OpenChain Telco SBOM Guide

The telecom industry's OpenChain Telco Workgroup has published its own Telco specific SBOM recommendations.
Interlynk
June 10, 2024
Photo by Diana den Held on Unsplash

Software Bill of Materials (SBOM) enable organizations to identify vulnerabilities, track open-source usage, and ensure compliance with obligations.

However, each industry and their software production and consumption habits can have its own industry specific requirements.

The telecom industry realized this and OpenChain Telco workgroup was created in May 2021 to address industry's unique SBOM requirements.

Powered by participation from industry giants - Ericsson, Nokia, Huawei, KDDI Corporation, Fujitsu, Toshiba, Sony, Bosch among others - the working group aimed to recommend specific SBOM data-format, identify key fields in the format and criteria for distributing SBOM.

The OpenChain working group has released SBOM Guide Version 1.0 aimed at creating consensus for a quality Software Bill of Materials (SBOM).

Requirements

Specifications

  • SPDX 2.2 (verified against SPDX 2.2.1)
  • SPDX 2.3

File Formats

  • Tag:Value
  • JSON

Required Elements

Document creation information

SBOM Build Information

  • The Creator field must contain an Organization value
  • The Creator field must contain a Tool name and its version
  • The CreatorComment field must contain SBOMType information as defined by CISA

Package information

Scope information

  • Must include all open-source components including transitive components
  • Should include all commercial components
  • Must include all "known unknown" components

Relationships Information

  • Relationships: at DESCRIBES and CONTAINS, needed by “NTIA SBOM Minimum elements”

Timining of SBOM Delivery

  • The SBOM SHALL be delivered no later than at the time of the delivery of the software (in either binary or source form).

Method of SBOM delivery

  • Embed in the software package (if feasible) OR
  • Web-hosted version available to copy and store for at least 18-months (if not feasible)

SBOM Verification

  • Recommended to include a digital signature of the SBOM in order to ensure integrity of the SBOM

SBOM Merger

  • A conformant SBOM can be built using sever SBOM files using SPDX relationships

Interlynk for OpenChain Telco SBOM Conformance

Interlynk has open source multi-spec utility sbomqs  is widely used for SBOM's quality and conformity against NTIA-Minimum Elements and BSI TR-03183-2.

Now we are actively working on adding support for OpenChain Telco SBOM conformance and this post will be updated to reflect that.