alitheg commented on issue #1304: URL: https://github.com/apache/tooling-trusted-releases/issues/1304#issuecomment-4630948169
Yeah I think there's probably a valid discussion for future development about what is required and it likely touches on definitions too. In my opinion, supplier is less important for the issue of provenance - it's more important I think to know who produced it not necessarily who provided it to you - but as you pointed out the semantic terms and various minimum specs don't necessarily agree with the way the CDX spec discusses them! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
