search

janbiasi / rollup-plugin-sbom

Create SBOMs in CycloneDX format for your Vite or Rollup projects with ease
MIT License
7 stars 2 forks source link

Add support for authoring supplier(s) #12

Closed janbiasi closed 5 months ago

janbiasi commented 7 months ago

According to NTIA Minimum Elements there should be a supplier or multiple suppliers listed in the BOM's metadata bom.metadata.supplier. It would be a good idea to add an option to add the supplier via an option or infer the supplier via the "authors" field from package.json.

Edit: the plugin should not set any default value

github-actions[bot] commented 6 months ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

jkowalleck commented 6 months ago

reminder: your tool is used by the manufacturer/author of the BOM, which is not necessarily the supplier of the BOM...

janbiasi commented 5 months ago

Thanks for the heads up @jkowalleck! I am aware that the author field does not necessarily contain the correct value. In your opinion, would it be better not to set a default value?

jkowalleck commented 5 months ago

would it be better not to set a default value?

yes

janbiasi commented 5 months ago

yes

Thanks a lot! I just updated the issue description to not use a default value at all.

github-actions[bot] commented 5 months ago

:tada: This issue has been resolved in version 1.1.0 :tada:

The release is available on:

Your semantic-release bot :package::rocket: