microsoft / microsoft/component-detection
Align on an output format for detected dependencies
Open
Nobody has claimed this yet.
status:ready
type:feature
- Dominant language
- C#
- Stars
- 553
- Forks
- 135
- Avg merge
- 20h 58m
- Merged PRs (30d)
- 6
Description
I realized this tool is currently using its own JSON format for reporting dependencies, but I wonder whether instead it would make more sense to write out standardized formats like SPDX or CycloneDX, or at least try to align with existing formats of similar tools like the ORT Analyzer. (Disclaimer: I'm the founder of ORT.)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the tool's current JSON dependency output and comparing it with the linked SPDX, CycloneDX, and ORT Analyzer formats. The issue does not name files or tests; done would require agreeing on a target format and defining the resulting dependency output.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100