软件物料清单必要字段、实例参考.docx

《软件物料清单必要字段、实例参考.docx》由会员分享，可在线阅读，更多相关《软件物料清单必要字段、实例参考.docx（9页珍藏版）》请在优知文库上搜索。

1、附录A（资料性）软件物料清单必要字段软件物料清单必要字段如表A.1所示。表AJ软件物料清单必要字段元素名字段名字段描述字段类型软件信息softwaresoftWareName软件名称stringSoftwareVersion软件版本stringintegrityhashAlg杂凑算法stringHiessageDigest消息摘要string清单信息documentCormatName清单格式名称stringformatVersion格式版本stringSerialNumber清单标识stringtimestamp时间戳stringauthors创建者string组件信息componentsC

2、omponentId组件标识stringcomponentName组件名称stringComponcntVersion组件版本stringseifDeve1OpedProportion自研比例enum(ofstring)1IcenseName许可证名称arrayofstringintegrityhashAlg杂凑算法stringmessageDigest消息摘要string内部依赖信息dependenciesi(IentityAId依赖标识引用stringrelationship关系arrayofstringidentityBId被依赖标识引用string生命周期维护中断风险disruptio

3、nsdisruptionld中断标识stringUisruptionType中断类型stringaffectedbject影响对象string表A.1（续）元素名字段名字段描述字段类型生命周期维护中断风险disruptionsdescription风险描述stringdisposal处置情况booleanestimatedTime预计中断时间string签名信息integritySignatureFile签名文件stringHigitalCertificateFiIe数字证书文件string附录B(资料性)软件物料清单实例参考B.1软件信息JSON格式示例：a)定制化开发或商业采购软件：(“s

4、oftware”:“SoftwareName:MyApp”,“SoftwareYersion:1.2.0”,“integrity”:hashAlg:MD5,z，messageDigest，/：z/fc3aa394c8787e019eda27be38d65cdfzz),“supplier”:“supplierName:supplierA”,supplerType:agent,area:China,“developer”:z,developerAz,)“IicenseName:CommercialAgreementA”“authorizationTerm:2024T171”)b)开源软件：(“so

5、ftware”:“softwareName:UyApp”,“softwareVersion:1.2.0,“integrity”:hashAlg:MD5,messageDigest:fc3aa394c8787e019eda27be38d65cdf”),“acquisitionchannel”:z,openSourceCommunityz,“IicenseName”:,Apache-2.O”)JSON格式示例：(“document”:formatName:SBOMDF”,“formatVersion:1.0，serialNumbcrzz:urn:uuid:f47acl0b-58cc-4372-a5

6、67-0e02b2c3d479,lifecycle:commit,timestamp:2024-01-1010:00:00,authors”:*SBOMDFCreatorA*,z,createToolsz,:AutomationToolv2.1”,z,downloadUrlz,:“httpsB.3组件信息JSON格式示例：a)定制化开发或商业采购软件：“components”:(componentId:lib-001”,“ComponentName:1.ogging1.ibrary”,yzComponentVersionzr:25”,z,componentDescription:1.ibrar

7、yforapplicationlogging.z,yzSelfDevelopedProportionz,:none,“regidentifier:cpe:/a:microsoft:SqlSerVer:6.5，importance”:核心组件”，“security”:经过三方机构安全检测”，“supplier”:zSupplierNamezr:supplierA”,“supplierType:integrator”,“Marea:China,“developer:developerA”,)language:Java,“IicenseName:CommercialAgreementB”,“down

8、IoadUrl”:*https:/logcorp.COnI/1OgTib”,“homePgaeUrl”:z,https:/logcorp.COn,“completeness:known”,integrity:hashAlg:MD5”,messageDigestz,:z,d41d8cd98f00b204e9800998ecf8427ez,),)b)开源软件：(components*:(“componentId:lib-001”,componentName,“1.ogging1.ibrary,“componentversion:25”,z,componentDescriptionz,:“1.ibr

9、aryforapplicationlogging.*,z,SelfDeveIopedProportion:none,“regidentifier”:z,cpe:/a:microsoft:sq1_server:6.5”,z,importance*:核心组件”，security:经过开源社区安全审查”，“acquisitionchannel:openSourceCommunity”,language:Java,“IicenseName”:zzApache1.icense2.0”,downIoadUrlzr:*https:/logcorp.COm/1OgTib”,“homePgae:https:/l

10、ogcorp,com”,“completeness:known”,“integrity”:hashAlg:MD5,“messageDigest:d41d8cd98f00b204e9800998ecf8427e),)B.4文件信息JSON格式示例：(“files:(fileld:file-00,IileNanie:syslog.java,“fiIePath”:/src/com/myappsyslog.java”,zpurpose：实现软件日志信息生成的源代码文件”，“integrity”:hashAlg：MD5”,“messageDigest:03ac674216f3el5c761eela5e2

11、55f067”),B.5代码片段信息JSON格式示例：(4厂snippets:1.(“snippetld:snippet-001”,“snippetFile:*/srccom/myapp/Main.java”,zbyteStartPointerz,:100,zbyteEndPointerz,:200,IineStartPointer”:10,IineEndPointerz,:20,“snippetSource:OpensourceprojectA”,“snippetUrl:http:WWw.0penSourceCommunity.orgprojectA/homepage*,“IicenseNa

12、me:Apache1.icense2.0，integrity:hashAlg:MD5,“messageDigest”:z,a8a06469b6d584543e5619746e3d62cl4zz),)B.6内部依赖信息JSON格式示例：(“dependencies”:(*identityAId*:lib-001”,“relationship:dependsn”,“identityBId:lib-002),(*identityAId:file-001，“relationship:contains”,identityBId:snipPet-Oo1”),)B.7外部网络服务信息JSON格式示例：(”s

13、ervices:1.(“serviceld:service-Oo1”,“serviceNam。”：AuthenticationService”,“substitutability”:false,“supplier”:z,supplierName:paymentserviceprovider*,area:China,),“serviceUrl:https:auth.servicecorp.COnlapi”,serviceArea”:国内计算环境”，z,serviceProtocolz,:http,“dataDescription”:包含电话、身份证、银行卡号等个人隐私信息”,)B.8基础环境信息

14、JSoN格式示例：(“platform”:(“assetld”:,java-runtime*,“assetName”:,JavaRuntimeEnvironment*,“assetVersion:v8.0,“substitutability”:false,“source:https:java,com”,“supplier”:*supplierNamez,:“Javaprovider*,area:China,)JSON格式示例：(“dcvelopmcntTools”:(toolld:tool-001，z,toolNamez,:IDE”,“toolTypc”:代码编辑器，z,toolVcrsion:v5.3,purpose:编辑源代码”，),B.10网络服务接口信息JSON格式示例：(“interfaces”:(interfaced”:INT-00,“interfaceType:Restful”,description”