mcc0nnell commented on PR #845: URL: https://github.com/apache/celix/pull/845#issuecomment-5447812243
Thanks, this makes sense. I’ve updated the PR so the SBOM is now tied to the concrete Conan binary package rather than generated independently from the recipe. The GCC job first creates celix/3.0.0, then consumes that package with the same settings/options and runs full_deploy and cyclone_1.6 in the same dependency-graph resolution. The publication step uses -b never so it cannot silently rebuild a different configuration. CI now uploads the deployed binary packages and the matching CycloneDX SBOM together as a single artifact. This should address the concern about dependency overrides changing the binary/SBOM relationship. Please let me know if you’d prefer a different packaging boundary. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
