potiuk commented on PR #37: URL: https://github.com/apache/tooling-actions/pull/37#issuecomment-5744063239
> To be clear. Building of artifacts is outside the scope of ATR because there are many ways to build and many build tools. These are each project's decision. For many reasons a source release must contain only files that are in the source repository, but it need not contain all. Often there are files in the repository it MUST not include. > Oh absolutely - and there is absolutely standard way of excluding those files: .gitattributes. We are using it for years in Airflow and many other projects also use `git archive` to produce the artifacts and excluding files with .gitattributes. It's **just** a matter of adding a doc here telling people that they should use those. Airflow's .gitattributes file: https://github.com/apache/airflow/blob/main/.gitattributes > Adding signatures and checksum creation would be a helpful and acceptable extra. The calculation of SWID is only needed if you want to check it with the calculation that ATR already does in the compose phase. (This is a new feature.) > > If there is a common way to check and possibly generate a cycloneDX SBOM that would be an awesome bonus feature. I've worked with the author of cdxgen https://github.com/cdxgen/cdxgen - we fixed a few performance issues few years ago - and we are using them for airflow's SBOMS However - this is much more complex - as opposed to .gitattributes export-ignore directives that make `git archive` perfect for 'standard' source package preparation - there is no standard for all kinds of types of SBOMS (there are 6 or 7) and exclude/include directives there - unlike source code exclusions from export, those depend a lot on the project's context I think. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
