alitheg commented on issue #1304: URL: https://github.com/apache/tooling-trusted-releases/issues/1304#issuecomment-4624017199
Personally, I'd lean towards an interpretation that manufacturer is the author of the *software* and author is the author of the SBOM itself. But, the CDX spec says manufacturer is often used by tooling that creates SBOMs so if we want to assert that provenance information is present then I think it's probably correct to say "at least one of author or manufacturer is set" -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
