diff --git a/www/templates/sbom/index.html b/www/templates/sbom/index.html new file mode 100644 index 0000000..77cf055 --- /dev/null +++ b/www/templates/sbom/index.html @@ -0,0 +1,120 @@ +{% extends 'layouts/base.html' %} +{% load i18n %} +{% load static %} +{% load encore %} + +{% block title %}{% translate 'AlmaLinux OS - SBOM' %}{% endblock %} +{% block description %} + {% translate 'ELevate enables migration between major versions of RHEL(r) derivatives. Easily go from CentOS 7.x to any 8.x of your choice' %}{% endblock %} + +{% block head_end %} + {% encore_entrypoint_css 'page_elevate' %} +{% endblock %} +{% block body_end %} + {% encore_entrypoint_js 'page_elevate' %} +{% endblock %} + +{% block body %} +
+
+

AlmaLinux Software Bill of Materials (SBOM) Information

+
+ {% if post.featured_image %} +
+ {{ post.title }} +
+ {% endif %} +
+

+ AlmaLinux provides a Software Bill of Materials (SBOM) for its releases. +

+

What is an SBOM?

+

+ SBOM, which stands for Software Bill of Materials, is something akin to an “ingredient list” for a +codebase. It helps identify the contents of software, including what open source and third-party +components are used, licensing information, components' versions and if there are any known +vulnerabilities in those components. +

+

+ The SBOM is the “ingredient list”, the code are the ingredients, the build system is the “kitchen” +where those ingredients get built into the final piece of software which you consume. +

+

+ Why are SBOMs important? +

+

+ Open source software is used extensively in applications, but it has led to the discovery of high- +profile hacks and vulnerabilities. SBOMs are meant to provide the community and users of open +source with even more transparency, and an efficient way to identify (in the case of a risk) +individual files, libraries, dependencies, etc. thereby increasing the trust and confidence in the +use of open source software. +

+

+ The Linux Foundation thinks so too… +

+

+ The Linux Foundation and open source Security Foundation (OpenSSF) have also produced a +plan called the Source Software Security Mobilization Plan which calls for industry action +to develop software component frameworks, including SBOMs, to expedite discovery of and +response to future vulnerabilities like Log4j. +

+

+ ...And the president himself +

+

+ An SBOM has been spotlighted as a key part of the solution presented by the president in the Executive Order on Improving the Nation’s Cybersecurity. +

+
+ "the term “Software Bill of Materials” or “SBOM” means a formal record containing +the details and supply chain relationships of various components used in building +software. Software developers and vendors often create products by assembling +existing open source and commercial software components. The SBOM +enumerates these components in a product. It is analogous to a list of +ingredients on food packaging." +
+

+ What AlmaLinux Provides +

+

+ The AlmaLinux Build System has implemented SBOM into the pipeline for the reasons listed above, to enable: +

+
    +
  • Tracing the whole build process from pulling sources from CentOS git repositories to releasing a verified and signed package in the public repository
    • +
  • Making the build pipeline more secure like ensuring that only trusted sources are used for builds, avoiding attack consequences, etc
    • +
  • Reducing the number of ways of data corruption
    • +
+

How are we doing this?

+

AlmaLinux is leveraging Codenotary’s open source Community Attestation Service (CAS) to provide administrators with authentication, verification and full SBOM visibility.

+
    +
  • CAS stores all signatures inside of immudb, the standard for open source for + immutable databases, used by some of the world’s leading companies and + governments.
    • +
  • CAS is protected against tampering. All attestation data is integrity-checked and + cryptographically verified by the CAS client. No one can change this data, not + AlmaLinux or anyone else.
    • +
  • CAS is also protected against MITM attacks. The encryption key is client-side + verified and checked before every communication.
    • +
+

Getting Started

+

For more information, see the Almalinux wiki: https://github.com/AlmaLinux/build-system/wiki/Codenotary-SBOM-integration

+
+
+
+ {% if previous_post %} + + {% translate '« Previous' %} + + {% endif %} + + {% if next_post %} + + {% translate 'Next »' %} + + {% endif %} +
+
+
+{% endblock %} diff --git a/www/urls.py b/www/urls.py index 04b4ddd..32081e3 100755 --- a/www/urls.py +++ b/www/urls.py @@ -17,6 +17,7 @@ urlpatterns = [ path('feed/', BlogPostFeed(), name='feed'), path('media-link/', views.media_element, name='media_element'), path('elevate', views.elevate, name='elevate'), + path('sbom', views.sbom, name='sbom'), path('ELevate', RedirectView.as_view(url='elevate'), name='ELevate'), path('certified/amd-ryzen-may2022/', views.certified_index, name="certified_index_page") -] +] \ No newline at end of file diff --git a/www/views.py b/www/views.py index 15c799a..84cb4f4 100755 --- a/www/views.py +++ b/www/views.py @@ -220,6 +220,10 @@ def media_element(_: HttpRequest, media_id: int) -> HttpResponse: def elevate(request: HttpRequest) -> HttpResponse: return render(request, 'elevate/index.html', {}) +@require_safe +@never_cache +def sbom(request: HttpRequest) -> HttpResponse: + return render(request, 'sbom/index.html', {}) def not_found(request: HttpRequest, exception: Exception) -> HttpResponse: return render(request, '404.html', status=404)