| Name | ntia-conformance-checker JSON |
| Version |
2.0.0
JSON |
| download |
| home_page | None |
| Summary | Check SPDX SBOM for NTIA minimum elements |
| upload_time | 2024-04-29 19:58:57 |
| maintainer | None |
| docs_url | None |
| author | None |
| requires_python | >=3.8 |
| license | Apache-2.0 |
| keywords |
spdx
sbom
ntia
|
| VCS |
 |
| bugtrack_url |
|
| requirements |
No requirements were recorded.
|
| Travis-CI |
No Travis.
|
| coveralls test coverage |
No coveralls.
|
[](https://github.com/spdx/ntia-conformance-checker/actions)
[](https://badge.fury.io/py/ntia-conformance-checker)
[](https://badge.fury.io/py/ntia-conformance-checker)
# NTIA Conformance Checker
This tool determines whether a [SPDX](https://spdx.dev/) software bill of materials (SBOM) document contains the National Telecommunications and Information Administration (NTIA) ["minimum elements."](https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf) The mapping of the NTIA elements required data fields to the SPDX specification can be found [here](https://spdx.github.io/spdx-spec/v2.3/how-to-use/#k22-mapping-ntia-minimum-elements-to-spdx-fields).
The minimum elements include:
- Supplier Name
- Component Name
- Version of the Component
- Other Unique Identifiers
- Dependency Relationship
- Author of SBOM Data
- Timestamp
As defined by the NTIA, the minimum elements are "the essential pieces that support basic SBOM functionality and will serve as the foundation for an evolving approach to software transparency."
## Installation
To install use the following command:
`pip install ntia-conformance-checker`
Alternatively, just clone the repo and install dependencies using the following commands:
```bash
git clone https://github.com/spdx/ntia-conformance-checker.git
cd ntia-conformance-checker
pip install .
```
The tool requires Python 3 (3.8+). It is recommended to use a virtual python environment especially
if you are using different versions of python. `virtualenv` is a tool for setting up virtual python environments which
allows you to have all the dependencies for the tool set up in a single environment, or have different environments set
up for testing using different versions of Python.
## CLI Usage
```
Usage: ntia-checker [OPTIONS]
Options:
--file TEXT The file to be parsed
--output [print|json] Output format [default: print]
-v, --verbose Use verbose printing
--output_path TEXT Filepath for optionally storing output.
-h, --help Show this message and exit.
```
The user can then analyze a particular file:
```bash
ntia-checker --file sbom.json
```
To generare the output in machine-readable JSON, run:
```bash
ntia-checker --file sbom.spdx --output json
```
## Usage as a Library
`ntia-conformance-checker` can also be imported as a library. For example:
```python
import ntia_conformance_checker as ntia
sbom = ntia.SbomChecker("SBOM_filepath")
print(sbom.ntia_minimum_elements_compliant)
```
Additional properties and methods associated with `SbomChecker()` can be found in [`sbom_checker.py`](ntia_conformance_checker/sbom_checker.py).
# History
This is the result of an initial [Google Summer of Code (GSoC)](https://summerofcode.withgoogle.com/) contribution in 2022 by
[@linynjosh](https://github.com/linynjosh) and is maintained
by a community of SPDX adopters and enthusiasts.
# License
[Apache-2.0](LICENSE)
# Dependencies
* [spdx-tools](https://pypi.org/project/spdx-tools/) used for parsing the SPDX SBOM.
# Support
* Submit issues, questions or feedback at https://github.com/spdx/ntia-conformance-checker/issues
* Join the discussion on https://lists.spdx.org/g/spdx-tech and https://spdx.dev/participate/tech/
# Contributing
Contributions are very welcome! See [CONTRIBUTING.md](./CONTRIBUTING.md) for instructions on how to contribute to the codebase.
# Further help
Check out the [frequently asked questions](FAQ.md) document.
Raw data
{
"_id": null,
"home_page": null,
"name": "ntia-conformance-checker",
"maintainer": null,
"docs_url": null,
"requires_python": ">=3.8",
"maintainer_email": "John Speed Meyers <johnmeyersster@gmail.com>, Gary O'Neall <gary@sourceauditor.com>, Josh Lin <linynjosh@gmail.com>, SPDX group at the Linux Foundation and others <spdx-implementers+owner@lists.spdx.org>",
"keywords": "spdx, sbom, ntia",
"author": null,
"author_email": "Josh Lin <linynjosh@gmail.com>, John Speed Meyers <johnmeyersster@gmail.com>",
"download_url": "https://files.pythonhosted.org/packages/b0/5f/dc11a7887468c3be3741010bb12dd1a9b1f378bc2890e735b58ad64e092e/ntia_conformance_checker-2.0.0.tar.gz",
"platform": null,
"description": "[](https://github.com/spdx/ntia-conformance-checker/actions)\n\n[](https://badge.fury.io/py/ntia-conformance-checker)\n[](https://badge.fury.io/py/ntia-conformance-checker)\n\n# NTIA Conformance Checker\n\nThis tool determines whether a [SPDX](https://spdx.dev/) software bill of materials (SBOM) document contains the National Telecommunications and Information Administration (NTIA) [\"minimum elements.\"](https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf) The mapping of the NTIA elements required data fields to the SPDX specification can be found [here](https://spdx.github.io/spdx-spec/v2.3/how-to-use/#k22-mapping-ntia-minimum-elements-to-spdx-fields).\n\nThe minimum elements include:\n- Supplier Name\n- Component Name\n- Version of the Component\n- Other Unique Identifiers\n- Dependency Relationship\n- Author of SBOM Data\n- Timestamp\n\nAs defined by the NTIA, the minimum elements are \"the essential pieces that support basic SBOM functionality and will serve as the foundation for an evolving approach to software transparency.\"\n\n## Installation\n\nTo install use the following command:\n\n`pip install ntia-conformance-checker`\n\nAlternatively, just clone the repo and install dependencies using the following commands:\n\n```bash\ngit clone https://github.com/spdx/ntia-conformance-checker.git\ncd ntia-conformance-checker\npip install .\n```\n\nThe tool requires Python 3 (3.8+). It is recommended to use a virtual python environment especially\nif you are using different versions of python. `virtualenv` is a tool for setting up virtual python environments which\nallows you to have all the dependencies for the tool set up in a single environment, or have different environments set\nup for testing using different versions of Python.\n\n## CLI Usage\n\n```\nUsage: ntia-checker [OPTIONS]\n\nOptions:\n --file TEXT The file to be parsed\n --output [print|json] Output format [default: print]\n -v, --verbose Use verbose printing\n --output_path TEXT Filepath for optionally storing output.\n -h, --help Show this message and exit.\n```\n\nThe user can then analyze a particular file:\n\n```bash\nntia-checker --file sbom.json\n```\n\nTo generare the output in machine-readable JSON, run:\n\n```bash\nntia-checker --file sbom.spdx --output json\n```\n\n## Usage as a Library\n\n`ntia-conformance-checker` can also be imported as a library. For example:\n\n```python\n\nimport ntia_conformance_checker as ntia\n\nsbom = ntia.SbomChecker(\"SBOM_filepath\")\n\nprint(sbom.ntia_minimum_elements_compliant)\n```\n\nAdditional properties and methods associated with `SbomChecker()` can be found in [`sbom_checker.py`](ntia_conformance_checker/sbom_checker.py).\n\n# History\n\nThis is the result of an initial [Google Summer of Code (GSoC)](https://summerofcode.withgoogle.com/) contribution in 2022 by\n[@linynjosh](https://github.com/linynjosh) and is maintained\nby a community of SPDX adopters and enthusiasts.\n\n# License\n\n[Apache-2.0](LICENSE)\n\n# Dependencies\n\n* [spdx-tools](https://pypi.org/project/spdx-tools/) used for parsing the SPDX SBOM.\n\n# Support\n\n* Submit issues, questions or feedback at https://github.com/spdx/ntia-conformance-checker/issues\n* Join the discussion on https://lists.spdx.org/g/spdx-tech and https://spdx.dev/participate/tech/\n\n# Contributing\n\nContributions are very welcome! See [CONTRIBUTING.md](./CONTRIBUTING.md) for instructions on how to contribute to the codebase.\n\n# Further help\n\nCheck out the [frequently asked questions](FAQ.md) document.\n",
"bugtrack_url": null,
"license": "Apache-2.0",
"summary": "Check SPDX SBOM for NTIA minimum elements",
"version": "2.0.0",
"project_urls": {
"Homepage": "https://github.com/spdx/ntia-conformance-checker"
},
"split_keywords": [
"spdx",
" sbom",
" ntia"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "61107d33afba4437890ff554659f1078378f1285d1ffe95eb5baa61df0afbf6b",
"md5": "a6a402654620560dad0f5cb3fe220f63",
"sha256": "6bf4b77279670e22f24b3b320f99083c3a586ee003516c7f8ea91f32ed4f3f13"
},
"downloads": -1,
"filename": "ntia_conformance_checker-2.0.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "a6a402654620560dad0f5cb3fe220f63",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=3.8",
"size": 11603,
"upload_time": "2024-04-29T19:58:54",
"upload_time_iso_8601": "2024-04-29T19:58:54.916689Z",
"url": "https://files.pythonhosted.org/packages/61/10/7d33afba4437890ff554659f1078378f1285d1ffe95eb5baa61df0afbf6b/ntia_conformance_checker-2.0.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "b05fdc11a7887468c3be3741010bb12dd1a9b1f378bc2890e735b58ad64e092e",
"md5": "b248004d98b91b9ce15005a4c02f5801",
"sha256": "8fc0878e3273302f80aa49b03b310ac35acdb6ad836c37c2a76dfea3432c2c4d"
},
"downloads": -1,
"filename": "ntia_conformance_checker-2.0.0.tar.gz",
"has_sig": false,
"md5_digest": "b248004d98b91b9ce15005a4c02f5801",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.8",
"size": 3963031,
"upload_time": "2024-04-29T19:58:57",
"upload_time_iso_8601": "2024-04-29T19:58:57.278770Z",
"url": "https://files.pythonhosted.org/packages/b0/5f/dc11a7887468c3be3741010bb12dd1a9b1f378bc2890e735b58ad64e092e/ntia_conformance_checker-2.0.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-04-29 19:58:57",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "spdx",
"github_project": "ntia-conformance-checker",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"lcname": "ntia-conformance-checker"
}
