Details
-
Task
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
None
-
None
Description
The current file format for the SBOM files for MaxScale are provided only in .tgz format which are not compatible for automated security tooling.
Issue:
- The Security team’s vulnerability scanning tools are configured to locate SBOMs using the pattern:
{product}/**/{version}/**/*.cdx.json
- .tgz-formatted SBOMs are not recognized or scanned, which creates a gap in automated security coverage.
MaxScale SBOMs should be made available in the .cdx.json format, similar to how it is published for MariaDB Enterprise Server.