microsoft / microsoft/sbom-tool
SBOM generation skips SPDX 3.0 documents when looking for external document references
@pragnya17 is already working on this.
Since Mar 19, 2025.
- Dominant language
- C#
- Stars
- 2.1k
- Forks
- 201
- Avg merge
- 6d 21h
- Merged PRs (30d)
- 1
Description
During SBOM generation (regardless of SPDX version), we skip SPDX 3.0 documents if they are in the build drop path. This means that they do not get added to the generated SBOM as external document references. During generation, the following warning message is also displayed to the user to indicate this behavior:
##[warning]Discovered SPDX at "C:\\Users\\ppandrate\\source\\repos\\sbom-tool\\TestResults\\Deploy_ppandrate 20250317T155644_5824\\E2E_GenerateAndRedactSPDX30Manifest_ReturnsNonZeroExitCode\\_manifest\\spdx_3.0\\manifest.spdx.json" is not SPDX-2.2 document, skipping
Is this behavior we are ok with? Do we want to include SPDX 3.0 documents in external document references?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.