Skip to content

SBOM generation skips SPDX 3.0 documents when looking for external document references #981

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pragnya17 opened this issue Mar 18, 2025 · 1 comment
Assignees
Labels
accepted We are working on this and hope to release it into the product

Comments

@pragnya17
Copy link
Contributor

During SBOM generation (regardless of SPDX version), we skip SPDX 3.0 documents if they are in the build drop path. This means that they do not get added to the generated SBOM as external document references. During generation, the following warning message is also displayed to the user to indicate this behavior:

##[warning]Discovered SPDX at "C:\\Users\\ppandrate\\source\\repos\\sbom-tool\\TestResults\\Deploy_ppandrate 20250317T155644_5824\\E2E_GenerateAndRedactSPDX30Manifest_ReturnsNonZeroExitCode\\_manifest\\spdx_3.0\\manifest.spdx.json" is not SPDX-2.2 document, skipping

Is this behavior we are ok with? Do we want to include SPDX 3.0 documents in external document references?

@pragnya17 pragnya17 added the needs triage Default status upon issue submission label Mar 18, 2025
@sfoslund sfoslund added accepted We are working on this and hope to release it into the product and removed needs triage Default status upon issue submission labels Mar 19, 2025
@pragnya17
Copy link
Contributor Author

This is not a release blocker for SPDX 3.0 so it is currently deprioritized.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
accepted We are working on this and hope to release it into the product
Projects
None yet
Development

No branches or pull requests

2 participants