dongjoon-hyun commented on PR #39401:
URL: https://github.com/apache/spark/pull/39401#issuecomment-1372460399
Thank you, @srowen .
1. It goes to Maven Central. I did this at the Apache ORC project first via
ORC-1342. Here is the published SBOM on the snapshot versions after merging
this.
- https://github.com/apache/orc/pull/1353
```
**1.9.0**
-
https://repository.apache.org/content/repositories/snapshots/org/apache/orc/orc-core/1.9.0-SNAPSHOT/orc-core-1.9.0-20230105.074036-185-cyclonedx.xml
-
https://repository.apache.org/content/repositories/snapshots/org/apache/orc/orc-core/1.9.0-SNAPSHOT/orc-core-1.9.0-20230105.074036-185-cyclonedx.json
**1.8.2**
-
https://repository.apache.org/content/repositories/snapshots/org/apache/orc/orc-core/1.8.2-SNAPSHOT/orc-core-1.8.2-20230105.074040-16-cyclonedx.xml
-
https://repository.apache.org/content/repositories/snapshots/org/apache/orc/orc-core/1.8.2-SNAPSHOT/orc-core-1.8.2-20230105.074040-16-cyclonedx.json
**1.7.8**
-
https://repository.apache.org/content/repositories/snapshots/org/apache/orc/orc-core/1.7.8-SNAPSHOT/orc-core-1.7.8-20230105.074050-2-cyclonedx.xml
-
https://repository.apache.org/content/repositories/snapshots/org/apache/orc/orc-core/1.7.8-SNAPSHOT/orc-core-1.7.8-20230105.074050-2-cyclonedx.json
```
2. While `deps` files are only for Spark binary distributions, this is a
jar-level manifest. For example, `spark-core_2.12-3.4.0-SNAPSHOT-cyclonedx.xml`
shows its dependency only without Kubernetes dependencies.
```
$ cat
~/.m2/repository/org/apache/spark/spark-core_2.12/3.4.0-SNAPSHOT/spark-core_2.12-3.4.0-SNAPSHOT-cyclonedx.json
| jq .components | grep \"name\" | head -n5
"name": "avro",
"name": "jackson-core",
"name": "commons-compress",
"name": "avro-mapred",
"name": "avro-ipc",
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
