microsoft / microsoft/sbom-tool
PIP Comp Detect Adapter - No License or Supplier information
Open
@THEJRRR is already working on this.
Since Jan 23, 2025.
tabled
- Dominant language
- C#
- Stars
- 2.1k
- Forks
- 201
- Avg merge
- 6d 21h
- Merged PRs (30d)
- 1
Description
The scan manifest file that Component Detection creates shows license and author information of each pip package that was detected. The sbom-tool does not correctly collect that information - it shows "NO ASSERTION" for the license declared and "NO ASSERTION" for the supplier:
ScanManifest-2024....json (Comp Detect file)
"component": {
"name": "torch",
"version": "2.5.1",
"author": "PyTorch Team",
"license": "BSD-3-Clause",
"type": "Pip",
"id": "torch 2.5.1 - pip",
"packageUrl": {
"Scheme": "pkg",
"Type": "pypi",
"Namespace": null,
"Name": "torch",
"Version": "2.5.1",
"Qualifiers": null,
"Subpath": null
}
}
manifest.spdx.json (sbom-tool)
{
"name": "torch",
"SPDXID": "SPDXRef-Package-A40751563D79B440AD6920A1E59C425463CBCF0A7835485457E3BAFBD06B4260",
"downloadLocation": "NOASSERTION",
"filesAnalyzed": false,
"licenseConcluded": "NOASSERTION",
"licenseDeclared": "NOASSERTION",
"copyrightText": "NOASSERTION",
"versionInfo": "2.5.1",
"externalRefs": [
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:pypi/torch@2.5.1"
}
],
"supplier": "NOASSERTION"
},
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.