Skip to content

Add GLaaS to tool center#119

Open
jongeyer wants to merge 2 commits into
CycloneDX:mainfrom
treqs:add-glaas-tool
Open

Add GLaaS to tool center#119
jongeyer wants to merge 2 commits into
CycloneDX:mainfrom
treqs:add-glaas-tool

Conversation

@jongeyer

@jongeyer jongeyer commented Jul 9, 2026

Copy link
Copy Markdown

Summary

  • Adds GLaaS (Global Lineage-as-a-Service) to the tool center.
  • GLaaS pairs with the open-source roar CLI to trace ML pipeline lineage and generate CycloneDX 1.7 AI-BOMs, scored for completeness against G7, CISA, and NTIA SBOM-for-AI minimum elements.
  • For more details, see glaas.ai, https://pypi.org/project/roar-cli/ and treqs.ai
  • Validated tools/glaas.json against schemas/tool.schema.json with check-jsonschema

@jongeyer jongeyer requested a review from a team as a code owner July 9, 2026 16:57
GLaaS (Global Lineage-as-a-Service) generates CycloneDX 1.7 AI-BOMs
from ML pipeline lineage tracked by the open-source roar CLI, with
completeness scoring against G7/CISA/NTIA SBOM-for-AI minimum elements.

Signed-off-by: Jon Geyer <jon@treqs.ai>

@jkowalleck jkowalleck left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for adding the tool.
I have some remarks

Comment thread tools/glaas.json Outdated
"SUBSCRIPTION"
],
"functions": [
"AUTHOR",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AUTOR seams not right for an automated tool.

https://cyclonedx.github.io/tool-center/tool.html#tool_functions

AUTHOR - Tools that human authors can use to create CycloneDX BOMs.

Suggested change
"AUTHOR",

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @jkowalleck, I can remove the Author designation if that seems clearer. It's not clear which bucket(s) our tool fall into.

Our tool has two parts:

  1. roar - a CLI tool to automatically capture runtime activity, track (inputs, outputs, other characteristics). So for example, if an data source is attributed to contain PII, that gets propagated to downstream artifacts. So it's "automatic" in terms of tracking the connections, but involves some manual process for tagging and labeling.
  2. GLaaS - an online registry for roar activity. GLaaS scans the roar activity to provide CycloneDX 1.7 export. So it generates the AI-BOM but is not an editor. It has some analytical features in that it provides a completeness score/breakdown and point to ways for users to increase AI-BOM coverage.

If it's helpful, I can provide more of this detail in the description.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so it his not a tool for authors. please remove it, then.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it's helpful, I can provide more of this detail in the description.

feel free to do so.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed AUTHOR from function field.
Added DISTRIBUTE which I believe is more accurate.

Signed-off-by: Jon Geyer <jon@treqs.ai>
@jongeyer jongeyer requested a review from jkowalleck July 13, 2026 17:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants