CycloneDX / CycloneDX/specification
Consider making `evidence.identity` mandatory
Open
breaking-changes
- Dominant language
- XSLT
- Stars
- 547
- Forks
- 93
- Avg merge
- 7h 11m
- Merged PRs (30d)
- 37
Description
We are seeing SBOM tools that are making up CPE and purl identifiers without offering evidence for identity. This is causing frustration, delays, and lack of trust in the tool and the process. Making the identity mandatory could help filter components with low confidence detection techniques.
Contributor guide
Assessment
This issue has not been assessed yet.