Feature Requests

Support SBOM orchestration, ingestion and verification for windows infra

One use case for an SBOM we would like to see on Harness is the ability to query a specific dependency and be able to see all applications that are using this depedency. If something like a day 0 vulnerability appears in a dependency, then we will be able to flag all applications that are using it. Note: This feature would be best suited to be in the Supply Chain Security module, but since that was not an option above, the Security Testing Orchestration module is the closest one.

Hi Team, We are generating the SBOM & SLSA Attestation steps in the pipeline and we don't want to perform attestation for all branches. Instead, we want to do attestation only for release, master, and main branches. This will help us save resources in Artifactory and Vault

It would be great if you could map the internal package int he Artifact SBOM so that it would show no assertion on the Harness SBOM page

Hi Team, The Harness-Vault connector is not capable of pulling keys from subfolders. It would be great if you could add this feature. We are adding subfolder details in the stage variable to fetch the keys.

In policy violations side-car page, search based on components/licenses defined in the violation rules

Severity of the policy set (warn or block) shown in the policy violations dashboard (Pipeline execution summary)

The name of the policy should also be shown in the Pipeline execution summary. This helps the team to identify which policy sets were violated

A best practice for artifact signing is to support timestamping. Timestamping: To ensure the signature was produced within the certificate's validity window, a timestamp is added to the signed artifact. This will allow us to not fail a verification/validation step if the signing material has changed or expired. Without this, we would need to resign the same artifacts.

integrating something like scorecard to help understand potential issues with opensource package dependencies. https://github.com/ossf/scorecard