Skip to content
Open
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions tools/glaas.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
{
"$schema": "https://cyclonedx.org/schema/tool-center-v2.tool.schema.json",
"specVersion": "2.0",
"tool": {
"name": "GLaaS",
"publisher": "TReqs Inc.",
"description": "GLaaS (Global Lineage-as-a-Service) pairs with the open-source roar CLI to trace ML pipeline lineage and generate CycloneDX 1.7 AI-BOMs, scored for completeness against G7, CISA, and NTIA SBOM-for-AI minimum elements.",
"repository_url": "https://github.com/treqs/roar",
"website_url": "https://glaas.ai",
"capabilities": [
"AI/ML-BOM"
],
"availability": [
"FREEMIUM",
"SUBSCRIPTION"
],
"functions": [
"AUTHOR",

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AUTOR seams not right for an automated tool.

https://cyclonedx.github.io/tool-center/tool.html#tool_functions

AUTHOR - Tools that human authors can use to create CycloneDX BOMs.

Suggested change
"AUTHOR",

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @jkowalleck, I can remove the Author designation if that seems clearer. It's not clear which bucket(s) our tool fall into.

Our tool has two parts:

  1. roar - a CLI tool to automatically capture runtime activity, track (inputs, outputs, other characteristics). So for example, if an data source is attributed to contain PII, that gets propagated to downstream artifacts. So it's "automatic" in terms of tracking the connections, but involves some manual process for tagging and labeling.
  2. GLaaS - an online registry for roar activity. GLaaS scans the roar activity to provide CycloneDX 1.7 export. So it generates the AI-BOM but is not an editor. It has some analytical features in that it provides a completeness score/breakdown and point to ways for users to increase AI-BOM coverage.

If it's helpful, I can provide more of this detail in the description.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so it his not a tool for authors. please remove it, then.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it's helpful, I can provide more of this detail in the description.

feel free to do so.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed AUTHOR from function field.
Added DISTRIBUTE which I believe is more accurate.

"ANALYSIS"
],
"analysis": [
"LICENSE_REPORTING",
"POLICY_EVALUATION",
"RESOURCE_REPORTING"
],
"packaging": [
"COMMAND_LINE_UTILITY",
"APPLICATION"
],
"library": [
"PYTHON",
"RUST"
],
"platform": [
"LINUX",
"MAC"
],
"lifecycle": [
"BUILD",
"POST-BUILD"
],
"supportedStandards": [
"CYCLONEDX"
],
"cycloneDxVersion": [
"CYCLONEDX_V1.7"
]
}
}