On 2026/10/26 20:26:27 Piotr P. Karwasz wrote:
> Hi Jason,
>
> On 26.10.2026 12:31, Jason Gerlowski wrote:
> > Whether it's a separate release artifact vs. "just" a file part of our
> > distribution tgz, I don't have strong feelings about. It sounds like
> > you're leaning towards the "release artifact" approach? Are there
> > particular advantages of that plan you're aware of?
>
>
> My PR implements both, this way:
>
> - You can check the SBOM *before* downloading Solr.
> - Users don't lose the SBOM if the unpackage the binary release.
>
> If you make a release using ATR (even by manually uploading the
> artifacts), ATR will recognize any file named <foo>.cdx.json as SBOM of
> the corresponding <foo> file and do some analysis.
>
> Piotr
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>
>
Piotr, why does the file have two names?
It appears to be <foo>.cdx.json if it's not in solr and <foo>.bom inside of
Solr?
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
