Start here
Bundle OKF 0.2 · 12 conceitos · jrjsmrtn/software-supply-chain-landscape
Open source Repository Open in the app JSON README (API)
About
# Start here
* [Understanding the Software Supply Chain Landscape](landscape.md) - The map. Read straight through once; everything below is looked *up*.
# Subdirectories
* [bom-types](bom-types/index.md) - The xBOM family: what each variant inventories, and whether it describes an artifact, a deployment or a process.
* [disclosure](disclosure/index.md) - Documents that travel with an artifact saying what it is for, and where it fails.
* [distribution](distribution/index.md) - How a consumer discovers and retrieves a release's artifacts.
* [formats](formats/index.md) - The BOM interchange formats, and the document-level practices that go with them.
* [intelligence](intelligence/index.md) - Vulnerability and lifecycle data, who issues it, and how findings are triaged.
* [licensing](licensing/index.md) - Licence identifiers and expressions, and the practices that make them trustworthy.
* [naming](naming/index.md) - How components and vulnerabilities are identified, and the registries b
Details
- Kind
- OKF bundles
- Topic
- Maps, weather & travel
- Publisher
- jrjsmrtn
- Origin
- okf_github
- Category
- dados
- Version
- 0.2
- Last push
- 2026-09-09T10:43:26Z
- Repository state
- ativo
- Language
- Python
- License
- CC-BY-4.0
- Added
- 2026-09-09 05:03:59
- Updated
- 2026-09-09 05:03:59
- Origin id
jrjsmrtn/software-supply-chain-landscape:knowledge/index.md
README
# Software Supply Chain Landscape Curated, sourced knowledge about the software supply chain — bills of materials, provenance, attestation, vulnerability intelligence, licensing and the tooling around them. Distributed as an [OKF](https://github.com/GoogleCloudPlatform/knowledge-catalog/blob/main/okf/SPEC.md) bundle: one concept per markdown file, YAML frontmatter, no tooling required to read it. ## Start here **[knowledge/landscape.md](knowledge/landscape.md)** is the map — written to be read straight through once, so the individual specifications make sense when you meet them later. Everything else is looked *up* rather than read. Then [knowledge/index.md](knowledge/index.md) for the concept listing. ## What makes this different from a wiki Every concept states where its facts came from, who checked them, and when they expire. | Frontmatter | What it records | |---|---| | `sources` | the specific pages a concept draws on, each with an `id` | | footnotes | per-claim attribution — `[^cdx-cbom]` keys into `sources[].id` | | `verified` | confirmation events; absent means **nobody has checked this** | | `stale_after` | when the concept stops being trustworthy | A footnote whose label is not a `sources[].id` attributes nothing, and a concept past its `stale_after` fails a gate. Both are **enforced by a checker, not asked for in prose** — run on every commit, and again weekly on a schedule. The weekly run is the one that matters for expiry: a concept goes stale with the calendar, on a repository nobody has touched. That discipline came from being burned: an earlier version of this corpus cited project homepages for claims that needed specific pages, and one URL had been written from memory. ## Layout ``` knowledge/ the OKF bundle — everything this repository carries landscape.md the explanation; type: Explanation index.md concept listing, for progressive disclosure log.md what changed in the bundle, and when bom-types/ naming/ formats/ licensing/ intelligence/ provenance/ distribution/ tools/ ``` Knowledge and nothing else. Tooling and decision records live in the meta-project this was extracted from. ## Reading it as an agent The bundle is designed for grounding. `index.md` files exist for progressive disclosure — read those to decide what to load, rather than loading the tree. Concepts cross-link with bundle-relative paths (`/naming/purl.md`), which are interpreted from `knowledge/`. Treat `verified: absent` as unverified. Most of this corpus is migrated prose whose claims have not been re-checked; the concepts that *have* been checked say so. ## Licence **[CC BY 4.0](LICENSES/CC-BY-4.0.txt)** — use it, quote it, build on it, with attribution. Declared per-file in [`REUSE.toml`](REUSE.toml) and enforced by `reuse lint`. Facts drawn from upstream sources remain theirs; each concept names them. The upstream set is permissively licensed throughout — Apache-2.0, CC0-1.0, and US government works — with no share-alike obligation.