{"id":15032154,"url":"https://github.com/omnibor/omnibor-rs","last_synced_at":"2025-04-07T06:07:38.741Z","repository":{"id":42679064,"uuid":"462479827","full_name":"omnibor/omnibor-rs","owner":"omnibor","description":"Reproducible identifiers \u0026 fine-grained build dependency tracking for software artifacts.","archived":false,"fork":false,"pushed_at":"2025-02-07T22:55:34.000Z","size":598,"stargazers_count":25,"open_issues_count":16,"forks_count":8,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-03-31T04:08:29.519Z","etag":null,"topics":["omnibor","rust","sbom"],"latest_commit_sha":null,"homepage":"https://omnibor.io","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/omnibor.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-02-22T21:25:47.000Z","updated_at":"2025-02-12T09:44:07.000Z","dependencies_parsed_at":"2023-11-14T17:31:41.423Z","dependency_job_id":"5d1132e6-f6a1-4c5b-930c-490d2969d4d3","html_url":"https://github.com/omnibor/omnibor-rs","commit_stats":{"total_commits":269,"total_committers":6,"mean_commits":"44.833333333333336","dds":"0.29368029739776946","last_synced_commit":"b9c2ad0099c1c7645a311e3135beb8384a8a22c8"},"previous_names":["git-bom/gitbom-rs"],"tags_count":23,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/omnibor%2Fomnibor-rs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/omnibor%2Fomnibor-rs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/omnibor%2Fomnibor-rs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/omnibor%2Fomnibor-rs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/omnibor","download_url":"https://codeload.github.com/omnibor/omnibor-rs/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247601448,"owners_count":20964864,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["omnibor","rust","sbom"],"created_at":"2024-09-24T20:17:32.671Z","updated_at":"2025-04-07T06:07:38.722Z","avatar_url":"https://github.com/omnibor.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n\u003cbr\u003e\n\n\u003cimg alt=\"OmniBOR Logo\" width=\"400rem\" src=\"https://raw.githubusercontent.com/omnibor/omnibor-rs/main/assets/omnibor-logo.svg\"\u003e\n\n\u003cbr\u003e\n\n__Reproducible identifiers \u0026amp; fine-grained build dependency tracking for software artifacts.__\n\n[![Website](https://img.shields.io/badge/website-omnibor.io-blue)](https://omnibor.io) [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/omnibor/omnibor-rs/blob/main/LICENSE)\n\n\u003c/div\u003e\n\n## What is OmniBOR?\n\n[OmniBOR][omnibor] is a draft specification which defines two key concepts:\n\n- __Artifact Identifiers__: independently-reproducible identifiers for\n  software artifacts.\n- __Artifact Input Manifests__: record the IDs of every input used in the\n  build process for an artifact.\n\nArtifact IDs enable _anyone_ to identify and cross-reference information for\nsoftware artifacts without a central authority. Unlike [pURL][purl] or [CPE][cpe],\nOmniBOR Artifact IDs don't rely on a third-party, they are _inherent\nidentifiers_ determined only by an artifact itself. They're based on\n[Git's Object IDs (GitOIDs)][gitoid] in both construction and choice of\ncryptographic hash functions.\n\nArtifact Input Manifests allow consumers to reconstruct Artifact Dependency\nGraphs that give _fine-grained_ visibility into how artifacts in your\nsoftware supply chain were made. With these graphs, consumers could\nin the future identify the presence of exact files associated with known\nvulnerabilities, side-stepping the complexities of matching version numbers\nacross platforms and patching practicies.\n\n[__You can view the OmniBOR specification here.__][omnibor_spec]\n\nThe United States Cybersecurity \u0026 Infrastructure Security Agency (CISA),\nidentified OmniBOR as a major candidate for software identities\nin its 2023 report [\"Software Identification Ecosystem Option\nAnalysis.\"][cisa_report]\n\n## What's in this Repository?\n\n| Crate Name    | Type                                                      | Purpose                                   | Links                                                                                                           |\n|:--------------|:----------------------------------------------------------|:------------------------------------------|:----------------------------------------------------------------------------------------------------------------|\n| `omnibor`     | ![Library](https://img.shields.io/badge/Library-darkblue) | OmniBOR Identifiers and Manifests         | [README][omnibor_r] \u0026middot; [Changelog][omnibor_c] \u0026middot; [API Docs][omnibor_d] \u0026middot; [Crate][omnibor_cr] |\n| `omnibor-cli` | ![Binary](https://img.shields.io/badge/Binary-darkgreen)  | CLI for OmniBOR Identifiers and Manifests | [README][omnibor_cli_r] \u0026middot; [Changelog][omnibor_cli_c] \u0026middot; [Crate][omnibor_cli_cr]                    |\n| `xtask`       | ![Binary](https://img.shields.io/badge/Binary-darkgreen)  | OmniBOR Rust Workspace Automation         | [README][xtask_r]                                                                                               |\n\n## Contributing\n\n__We happily accept contributions to any of the packages in this repository!__\n\nAll contributed commits _must_ include a Developer Certificate of Origin\nsign-off (use the `--signoff` flag when running `git commit`). This is checked\nby Continuous Integration tests to make sure you don't miss it! You can\n[learn more on the DCO website][dco].\n\nContributors do not sign any Contributor License Agreement. Your contributions\nremain owned by you, licensed for use in OmniBOR under the terms of the Apache\n2.0 license.\n\nCheck out the full [Contributing Guide][contributing] to learn more!\n\n## Discussions \u0026 Support\n\nIf you've encountered [specific bugs][bugs] or have specific\n[feature requests][features], we recommend opening issues in the\n[issue tracker][issues]!\n\nHowever, if you have more open-ended ideas, want to ask questions\nabout OmniBOR or the OmniBOR Rust implementation, or want to get support\ndebugging an issue you've encountered, we recommend opening a new\n[discussion][discussion].\n\nIf you believe you've found a security vulnerability, please\n[report it to us][vuln].\n\n## Security\n\nThe project maintains an official [Security Policy][security] and accepts\nsecurity disclosures through GitHub.\n\n## Code of Conduct\n\nAll discussions, issues, pull requests, and other communication spaces\nassociated with this project require participants abide by the project's\n[Code of Conduct][coc] (Contributor Covenant 2.0).\n\n## License\n\nAll crates in this repository are Apache 2.0 licensed. You can read the full\nlicense text in the [`LICENSE`][license] file.\n\n[contributing]: CONTRIBUTING.md\n[cbindgen]: https://github.com/eqrion/cbindgen\n[cisa_report]: https://www.cisa.gov/sites/default/files/2023-10/Software-Identification-Ecosystem-Option-Analysis-508c.pdf\n[cpe]: https://nvd.nist.gov/products/cpe\n[gitoid]: https://git-scm.com/book/en/v2/Git-Internals-Git-Objects\n[license]: https://github.com/omnibor/omnibor-rs/blob/main/LICENSE\n[omnibor]: https://omnibor.io\n[omnibor_cr]: https://crates.io/crates/omnibor\n[omnibor_r]: https://github.com/omnibor/omnibor-rs/blob/main/omnibor/README.md\n[omnibor_c]: https://github.com/omnibor/omnibor-rs/blob/main/omnibor/CHANGELOG.md\n[omnibor_d]: https://docs.rs/crate/omnibor/latest\n[omnibor_cli_r]: https://github.com/omnibor/omnibor-rs/blob/main/omnibor-cli/README.md\n[omnibor_cli_c]: https://github.com/omnibor/omnibor-rs/blob/main/omnibor-cli/CHANGELOG.md\n[omnibor_cli_cr]: https://crates.io/crates/omnibor-cli\n[omnibor_spec]: https://github.com/omnibor/spec\n[purl]: https://github.com/package-url/purl-spec\n[xtask_r]: https://github.com/omnibor/omnibor-rs/blob/main/xtask/README.md\n[dco]: https://developercertificate.org/\n[security]: https://github.com/omnibor/omnibor-rs/blob/main/SECURITY.md\n[coc]: https://github.com/omnibor/omnibor-rs/blob/main/CODE_OF_CONDUCT.md\n[bugs]: https://github.com/omnibor/omnibor-rs/issues/new?assignees=\u0026labels=\u0026projects=\u0026template=bug_report.md\u0026title=\n[features]: https://github.com/omnibor/omnibor-rs/issues/new?assignees=\u0026labels=\u0026projects=\u0026template=feature_request.md\u0026title=\n[issues]: https://github.com/omnibor/omnibor-rs/issues\n[discussion]: https://github.com/omnibor/omnibor-rs/discussions\n[vuln]: https://github.com/omnibor/omnibor-rs/security/advisories/new\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fomnibor%2Fomnibor-rs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fomnibor%2Fomnibor-rs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fomnibor%2Fomnibor-rs/lists"}