The safeguards map / 1.1 Code and dependencies
BOMHort
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A Kubernetes-native platform that ingests SPDX and CycloneDX SBOMs and checks their licenses against a policy and their packages against OSV.
Where it sits
1.1 Code and dependencies (primary): Reads SPDX and CycloneDX SBOMs, checks package licenses against a permissive and copyleft policy with reviewed exceptions, and looks packages up in OSV.
an externalized permissive/copyleft policy, SPDX expression evaluation, and reviewed exceptions that reload live and apply retroactively to every SBOM already ingested.
captured
Ingest 1000+ SPDX and CycloneDX SBOMs
captured
OSV batch lookups at ingest, plus a daily refresher
captured
Facts
- Concern
- securitylegal
- Names the law
- no
- Subject
- software
- Used by
- those who make itthose who run it
- Runs
- at runtime
Handoffs
consumes Software and AI inventory: SPDX
consumes Software and AI inventory: CycloneDX
consumes Vulnerability status: OSV
consumes Vulnerability status: OpenVEX
Collector's note
The repository owner is seebom-labs, not the OpenSSF organization; the home rests on the project's row in the OpenSSF TAC table, which lists this repository. Formerly named SeeBOM.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.