Add hermeto

SBOM-Catalog/public/data.yaml

@@ -39,10 +39,10 @@
   Standards:
     - SPDX
     - CycloneDX
   Summary: 'Syft is an open-source CLI tool and Go library for generating Software
     Bill of Materials (SBOM) from container images and filesystems. The tool supports
     multiple SBOM formats including CycloneDX, SPDX, and its native format. Syft can
     analyze container images, filesystems, and archives to discover packages and dependencies
     across numerous programming language ecosystems.
 
 
@@ -50,11 +50,11 @@
 
     - Generates SBOMs for OCI, Docker, and Singularity container images
 
     - Supports multiple output formats (CycloneDX, SPDX, GitHub dependency snapshots)
 
     - Linux distribution identification
 
     - Package detection for over 20 ecosystems including Java, Python, Go, and Node.js
 
     - Integration with Grype vulnerability scanner
 
@@ -63,9 +63,9 @@
     - Format conversion between different SBOM standards
 
 
     The tool provides comprehensive software composition analysis with support for
     both system-level packages and programming language-specific dependencies. Syft
     can analyze all image layers or focus on the final container image state, making
     it suitable for various security and compliance use cases.'
   Types:
     - Build
@@ -83,7 +83,7 @@
   Source: AI & human reviewed
   Standards:
     - CycloneDX
   Summary: 'CycloneDX Core (Java) is a library providing essential functionality for
     handling Software Bill of Materials (SBOM) in the CycloneDX format. The tool offers
     model representation, creation, validation, and parsing capabilities for SBOMs.
     It supports CycloneDX schema versions up to 1.6.1 with both XML and JSON output
@@ -855,6 +855,41 @@
     - Does not directly handle NPM packages or system dependencies'
   Types:
     - Build
+- Abilities:
+    - Generate
+  Languages:
+    - Ruby
+    - Rust
+    - Go
+    - Javascript
+    - Python
+  License: GPL-3.0
+  Link: https://github.com/hermetoproject/hermeto
+  Name: hermeto
+  Publisher: Hermeto Project
+  Source: Human written
+  Standards:
+    - CycloneDX
+    - SPDX
+  Summary: |
+    Hermeto is a CLI tool that pre-fetches your project's dependencies to aid in making your build process hermetic.
+
+    The primary intended use of Hermeto's outputs is for network-isolated container builds.
+
+    To play nicely with Hermeto, the build process for your project must be
+
+    - **Defined** - Hermeto only fetches dependencies that are explicitly declared - typically in a lockfile generated by your package manager.
+    - **Reproducible** - Hermeto will refuse to fetch a dependency if it's not pinned to an exact version. This goes for transitive dependencies as well (and ties to the Defined point). Most package managers pin all dependencies automatically in lockfiles.
+    - **Secure** - Even with a lockfile, your build is not truly safe from supply chain attacks unless you verify the checksums of all dependencies. If your package manager supports specifying the expected checksums, we strongly encourage you to make use of them.
+
+    In return, Hermeto will help make your build
+
+    - **Auditable** - by generating a manifest of all the dependencies that go into your build.
+
+    The ability to achieve the goals depends on the build process being hermetic. Ideally, you should try to isolate the build from both the internet and the underlying host system to avoid implicit dependencies, unreproducible behavior and whole hosts of other issues. Hermeto itself is not a hermetic build system. We suggest you take advantage of existing technologies - such as containers - to achieve network isolation.
+  Types:
+    - Source
+    - Build
 - Abilities:
     - Generate
     - Convert