NTIA Conformance Checker

This tool determines whether a SPDX software bill of materials (SBOM) document contains informational items as required by a certain specification.

Currently, the only supported specification is the 2021 National Telecommunications and Information Administration (NTIA) "minimum elements." The mapping of the NTIA elements required data fields to the SPDX 2.3 specification can be found here.

The minimum elements include:

• Supplier Name
• Component Name
• Version of the Component
• Other Unique Identifiers
• Dependency Relationship
• Author of SBOM Data
• Timestamp

As defined by the NTIA, the minimum elements are "the essential pieces that support basic SBOM functionality and will serve as the foundation for an evolving approach to software transparency."

Checking the conformance with 2024 Framing Software Component Transparency (FSCT3) "Baseline Attributes" is experimental and under development. The mapping of FSCT3 Baseline Attributes to ISO/IEC 5962:2021 (SPDX 2.2.1) and SPDX 3.0 can be found at Section 2.5 of the FSCT3 document.

In addition to information similar to NTIA minimum elements, FSCT3 also requires these Baseline Attributes:

• License
• Copyright Holder

Installation

Installation Method #1: Install from the Python Package Index (PyPI) with pip.

pip install ntia-conformance-checker

Installation Method #2: Install locally. Clone the repo and install dependencies using the following commands:

git clone https://github.com/spdx/ntia-conformance-checker.git
cd ntia-conformance-checker
pip install .

The tool requires Python 3 (3.8+). It is recommended to use a virtual python environment especially if you are using different versions of python. virtualenv is a tool for setting up virtual python environments which allows you to have all the dependencies for the tool set up in a single environment, or have different environments set up for testing using different versions of Python.

CLI Usage

Usage: sbomcheck [OPTIONS]

Options:
  --file TEXT            The file to be parsed
  --comply [fsct3-min|ntia]
                         Specify which compliance standard to check against
                         - fsct3-min: FSCT3 Baseline Attributes-Minimum Expected
                         - ntia: NTIA minimum elements
                         [default: ntia]
  --output [html|json|print|quiet]
                         Output format  [default: print]
  --output_path TEXT     Filepath for optionally storing output.
  --skip-validation      Specify whether to skip validation
  -v, --verbose          Use verbose printing
  --version              Display version of ntia-conformance-checker
  -h, --help             Show this message and exit.

The user can then analyze a particular file:

sbomcheck --file sbom.json

To generate the output in machine-readable JSON, run:

sbomcheck --file sbom.spdx --output json

Usage as a Library

ntia-conformance-checker can also be imported as a library. For example:

from ntia_conformance_checker import SbomChecker

sbom_checker = SbomChecker("SBOM_filepath")

print(sbom_checker.compliant)

Additional properties and methods can be found in BaseChecker class at base_checker.py. Specific properties and methods for a particular specification can be found at the checker for that specification. For example, NTIAChecker class at ntia_checker.py.

History

This is the result of an initial Google Summer of Code (GSoC) contribution in 2022 by @linynjosh and is maintained by a community of SPDX adopters and enthusiasts.

License

Apache-2.0

Dependencies

• spdx-tools used for parsing the SPDX SBOM.

Support

• Submit issues, questions or feedback at https://github.com/spdx/ntia-conformance-checker/issues
• Join the discussion on https://lists.spdx.org/g/spdx-tech and https://spdx.dev/participate/tech/

Contributing

Contributions are very welcome! See CONTRIBUTING.md for instructions on how to contribute to the codebase.

Further help

Check out the frequently asked questions document.