tool Center in an upcoming demo for a EU project I’m involved in.

What is this program called and what is it about?
You might want to get in touch with Vinod on the CDX slack (invite: https://cyclonedx.org/slack/invite), maybe we can boot the outreach of your work even a bit more.

---

in the meantime, let me check why the tools/aibomgen.json was not picked up.
PS: seams about fixed

[wiebe-vandendriessche]

What is this program called and what is it about? You might want to get in touch with Vinod on the CDX slack (invite: https://cyclonedx.org/slack/invite), maybe we can boot the outreach of your work even a bit more.

Thanks for merging!

I’m a PhD researcher at IDLab, Ghent University, imec, and we’re a partner in the CRACY project, which helps SMEs meet CRA compliance where SBOMs will be mandatory for all software/hardware on the EU market.

Part of the project is providing tooling that enhances and boosts SBOM practices. My PhD research focuses on AIBOMs to secure the AI lifecycle, and the tooling I contributed is part of the CRACY project’s effort to deliver SBOM-enhancing FOSS tools.

I’ve already joined some OWASP AIBOM project meetings. I’m not yet sure how closely they’ll align with the CycloneDX standard (they probably should), but I’ll make sure to stay updated. I’ve also seen that the OWASP GenAI team has developed an AIBOM tool with functionality similar to my AIBoMGen CLI tool, so it could be interesting to explore potential collaboration or alignment there.

I joined the CycloneDX Slack :)
Looking forward to further contribute