Hey all, Chatting with Piotr at C/C Glasgow about his SBOM contribution for Solr, and I wanted to take the temperature of the community on adding this artifact to our releases. What he is proposing in https://github.com/apache/solr/pull/4690 is to provide as part of our release a file that describes exactly what dependencies are in the binary archive.
Adding SBOM's to releases would be a somewhat new thing for an Apache project. Apache Camel and PLC4X both ship SBOMs, and they have a lot of dependenices like us. Ivy and Ant as well as Log4j are other examples of project doing this. SBOM's might be the data structure that we could use to publish our dependency updates from release to release, instead of doing it via Changelog entries. We had a bit of disucssion in https://lists.apache.org/thread.html/1lbnk8ch6s92hlkh91bq2vzf738gppr0. It would also replace the current dependency mapping file in the solr-site used to track vex file ranges: https://github.com/apache/solr-site/blob/main/plugins/vex/solr-dependency-versions.json for any release that had it. Thoughts? --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
