Fm/vcs link #124
Fm/vcs link #124
Conversation
tamilari
force-pushed
the
fm/vcs-link
branch
2 times, most recently
from
89bc06e to
88dedcf
Compare
tamilari
force-pushed
the
fm/vcs-link
branch
2 times, most recently
from
a7304d6 to
28d22b6
Compare
|
LGTM. @gernot-h @fmoessbauer any more comments? I would like to merge this soon so we can get another release ready. |
I also propose to merge this as is. The code part is fine and it also looks like we agreed on the semantics. |
|
Well, as discussed in the unresolved discussion above, I would suggest to not emit the "vcsbrowser" information for the CDX format, as there doesn't seem to be a matching reference type for it and it might create confusion to have two "vcs" references. However, if you have good reasons to keep it, @fmoessbauer or @Urist-McGit, I can also live with it, it wouldn't bother me personally. |
For cdx add the Vcs information and the url to the web interface to the 'external_refs' object with the type set to 'vcs'. For spdx there there isn't a suitable category or type for this in the externalReferences field. Therefore, we use the Other category with the custom types 'vcs' and 'vcsBrowser'. This Vcs information can be useful for analysing the packages (e.g. how well a package is maintained and what the risk factor is). Signed-off-by: Tamino Larisch <[email protected]>
Signed-off-by: Tamino Larisch <[email protected]>
tamilari
force-pushed
the
fm/vcs-link
branch
from
28d22b6 to
addd530
Compare
|
Okay, I've removed the "vcsbrowser" information. Thank you for your help! |
4 participants
feat: add Vcs informations to sbom
For spdx, add the Vcs information in the 'download_location' field. Format this string according to the spdx documentation. It is not possible to add the url to the web interface for browsing the repository, since there is no field for this information.
For cdx add the Vcs information and the url to the web interface to the 'external_refs' object with the type set to 'vcs'.
This Vcs information can be useful for analysing the packages (e.g. how well a package is maintained and what the risk factor is).