microsoft / microsoft/sbom-tool

SBOM generation skips SPDX 3.0 documents when looking for external document references

Open
#981 1 comment 1 reaction 2 assignees View on GitHub

@pragnya17 is already working on this.

Since Mar 19, 2025.

accepted
Dominant language
C#
Stars
2.1k
Forks
201
Avg merge
6d 21h
Merged PRs (30d)
1

Description

During SBOM generation (regardless of SPDX version), we skip SPDX 3.0 documents if they are in the build drop path. This means that they do not get added to the generated SBOM as external document references. During generation, the following warning message is also displayed to the user to indicate this behavior:

##[warning]Discovered SPDX at "C:\\Users\\ppandrate\\source\\repos\\sbom-tool\\TestResults\\Deploy_ppandrate 20250317T155644_5824\\E2E_GenerateAndRedactSPDX30Manifest_ReturnsNonZeroExitCode\\_manifest\\spdx_3.0\\manifest.spdx.json" is not SPDX-2.2 document, skipping

Is this behavior we are ok with? Do we want to include SPDX 3.0 documents in external document references?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.