GH-500 · Question #87
What is the exportable SBOM format created by the dependency graph on GitHub?
The correct answer is D. All of the above. GitHub's dependency graph supports exporting a Software Bill of Materials (SBOM) in multiple industry-standard formats, providing flexibility for different compliance and toolchain needs.
Question
What is the exportable SBOM format created by the dependency graph on GitHub?
Options
- ACycloneDX.
- BSPDX.
- CSWID.
- DAll of the above.
How the community answered
(29 responses)- A3% (1)
- B3% (1)
- D93% (27)
Why each option
GitHub's dependency graph supports exporting a Software Bill of Materials (SBOM) in multiple industry-standard formats, providing flexibility for different compliance and toolchain needs.
CycloneDX is only one of the supported SBOM export formats; selecting it alone ignores the equally valid SPDX and SWID formats also supported by the dependency graph.
SPDX is only one of the supported SBOM export formats; selecting it alone ignores the equally valid CycloneDX and SWID formats also supported by the dependency graph.
SWID is only one of the supported SBOM export formats; selecting it alone ignores the equally valid SPDX and CycloneDX formats also supported by the dependency graph.
The GitHub dependency graph supports exporting SBOMs in all three formats - SPDX, CycloneDX, and SWID - allowing organizations to satisfy various regulatory, compliance, and tool integration requirements by choosing the format that fits their ecosystem.
Concept tested: SBOM export formats supported by GitHub dependency graph
Source: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exporting-a-software-bill-of-materials-for-your-repository
Topics
Community Discussion
No community discussion yet for this question.