Support scoring category for FSCT, BSI, BS-V2, etc

[viveksahu26]

This issue is to add support of scoring for categories other than NTIA-minimum-elements, such as FSCT, BSI, BSI-V2, etc. Currently score support only category for SBOM compliance NTIA, i.e.

sbomqs score -c NTIA-minimum-elements ../sbomqs/samples/sbomqs-cdx-cgomod.json                        
catScores()
SBOM Quality by Interlynk Score:8.6	components:21	../sbomqs/samples/sbomqs-cdx-cgomod.json
+-----------------------+-------------------------+-----------+--------------------------------+
|       CATEGORY        |         FEATURE         |   SCORE   |              DESC              |
+-----------------------+-------------------------+-----------+--------------------------------+
| NTIA-minimum-elements | comp_with_name          | 10.0/10.0 | 21/21 have names               |
+                       +-------------------------+-----------+--------------------------------+
|                       | comp_with_supplier      | 0.0/10.0  | 0/21 have supplier names       |
+                       +-------------------------+-----------+--------------------------------+
|                       | comp_with_uniq_ids      | 10.0/10.0 | 21/21 have unique ID's         |
+                       +-------------------------+-----------+--------------------------------+
|                       | comp_with_version       | 10.0/10.0 | 21/21 have versions            |
+                       +-------------------------+-----------+--------------------------------+
|                       | sbom_authors            | 10.0/10.0 | doc has 1 authors              |
+                       +-------------------------+-----------+--------------------------------+
|                       | sbom_creation_timestamp | 10.0/10.0 | doc has creation timestamp     |
|                       |                         |           | 2023-05-04T02:34:37-07:00      |
+                       +-------------------------+-----------+--------------------------------+
|                       | sbom_dependencies       | 10.0/10.0 | doc has 11 dependencies        |
+-----------------------+-------------------------+-----------+--------------------------------+

Motivation

• Along with detailed compliance of the SBOM, users are also interested to get a summary of their compliance like above for NTIA. Which gives them clear picture of how many components contains corresponding fields.

[viveksahu26]

Command will be like:

sbomqs score -c bsi-v1 sbom.json 
sbomqs score -c bsi-v2 sbom.json 
sbomqs score -c bsi-v2.1.0 sbom.json 

And o/p would be:

SBOM Quality by Interlynk Score:7.1     components:279  sbom.json
+-----------------------+-------------------------+-----------+-------------------------------------------+
|       CATEGORY        |         FEATURE         |   SCORE   |                  DESC                     |
+-----------------------+-------------------------+-----------+-------------------------------------------+
| BSI-V2                | sbom_vuln_excluded      | 10.0/10.0 | no vulnerability info present             |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | spec_compliant          | 5.0/10.0  | SPDX/CycloneDX version exists, but format |
|                       |                         |           | usage is partially non-deterministic      |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | comp_with_uniq_ids      | 10.0/10.0 | 279/279 have PURLs or CPEs                |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | comp_with_version       | 10.0/10.0 | 279/279 have versions                     |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | sbom_authors            | 10.0/10.0 | author fields present w/ email or URL     |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | sbom_creation_timestamp | 10.0/10.0 | timestamp present and RFC-3339 conformant |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | sbom_dependencies       | 0.0/10.0  | No relationships or attestations found    |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | comp_with_licenses      | 5.0/10.0  | some SPDX license info, partial coverage  |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | comp_with_hashes        | 7.5/10.0  | most have SHA-256, a few are missing      |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | sbom_bomlinks           | 0.0/10.0  | no externalDocumentRefs or bom-links      |
+                       +-------------------------+-----------+-------------------------------------------+
|                       | digital_signatures      | 0.0/10.0  | no digital signature field found          |
+-----------------------+-------------------------+-----------+-------------------------------------------+

Similar prototype for other compliances too.

[viveksahu26]

sbomqs score -c bsi-v1 sbom.json 

SBOM Quality by Interlynk Score:7.1     components:279  sbom.json
+-----------------------+----------------------------+-----------+-------------------------------------------+
|       CATEGORY        |         FEATURE            |   SCORE   |                  DESC                     |
+-----------------------+----------------------------+-----------+-------------------------------------------+
|          BSI-V2       | spec_compliant             | 5.0/10.0  | SPDX/CycloneDX version exists, but format |
|                       |                            |           | usage is partially non-deterministic      |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | sbom_authors               | 10.0/10.0 | doc has 1 author with email or URL        |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | sbom_creation_timestamp    | 10.0/10.0 | doc has creation timestamp                |
|                       |                            |           | 2023-01-12T22:06:03Z                      |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | sbom_dependencies          | 0.0/10.0  | primary comp has 10 dependencies          |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | sbom_with_uri              | 0.0/10.0  | doc has 1 namespace(spdx)  or             |
|                       |                            |           | doc has 1 bom-links(cdx)                  | 
+                       +----------------------------+-----------+-------------------------------------------+
|                       | comp_with_name             | 10.0/10.0 | 279/279 have names                        |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | comp_with_uniq_ids         | 10.0/10.0 | 279/279 have PURLs or CPEs                |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | comp_with_version          | 10.0/10.0 | 279/279 have versions                     |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | comp_with_supplier         | 10.0/10.0 | 27/279 have supplier names                |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | comp_with_licenses         | 5.0/10.0  | 100/279 have license compliant            |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | comp_with_hashes           | 7.5/10.0  | 200/279 have checksum values              |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | comp_with_source_code_uri  | 0.0/10.0  | 0/279 have extRef of type vcs(cdx) or     |
|                       |                            |           | no-deterministic-field (spdx)             |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | comp_with_executable_uri   | 0.0/10.0  | 0/279 have extRef of type distribution(cdx|
|                       |                            |           | 22/279 have comp download location(spdx)  |
+                       +----------------------------+-----------+-------------------------------------------+
|                       | comp_with_source_code_hash | 0.0/10.0  | no-deterministic-field for cdx            |
|                       |                            |           | 20/279 have package verification code(spdx|
+-----------------------+----------------------------+-----------+-------------------------------------------+

@riteshnoronha this would be the complete list of features that bsi-v1 would have.

[viveksahu26]

Similarly, the bsi-v2 would look like:

$ sbomqs score -c bsi-v2 sbom.json 

SBOM Quality by Interlynk Score:7.1     components:279  sbom.json
+-----------------------+------------------------------+-----------+-------------------------------------------+
|       CATEGORY        |         FEATURE              |   SCORE   |                  DESC                     |
+-----------------------+------------------------------+-----------+-------------------------------------------+
|          BSI-V2       | sbom_with_vuln               | 10.0/10.0 | doc has no vulnerability                  |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | spec_compliant               | 5.0/10.0  | SPDX/CycloneDX version exists, but format |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | sbom_build_process           | 0.0/10.0  | doc build process is build type           |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | sbom_authors                 | 10.0/10.0 | doc has 1 author with email or URL        |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | sbom_creation_timestamp      | 10.0/10.0 | doc has creation timestamp                |
|                       |                              |           | 2023-01-12T22:06:03Z                      |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | sbom_dependencies            | 0.0/10.0  | primary comp has 10 dependencies          |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | sbom_with_uri                | 0.0/10.0  | doc has 1 namespace(spdx)  or             |
|                       |                              |           | doc has 1 bom-links(cdx)                  | 
+                       +------------------------------+-----------+-------------------------------------------+
|                       | sbom_with_bomlinks           | 0.0/10.0  | doc has 1 namespace(spdx)  or             |
|                       |                              |           | doc has 1 bom-links(cdx)                  | 
+                       +------------------------------+-----------+-------------------------------------------+
|                       | sbom_signature               | 0.0/10.0  | doc has no signature                      |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_name               | 10.0/10.0 | 279/279 have names                        |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_uniq_ids           | 10.0/10.0 | 279/279 have PURLs or CPEs                |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_version            | 10.0/10.0 | 279/279 have versions                     |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_supplier           | 10.0/10.0 | 27/279 have supplier names                |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_associated_license | 5.0/10.0  | 100/279 have license compliant            |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_concluded_license  | 5.0/10.0  | 100/279 have license compliant            |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_declared_license   | 5.0/10.0  | 100/279 have license compliant            |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_dependencies       | 7.5/10.0  | 200/279 have at least 1 deps              |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_hashes             | 7.5/10.0  | 200/279 have checksum values              |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_source_code_uri    | 0.0/10.0  | 0/279 have extRef of type vcs(cdx) or     |
|                       |                              |           | no-deterministic-field (spdx)             |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_executable_hash    | 7.5/10.0  | 200/279 have executable checksum values   |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_executable_uri     | 0.0/10.0  | 0/279 have extRef of type distribution(cdx|
|                       |                              |           | 22/279 have comp download location(spdx)  |
+                       +------------------------------+-----------+-------------------------------------------+
|                       | comp_with_source_code_hash   | 0.0/10.0  | no-deterministic-field for cdx            |
|                       |                              |           | 20/279 have package verification code(spdx|
+-----------------------+------------------------------+-----------+-------------------------------------------+

[viveksahu26]

@riteshnoronha , similarly above one will be for bsi-v2 .