Add dependency/SBOM criteria and releveling

[puerco]

This commit updates the dependency criteria to add increasing transparency requirements at each level:

1. Checked in language-native dependency list
2. Simple SBOM
3. SBOM with NTIA/CRA data fields

In addition to the two new ones, OSPS-QA-03 is simplified and releveled to 1.

Signed-off-by: Adolfo García Veytia (Puerco) [email protected]

[SecurityCRob]

i need to adjust the xls to account for this change, but +1

[evankanderson]

Details says "direct and transitive" but criteria says "direct". Which do we require here?

[puerco]

i need to adjust the xls to account for this change,

@SecurityCRob I'm happy to add it to the spreadsheet.
Note that OSPS-QA-11 & OSPS-QA-12 match SSDF PS3, PW4. OSPS-QA-03 is cross referenced to SSDF PO4 and PS1. I think those are not correct, but I didn't want to mess with your original assessment.

[eddie-knight]

I noticed that the first entry needs to be changed to follow our criterion format

[funnelfiasco]

I think we should soften the language in the rationale/details to make it clear that what we're looking for in this criterion is enumeration, not pinning.

On the other hand, if we do want to require some form of pinning at level 1, we need to

1. Update the criterion text to include that
2. Specify what sort of pinning is sufficient (e.g. minimum version, branch/release name, specific version, hash, etc etc etc)

For clarity: my strong preference is to go with the first approach and focus on enumeration at level 1.

[SecurityCRob]

i need to adjust the xls to account for this change,

@SecurityCRob I'm happy to add it to the spreadsheet. Note that OSPS-QA-11 & OSPS-QA-12 match SSDF PS3, PW4. OSPS-QA-03 is cross referenced to SSDF PO4 and PS1. I think those are not correct, but I didn't want to mess with your original assessment.

I'll figure this out today, no worries!