Hi Jason, On 26.10.2026 12:31, Jason Gerlowski wrote: > Whether it's a separate release artifact vs. "just" a file part of our > distribution tgz, I don't have strong feelings about. It sounds like > you're leaning towards the "release artifact" approach? Are there > particular advantages of that plan you're aware of?
My PR implements both, this way: - You can check the SBOM *before* downloading Solr. - Users don't lose the SBOM if the unpackage the binary release. If you make a release using ATR (even by manually uploading the artifacts), ATR will recognize any file named <foo>.cdx.json as SBOM of the corresponding <foo> file and do some analysis. Piotr --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
