top of page
  • Julian Coccia

SCANOSS: Setting the SCA Standard with SBOM Uniformity



In the intricate world of software supply chains, SBOM-related 'friction' is a common hurdle as SBOMs traverse through various stages. Traditionally, part of this friction stemmed from non-conformity to standard formats like SPDX and CycloneDX. While the adoption of these standards has become more widespread, alleviating some challenges, a more pervasive issue persists: the varied results produced by the multitude of commercial and Open Source SCA tools used throughout the supply chain. Each tool, employing its own technique to compile an SBOM, inevitably leads to discrepancies in SBOM outputs. This variation spawns significant back-and-forth discussions as parties attempt to reconcile the 'declared' SBOM with the 'found' SBOM at each supply chain juncture. SCANOSS addresses this challenge head-on by enabling uniform SBOM production and validation across the supply chain, significantly reducing friction and fostering trust in the software's integrity. 

  

As SCANOSS cements its position as the de-facto standard in Open Source component detection for Software Composition Analysis (SCA), our commitment to delivering the most accessible and accurate Software Bills of Materials (SBOMs) stands out. This blog explores how our approach to uniformity, particularly through integrations with Open Source SCA tools like ORT, Fossology and FOSSlight as well as commercial tools, is reshaping what to expect from SCA tools.  



Uniformity Through Integration: ORT, Fossology and FOSSlight, and Beyond 


At SCANOSS, we achieve SBOM uniformity along the software supply chain by integrating with popular open-source tools SCA such as ORT (OSS Review Toolkit), Fossology and FOSSlight, and a growing list of commercial SCA tools. These integrations are pivotal because they utilize the same scanning engine and knowledge base that SCANOSS employs. This means that regardless of the tool used within the software supply chain, the generated SBOMs are consistent, complete, and reliable. This all but eliminates the ‘friction’ associated with reconciling SBOM results as software moves through the software supply chain. 



Example: How It Works 


Consider a scenario where a vendor uses ORT to create an initial SBOM and then transmits that software to a third party who uses FOSSlight, say. With SCANOSS as the underlying engine in both ORT and Fosslight, both tools will yield identical results in terms of identified declared and undeclared components. This consistency is crucial in ensuring that every team member, regardless of the tool they prefer, has the same comprehensive understanding of the software's composition and risks.  



The Impact of Uniform SBOMs 


This uniformity is more than just a technical achievement; it has profound implications for the software development process: 


- Efficiency: It eliminates the time-consuming task of reconciling differing SBOMs from various tools. 

- Trust: Uniform results across tools mean that teams can trust the supply chain data they are working with, regardless of the source. 

- Reduced Friction: Consistent SBOMs cut out supply chain friction, streamlining the development and compliance process. 



Why Uniformity Matters 


In the current landscape, where software development often involves a myriad of tools, the uniformity offered by SCANOSS is invaluable. It ensures that teams can switch between tools without the worry of inconsistent data, making the development process smoother and more efficient. 

 


Establishing the De-facto Standard with SCANOSS 


By democratizing and standardizing Software Composition Analysis (SCA) SCANOSS is redefining the SCA field by becoming the industry's de-facto standard for component detection. Our commitment to delivering uniformly complete and accurate SBOMs across a range of tools and stages sets a new industry precedent. This standard emphasizes the need for thorough and consistent analysis in today's fast-paced and security-focused development landscape. For users, this means aligning with a leader in SCA, ensuring top-tier reliability and precision in their software development endeavours. The SCANOSS standard is not just about excellence; it's about shaping the future of software composition practices. 

  

In conclusion, SCANOSS’s integration with tools like ORT, Fosslogy and FOSSlight exemplifies our commitment to uniformity in SBOM results. This approach not only enhances efficiency and trust in software supply chains but also positions SCANOSS as a leader in the SCA space, paving the way for more informed and seamless software development practices. 


To learn more about how SCANOSS is a De-facto and what that means for you, book a short call with us here.

Comments


bottom of page