potiuk commented on issue #44178: URL: https://github.com/apache/airflow/issues/44178#issuecomment-2564865150
It looks like it's the way how cyclonedx generates it: * when you use "python-only" sboms - it's `pkg:application/[email protected]` - which is more correct, even if it's not PyPI URL * when you use "both npm + python" - it's `pkg:npm/[email protected]` I will take a look shortly on the generation process and we should likely set it to `pkg:pypi/[email protected]`. The good news is that it's only the "top" level Purl. All the other dependencies - including our providers - are good: "pkg:pypi/[email protected]" -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
