Should we add another default SBOM importer?

[jcrossley3]

We only have the RHT one now. If there was another big repo of SBOM's somewhere, we might explore the limits of trustify by importing them.

[jcrossley3]

from @JimFuller-RedHat

I had a look around for sbom corpuses https://sbombenchmark.dev has a few k
spdx has examples https://github.com/spdx/spdx-examples/tree/master/software
every github project generates an sbom
and we can run syft
cyclonedx https://github.com/CycloneDX/bom-examples

[JimFuller-RedHat]

the sbombenchmark.dev exposes an api

https://sbombenchmark.dev/api/data?draw=1&columns%5B0%5D%5Bdata%5D=file_url&columns%5B0%5D%5Bname%5D=&columns%5B0%5D%5Bsearchable%5D=true&columns%5B0%5D%5Borderable%5D=false&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B1%5D%5Bdata%5D=target_name&columns%5B1%5D%5Bname%5D=&columns%5B1%5D%5Bsearchable%5D=true&columns%5B1%5D%5Borderable%5D=true&columns%5B1%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B1%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B2%5D%5Bdata%5D=score&columns%5B2%5D%5Bname%5D=&columns%5B2%5D%5Bsearchable%5D=true&columns%5B2%5D%5Borderable%5D=false&columns%5B2%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B2%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B3%5D%5Bdata%5D=spec&columns%5B3%5D%5Bname%5D=&columns%5B3%5D%5Bsearchable%5D=false&columns%5B3%5D%5Borderable%5D=true&columns%5B3%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B3%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B4%5D%5Bdata%5D=format&columns%5B4%5D%5Bname%5D=&columns%5B4%5D%5Bsearchable%5D=false&columns%5B4%5D%5Borderable%5D=true&columns%5B4%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B4%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B5%5D%5Bdata%5D=creator&columns%5B5%5D%5Bname%5D=&columns%5B5%5D%5Bsearchable%5D=true&columns%5B5%5D%5Borderable%5D=true&columns%5B5%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B5%5D%5Bsearch%5D%5Bregex%5D=false&order%5B0%5D%5Bcolumn%5D=1&order%5B0%5D%5Bdir%5D=desc&start=0&length=10&search%5Bvalue%5D=&search%5Bregex%5D=false&_=1727715463266

guessing the start and length would allow one to get to the download urls

though I just found https://github.com/interlynk-io/sbomex which is a kind of cli against that repository ... thats probably the way to go.

[JimFuller-RedHat]

lastly - sqlite database with list of sboms and their file url - https://github.com/interlynk-io/sbomdb?tab=readme-ov-file