bodewig commented on issue #1304: URL: https://github.com/apache/tooling-trusted-releases/issues/1304#issuecomment-4623971181
NTIA doesn't explicitly say anything about the formats, likely because it has been written earlier. https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-SBOM-en.pdf on the other hand says under "NTIA Minimum Elements" to use metadata.publisher (as well as metadata.author a few rows later, which simply doesn't exist in the spec). We don't want to make things too easy. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
