Skip to content

SBOM generation skips SPDX 3.0 documents when looking for external document references #981

Open
@pragnya17

Description

@pragnya17

During SBOM generation (regardless of SPDX version), we skip SPDX 3.0 documents if they are in the build drop path. This means that they do not get added to the generated SBOM as external document references. During generation, the following warning message is also displayed to the user to indicate this behavior:

##[warning]Discovered SPDX at "C:\\Users\\ppandrate\\source\\repos\\sbom-tool\\TestResults\\Deploy_ppandrate 20250317T155644_5824\\E2E_GenerateAndRedactSPDX30Manifest_ReturnsNonZeroExitCode\\_manifest\\spdx_3.0\\manifest.spdx.json" is not SPDX-2.2 document, skipping

Is this behavior we are ok with? Do we want to include SPDX 3.0 documents in external document references?

Metadata

Metadata

Labels

acceptedWe are working on this and hope to release it into the product

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions