Policy Bundle Documentation

Table of Contents

1. Bundle: prodsec

Version: v1.0.0 Source: https://github.com/project-ncl/mequal-prodsec-policies

1.1. Policy: Teams should use CycloneDX 1.6 and above to use key features (CDX_1_6_PLUS)

Severity: tip Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_1_6_PLUS

Teams who are generating am SBOM will benefit from using CycloneDX version 1.6 and above in order to access key features that make it much easier to represent certain information, such as multiple CPEs and PURLs. This policy gives informational feedback on the advantages of using version CycloneDX 1.6 and above.

1.1.1. Rules

Rule: SBOM is CycloneDX 1.6 and Above (cdx_sbom_is_cdx_1_6_and_above)

Severity: tip Level: Undefined

SBOM is CycloneDX 1.6 and above in order to ensure support of potentially important features.

1.2. Policy: CycloneDX SBOM Uses Ancestors Field (CDX_ANCESTORS)

Severity: tip Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_ANCESTORS

Using the pedigree.ancestors field of a component inside of a CycloneDX SBOM, teams can denote the upstream of a component in the SBOMs they generate. Supported by Trustify.

1.2.1. Rules

Rule: Ancestors Field is Used in CycloneDX SBOM (cdx_ancestors_field_is_used)

Severity: tip Level: Undefined

In a given CycloneDX SBOM, there are components where the pedigree.ancestors relationship is utilized.

1.3. Policy: CycloneDX SBOM has a Main CPE (CDX_CPE)

Severity: tip Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_CPE

An SBOM can have a CPE field that ties it a product.

1.3.1. Rules

Rule: CycloneDX SBOM Has CPE (cdx_main_component_has_cpe)

Severity: tip Level: Undefined

The main component of a CycloneDX SBOM has a CPE.

1.4. Policy: CycloneDX SBOM Makes Valid External References to other SBOMs (CDX_EXTERNALREFS)

Severity: error Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_EXTERNALREFS

When teams produce an SBOM for their product, they will most likely NOT be putting all transitive layers into a single SBOM. This policy would ensure that the references to external SBOMs made are defined using the correct fields and are syntactically correct. Making sure that these references are correctly written is crucial for the relationships to accurately make it into TPA.

1.4.1. Rules

Rule: All Bomlink SBOM References are Valid (cdx_all_sbom_exrefs_valid_bomlink)

Severity: error Level: Undefined

Given an SBOM, ensure that all Bomlink external references to other SBOMs are valid in format.

Rule: All Bom uri SBOM References Have Non-empty URL Fields (cdx_all_sbom_exrefs_nonempty_bomuri)

Severity: error Level: Undefined

Given an SBOM, ensure that all SBOM external references to other SBOMs done using the bom uri field are non-empty in format.

Rule: External SBOM References Used (cdx_sbom_exrefs_used)

Severity: tip Level: Undefined

Given an SBOM, there have been external references identified.

1.5. Policy: CDX_MAINCOMPONENTDUP (CDX_MAINCOMPONENTDUP)

Severity: error Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_MAINCOMPONENTDUP

ProdSec use-cases policy 1. Check if top component is duplicated into the components array in a CycloneDX SBOM.

1.5.1. Rules

Rule: Has top purl in components (cdx_top_purl_in_components)

Severity: error Level: Undefined

Check if the .metadata.component has been duplicated into the components[] array

1.6. Policy: CycloneDX SBOM Contains Multiple CPEs (CDX_MULTICPE)

Severity: tip Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_MULTICPE

A CycloneDX SBOM that is version 1.6 and above has the ability to represent multiple CPEs using the metadata.component.cpe field for the main CPE, and the metadata.component.evidence.identity field for its aliases.

1.6.1. Rules

Rule: CycloneDX SBOM Uses Multi-CPE (cdx_contains_multicpe_example)

Severity: tip Level: Undefined

A given SBOM has a component within it that makes use of the evidence.identity field to define additional CPEs.

1.7. Policy: CycloneDX SBOM Contains Multiple PURLs (CDX_MULTIPURL)

Severity: tip Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_MULTIPURL

A CycloneDX SBOM that is version 1.6 and above has the ability to represent multiple PURLs using .purl field for the main PURL, and the .evidence.identity field for its aliases.

1.7.1. Rules

Rule: CycloneDX SBOM Uses Multi-PURL (cdx_contains_multipurl_example)

Severity: tip Level: Undefined

A given SBOM has a component within it that makes use of the evidence.identity field to define additional PURLs.

1.8. Policy: CycloneDX SBOM Uses Provides Field (CDX_PROVIDES)

Severity: tip Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_PROVIDES

Using the dependencies section of a CycloneDX SBOM, the provides field can be used to specify what specification a certain component implements, or additionally can represent source-to-binary relationships.

1.8.1. Rules

Rule: Provides Field is Used in CycloneDX SBOM (cdx_provides_field_is_used)

Severity: tip Level: Undefined

In a given CycloneDX SBOM, the provides relationship is utilized.

1.9. Policy: Specify the SBOM Type in CycloneDX (CDX_SBOMTYPE)

Severity: warning Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_SBOMTYPE

Teams who are generating an SBOM should define the type of SBOM it is. This can be done using the .metadata.lifecycles field. This policy ensures that different policies can be applied to different SBOM types. This also gives Mequal the option the opportunity to do SBOM evaluation in specific specialized contexts in the future.

1.9.1. Rules

Rule: CycloneDX Metadata.lifecycles Field Exists (cdx_metadata_lifecycles_exists)

Severity: warning Level: Undefined

In a CycloneDX SBOM, the .metadata.lifecycles field exists.

1.10. Policy: CycloneDX SBOM Uses Variants Field (CDX_VARIANTS)

Severity: tip Level: Undefined Path: data.prodsec.policies.cyclonedx.CDX_VARIANTS

Using the pedigree.variants field of a component inside of a CycloneDX SBOM, teams can represent the relationship of the image index container to their respective architectural variants in the CycloneDX SBOMs they generate. Supported by Trustify.

1.10.1. Rules

Rule: Variants Field is Used in CycloneDX SBOM (cdx_variants_field_is_used)

Severity: tip Level: Undefined

In a given CycloneDX SBOM, there are components where the pedigree.variants relationship is utilized.

2. Bundle: mequal

Version: v1.0.0 Source: https://github.com/project-ncl/mequal

2.1. Policy: SBOM either SPDX or CycloneDX (LPOL1)

Severity: Undefined Level: L0 Path: data.mequal.policies.LPOL1

SBOM Level grading policy 1. Check if an SBOM is in either SPDX or CycloneDX format

2.1.1. Rules

Rule: SBOM is SPDX or CycloneDX (sbom_is_spdx_or_cdx)

Severity: error Level: L0 Grading Context Level: L0

Check if the SBOM is either SPDX or CycloneDX

2.2. Policy: SBOMs include a version and a bom-ref, has components (LPOL2)

Severity: error Level: L1 Path: data.mequal.policies.cyclonedx.LPOL2

SBOM Level grading policy 2. Check if all packages in the SBOM include a version and a bom-ref, and has components

2.2.1. Rules

Rule: CDX SBOM has Components (cdx_sbom_has_empty_components_field)

Severity: error Level: L1 Grading Context Level: L1

The CycloneDX SBOM contains components

Rule: CDX SBOM has Components (cdx_sbom_has_no_components_field)

Severity: error Level: L1 Grading Context Level: L1

The CycloneDX SBOM contains components

Rule: CDX SBOM top component has version (cdx_sbom_has_top_component_version)

Severity: error Level: L1 Grading Context Level: L1

The CycloneDX SBOM top component contains a version field

Rule: CDX SBOM Components all have versions (cdx_sbom_all_components_contain_versions)

Severity: error Level: L1 Grading Context Level: L1

The CycloneDX SBOM components all have versions. Checks all components including nested ones.

Rule: CDX SBOM Components all have bom-ref field (cdx_sbom_all_components_have_bomref_field)

Severity: error Level: L1 Grading Context Level: L1

The CycloneDX SBOM components all have bom-ref fields. Checks all components including nested ones.

Rule: CDX SBOM Components all have VALID bom-ref values (cdx_sbom_all_components_have_valid_bomref_value)

Severity: error Level: L1 Grading Context Level: L1

The CycloneDX SBOM components all have valid bom-ref values. Checks all components including nested ones.

2.3. Policy: SBOM includes checksums (LPOL3)

Severity: error Level: L1 Path: data.mequal.policies.cyclonedx.LPOL3

Check if all packages in the CycloneDX SBOM include checksums

2.3.1. Rules

Rule: CDX SBOM all components have hashes field (cdx_sbom_all_components_contain_hashes_field)

Severity: error Level: L1 Grading Context Level: L1

The CycloneDX SBOM components all have hashes field. Checks all components including nested ones.

Rule: CDX SBOM all components have values in their hashes field (cdx_sbom_all_components_contain_hash_values)

Severity: error Level: L1 Grading Context Level: L1

The CycloneDX SBOM components all have values in their hashes field. Checks all components including nested ones.

2.4. Policy: All packages in the SBOM include a version (LPOL2)

Severity: error Level: L1 Path: data.mequal.policies.spdx.LPOL2

Check if all packages in the SBOM include a version

2.4.1. Rules

Rule: SPDX SBOM has a packages field (spdx_sbom_has_packages_field)

Severity: error Level: L1 Grading Context Level: L1

The SPDX SBOM has a packages field.

Rule: SPDX SBOM packages field not empty (spdx_sbom_packages_field_not_empty)

Severity: error Level: L1 Grading Context Level: L1

The SPDX SBOM has a non-empty packages field.

Rule: SPDX SBOM Components all have versions (spdx_sbom_all_components_contain_versions)

Severity: error Level: L1 Grading Context Level: L1

The SPDX SBOM components all have versions.

2.5. Policy: SBOM includes checksums (LPOL3)

Severity: error Level: L1 Path: data.mequal.policies.spdx.LPOL3

Check if all packages in the SPDX SBOM include checksums

2.5.1. Rules

Rule: SPDX SBOM all components have checksums field (spdx_sbom_all_components_contain_checksums_field)

Severity: error Level: L1 Grading Context Level: L1

The SPDX SBOM components all have checksums field.

Rule: SPDX SBOM all components have checksums values (spdx_sbom_all_components_contain_checksums_values)

Severity: error Level: Undefined

The SPDX SBOM components all have checksums values. Only checks flat list