Should we change the infer of copyright to only `metadata.component`?

[italvi]

Currently we change the coypright via amend for every component (if the flag is provided) and choose the current year for it. But is this really the right approach: We don't know in which year the component within components was created, so we should not assume there anything. However, we can do that for the metadata.component as the SBOM is mainly created during the build process.

[italvi]

Your opinion @mmarseu, @CBeck-96?

[mmarseu]

I think I've already made my opinion of this particular operation clear 😬

Even for the metadata component, you cannot automatically deduce a correct copyright claim. Copyright is a complex legal issue. As for your question regarding the current year, the SBOM might be recreated or modified after the product is published.

IMO, we should throw out this operation and force people to use other alternatives to manually apply copyright claims. For example, if it's only for a single component, a simple cdx-ev set --name xyz --version 1.2.3 --key copyright --value "My company" could do it.

[italvi]

IMO, we should throw out this operation and force people to use other alternatives to manually apply copyright claims.

Agree, as we already provide this possibility via set and I'm also aware of persons using set rather than amend for this purpose. This manual approach also forces persons to really think about adding this kind of information.

[mmarseu]

This manual approach also forces persons to really think about adding this kind of information.

EXACTLY! ❤️

I'll get on it :)