An artifact tree can be represented as a tree with the nodes identified by an artifact id.

flowchart BT
    Artifact-2[Artifact-2 ID] --> Artifact-1[Artifact-1 ID]
    Artifact-3[Artifact-3 ID] --> Artifact-1[Artifact-1 ID]
    Artifact-4[Artifact-4 ID] --> Artifact-2[Artifact-2 ID]
    Artifact-5[Artifact-5 ID] --> Artifact-2[Artifact-2 ID]
    Artifact-6[Artifact-6 ID] --> Artifact-3[Artifact-3 ID]
    Artifact-7[Artifact-7 ID] --> Artifact-3[Artifact-3 ID]

OmniBOR advocates for using the gitoid of an artifact as its artifact id:

flowchart BT
    Artifact-2[Artifact-2 gitoid] --> Artifact-1[Artifact-1 gitoid]
    Artifact-3[Artifact-3 gitoid] --> Artifact-1[Artifact-1 gitoid]
    Artifact-4[Artifact-4 gitoid] --> Artifact-2[Artifact-2 gitoid]
    Artifact-5[Artifact-5 gitoid] --> Artifact-2[Artifact-2 gitoid]
    Artifact-6[Artifact-6 gitoid] --> Artifact-3[Artifact-3 gitoid]
    Artifact-7[Artifact-7 gitoid] --> Artifact-3[Artifact-3 gitoid]

OmniBOR Document

The parent-child relationship is captured by a set of OmniBOR Documents.

Each artifact has a OmniBOR document that describes its immediate children consiting of a set of new line delimited records, one for each child, in lexical order.

A child artifact which is itself a leaf artifacts would be represented by

blob⎵${gitoid of child}\n

A child artifact which is itself a derived artifact would be represented by

blob⎵${gitoid of child}⎵bom⎵${gitoid of child's OmniBOR document}\n

Example:

flowchart BT
    Artifact-2[Artifact-2 gitoid] --> Artifact-1[Artifact-1 gitoid]
    Artifact-3[Artifact-3 gitoid] --> Artifact-1[Artifact-1 gitoid]
    Artifact-4[Artifact-4 gitoid] --> Artifact-2[Artifact-2 gitoid]
    Artifact-5[Artifact-5 gitoid] --> Artifact-2[Artifact-2 gitoid]
    Artifact-6[Artifact-6 gitoid] --> Artifact-3[Artifact-3 gitoid]
    Artifact-7[Artifact-7 gitoid] --> Artifact-3[Artifact-3 gitoid]

Artifact-2’s OmniBOR:

blob⎵${gitoid of Artifact-4}\n
blob⎵${gitoid of Artifact-5}\n

Artifact-3’s OmniBOR:

blob⎵${gitoid of Artifact-6}\n
blob⎵${gitoid of Artifact-7}\n

Artifact-1’s OmniBOR:

blob⎵${gitoid of Artifact-2}⎵bom⎵${gitoid of Artifact-2's OmniBOR}\n
blob⎵${gitoid of Artifact-3}⎵bom⎵${gitoid of Artifact-2's OmniBOR}\n

OmniBOR Identifier

For a given artifact, the OmniBOR ID of that artifact is simply the gitoid of its corresponding OmniBOR Document.

OmniBOR Identifier Embedding

OmniBOR advocates for build tools to embed into each derived artifact they are building that derived artifact’s OmniBOR ID.

Examples:

ELF Files (Executables and .so, and .o files)

Embed OmniBOR identifier into an elf section named ‘.bom’

ar Files (.a static libraries)

Embed OmniBOR identifier into an archive entry named ‘.bom’

General Archive files (tar,gzip,etc)

Embed OmniBOR identifier into an archive entry named ‘.bom’

Java class file

Embed OmniBOR identifier into an annotation named @BOM in the .class file.

Python .pyc files

Embed OmniBOR identifier into an bom in the .pyc file.

Container Images

Embed OmniBOR identifier into the image manifest as an annotation named “dot.bom”

Generated Source Code

Embed OmniBOR identifier for a generated source code file using a comment

OmniBOR Compliments SBOM

OmniBOR can help SBOMs be more precise and reliable.

See SBOM: OmniBOR Compliments SBOMs for further details.