dave2wave commented on PR #37: URL: https://github.com/apache/tooling-actions/pull/37#issuecomment-5743785468
To be clear. Building of artifacts is outside the scope of ATR because there are many ways to build and many build tools. These are each project's decision. For many reasons a source release must contain only files that are in the source repository, but it need not contain all. Often there are files in the repository it MUST not include. Adding signatures and checksum creation would be a helpful and acceptable extra. The calculation of SWID is only needed if you want to check it with the calculation that ATR already does in the compose phase. (This is a new feature.) If there is a common way to check and possibly generate a cycloneDX SBOM that would be an awesome bonus feature. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
