search

Festo-se / cyclonedx-editor-validator

Tool for creating, modifying and validating CycloneDX SBOMs.
https://festo-se.github.io/cyclonedx-editor-validator/
GNU General Public License v3.0
18 stars 4 forks source link

Should `amend` set `compositions` to `unknown` rather than `incomplete`? #161

Closed mmarseu closed 3 months ago

mmarseu commented 4 months ago

As of now, the amend command creates a compositions entry with .aggregate == "incomplete".

The stated goal of this is to explicitly disclaim any completeness of the provided information in the interest of revealing known unknowns. Shouldn't the value then not rather be unknown, which expresses exactly that? "Incomplete" means: this SBOM is known to be incomplete, which it might not actually be. "Unknown" only says: we don't guarantee completeness, which seems to be exactly our intent.

italvi commented 4 months ago

Agree, however, I would like to debate about not adding the bom.metadata.component to the list, as we should at least try to know our top-level dependencies. Your opinion?

mmarseu commented 4 months ago

@italvi Seems reasonable to me. In any case, this feature is a result of internal requirements and you're the person to set those requirements. So I don't get a say 😉

italvi commented 4 months ago

But I'm the guy sitting in the ivory tower, so the view of an user is always valuable 😉. So: Let's change incomplete to unknown and not add the metadata.component to the list.