Split source SBOM into multiple apps #9586
Conversation
CT Test Results 7 files 290 suites 3h 11m 23s ⏱️ Results for commit fdf2359. ♻️ This comment has been updated with latest results. To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass. See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally. Artifacts// Erlang/OTP Github Action Bot |
| "licenseDeclared": "MIT", | ||
| "name": "json-test-suite", | ||
| "versionInfo": "984defc2deaa653cb73cd29f4144a720ec9efe7c", | ||
| "path": "./lib/stdlib/test/json_SUITE_data", |
There was a problem hiding this comment.
I assume we need to haver this type of thing for our unicode test data? and the xmerl test? ASN.1?
There was a problem hiding this comment.
Yes, if that was copied from other project, absolutely. I do not think I can add that for this rc2, but we should get it right for OTP-28. I will talk to more people to see where it was originally from.
kikofernandez
force-pushed
the
kiko/otp/sbom-app-split
branch
from
6dd5553 to
a49acd1
Compare
splits the SBOM into Erlang and vendor SPDX packages. this allows to easily remove dependencies that are not needed from OTP. Erlang applications have also a purl that follows the EEF security working group guidelines, as per https://erlef.github.io/security-wg/specs/otp_purl_type
there are some errors in the current snippet generation that do not work correctly. so we are skipping the snippet generation for now
kikofernandez
force-pushed
the
kiko/otp/sbom-app-split
branch
from
e705165 to
c8a3dfa
Compare
kikofernandez
force-pushed
the
kiko/otp/sbom-app-split
branch
from
8b3f81b to
f8d4c7e
Compare
update "hasExtractedLicensingInfos" to consider LicenseRefs that are not included in the repo. this information has been hard-coded (the license text) but there is a check to see that we only add the license if it is ever present in the repo. this means that if this license `LicenseRef-scancode-wxwindows-free-doc-3` is not present in any curation nor SPDX license identifier, then it will not be added to the resulting SPDX
kikofernandez
force-pushed
the
kiko/otp/sbom-app-split
branch
from
f8d4c7e to
fdf2359
Compare
Improves the compliance script making the following changes
purlfor Erlang SPDX project and Erlang SPDX packages