Eliminate deprecated field metadata.tools.components.author on cyclonedx 1.6 format
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 42
Description
**What would you like to be deleted**:
- This screenshot shows the SBOM made with syft which follows version 1.6.
- I think Syft should delete metadata.component.author field.
**Why is this needed**:
- https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_author
- In this scheme, metadata.tools.component.author should be deprecated.
- Otherwise, placing it at metadata.author or metadata.manufacturer
Contributor guide
Research direction
Start by tracing Syft's CycloneDX 1.6 SBOM output handling and locate where metadata.tools.components.author is populated. Verify the output against the CycloneDX 1.6 schema, with the deprecated field absent and the author or manufacturer represented in the requested metadata location.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100