omnibor-rs

This project is a work in progress and is not ready for any use beyond experimental.

OmniBOR is a draft standard for creating (and optionally embedding in a binary) a record of cryptographic hashes for all build inputs for a software artifact. It is intended to serve as a complement to Software Bills of Material (SBOMs) like SPDX or CycloneDX, by saying not just what dependencies a project has, but what exact inputs went into an artifact's production.

This repository contains two Rust crates:

• omnibor: an implementation of the OmniBOR specification.
• gitoid: an implement of Git Object Identifiers (GitOids), the mechanism OmniBOR uses for hashing inputs.

Using from Other Languages

The gitoid crate exposes a Foreign Function Interface (FFI), and can be used as the basis for implementing GitOID generation and matching in other languages.

This interface uses cbindgen to generate the header file, and the gitoid crate is configured to generate a library file suitable for linking from other languages.

An example of how to build and link with gitoid from other languages is given in gitoid/Makefile.

Contributing

We're happy to accept contributions!

For bug fixes and minor changes to the implementation, feel free to open an issue in the issue tracker explaining what you'd like to fix, and then open a Pull Request with the change.

For larger design changes, you may also want to discuss the changes either in the issue tracker or on the #omnibor channel on the Open Source Security Foundation (OpenSSF) Slack workspace.

License

The omnibor and gitoid crates are both Apache 2.0 licensed. You can read the full license text in the LICENSE file.