Repository navigation
SBOMit Roadmap
Yuchen Zhang edited this page Jul 9, 2025
·
2 revisions
- Neutrality: SBOMit is now officially hosted under the Linux Foundation’s OpenSSF sandbox, reinforcing neutrality and open governance.
- Support: Tooling guidance has been initiated with early adopters like TestifySec and BOMCtl, demonstrating practical integration pathways.
- Inclusivity: Held the first SBOMit Workshop in Washington, D.C., engaging diverse voices from academia, industry, and government.
- Preliminary: ✅ Completed — Established an initial community through the OpenSSF sandbox and early workshop event.
- Short-Term: ✅ Completed/Ongoing — Engaged stakeholders through KubeCon Japan 2025 and initiated subcommittee discussions around specification and tooling.
- Mid-Term: In Progress — Advancing Phase 2 tooling and engaging maintainers of SPDX and CycloneDX for interoperability alignment.
- Long-Term: Planned — Broaden steering committee participation, develop sector-specific feedback loops (e.g., financial services, healthcare).
- Sustainability: Planned — Move toward a contributor-driven maintenance model, supported by open-source best practices.
- Representation from NYU, University of Maryland, TestifySec, BOMCtl, and OpenSSF.
- Active collaboration with at least three tooling providers and early adopters within the first year.
- Prioritize adoption through practical integrations and targeted outreach at security and policy conferences.
- Use partnerships with institutional players like DTCC and engagement with regulators to shape policy-aligned use cases.
- Preliminary: ✅ Completed — Initiated cross-sector partnerships including DTCC (finance) and conversations with government bodies (e.g., CISA).
- Short-Term: ✅ Completed/Ongoing — Engaged early adopters in the education and compliance space; integrated into NYU’s VIP course.
- Mid-Term: In Progress — Development of Phase 2 tooling to support more advanced use cases; begin drafting learning materials for onboarding.
- Long-Term: Planned — Host the second SBOMit workshop or mini-conference; launch a public knowledge base and case study library.
- Sustainability: Planned — Build a self-sustaining user base and recurring contributor programs with support from community-led steering.
- Adoption demonstrated through BOMCtl integration and pilot feedback from DTCC and Maryland.
- Training over 35 students at NYU (undergrad + grad) with real-world contributions.
- Early experimentation exposed inconsistencies in SBOM enrichment and tooling expectations, emphasizing the need for clear, stable specifications.
- Use SBOMit spec version 0.1.0 as the foundation for feedback, with a structured SIP (SBOMit Improvement Proposal) process and alignment with SPDX/CycloneDX communities.
- Preliminary: ✅ Completed — Released version 0.1.0 of the SBOMit specification.
- Short-Term: ✅ Completed/Ongoing — Started collecting implementer feedback and established the initial SIP process.
- Mid-Term: In Progress — Plan to release version 0.2.0 incorporating interoperability input; start formal conformance guidance and interoperability testing with BOMCtl/TestifySec.
- Long-Term: Planned — Work toward international standardization (e.g., through OpenSSF, SPDX WG); introduce a conformance toolkit and shared testing infrastructure.
- Sustainability: Planned — Mature the specification and SIP system into a stable, community-driven process.
- Specification tracked via GitHub, with active issues and update cadence.
- Early implementation and feedback cycles ongoing; no critical conformance issues identified with current adopters.