SW360 as an SBOM management tool

[arunazhakesan]

Wanted to discuss on the requirements and ideas for making SW360 able to manage SBOMS.

[heliocastro]

Do you have some examples of other BOM management tools ? Is a good approach to see what is around us now .

[KoukiHama]

DependencyTrack is SBOM management tool?
https://dependencytrack.org/

[KoukiHama]

for Example, cyclone dx have many usecase.
which use case should sw360 support?
https://cyclonedx.org/use-cases/

[KoukiHama]

I just come up with an idea.
It might be nice to have the ability to sign the SBOMs that SW360 outputs.
https://spdx.dev/a-step-by-step-guide-to-signing-an-spdx-sbom-with-sigstores-cosign/