anchore / anchore/syft

Eliminate deprecated field metadata.tools.components.author on cyclonedx 1.6 format

Open
#4,580 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

**What would you like to be deleted**:

Image

- This screenshot shows the SBOM made with syft which follows version 1.6.
- I think Syft should delete metadata.component.author field.

**Why is this needed**:
- https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_author
- In this scheme, metadata.tools.component.author should be deprecated.
- Otherwise, placing it at metadata.author or metadata.manufacturer

Contributor guide

Open the contributing guide

Research direction

Start by tracing Syft's CycloneDX 1.6 SBOM output handling and locate where metadata.tools.components.author is populated. Verify the output against the CycloneDX 1.6 schema, with the deprecated field absent and the author or manufacturer represented in the requested metadata location.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.