adding SecureSBOM to tools.json

[VinnyBarton]

No description provided.

[jkowalleck]

package manager integration?
could you elaborate on this feature?

[VinnyBarton]

Thanks for reviewing @jkowalleck

SecureSBOM has a standalone GitHub Action: https://github.com/shiftleftcyber/secure-sbom-action. In addition we are also close to releasing a standalone SDK that can easily be integrated into various build systems (ie: Jenkins, Bitbucket...). Since "build system" is mentioned in the description of PACKAGE_MANGER_INTEGRATION, I included it in the array.

"PACKAGE_MANAGER_INTEGRATION": "Tools that integrate with build systems and package managers.",

If I am mistaken I would be happy to remove.

[jkowalleck]

this PR has conflicts

[jkowalleck]

we've changed how the tools.json is managed.
since now, each tool has its own json file in https://github.com/CycloneDX/tool-center/tree/main/tools
please revert your changes to tools.json, and add a dedicated fiele in the tools folder.

[jkowalleck]

remove, as discussed here: #69 (comment)

Suggested change

"PACKAGE_MANAGER_INTEGRATION",

[Copilot]

Pull request overview

This pull request adds a new tool configuration file for SecureSBOM, an enterprise-grade API providing cryptographic signing and verification capabilities for SBOMs, to the CycloneDX tool center.

Key changes:

• Adds SecureSBOM tool metadata including capabilities, availability, functions, and supported standards
• Declares support for SBOM and VDR/VEX capabilities with FREEMIUM and SUBSCRIPTION availability models
• Specifies support for multiple platforms (Linux, Mac, Windows) and packaging formats (CLI, GitHub Action, Library)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The "analysis" array is empty, but the tool declares "ANALYSIS" in the "functions" array. When a tool has "ANALYSIS" functionality, it should specify what types of analysis it performs by including values such as "SECURITY_VULNERABILITIES", "LICENSE_REPORTING", "POLICY_EVALUATION", "RESOURCE_REPORTING", or "OUTDATED_COMPONENTS". Either populate this array with appropriate analysis types or remove "ANALYSIS" from the functions array.