k8s-ci-robot
commented
1 year ago @puerco: GitHub didn't allow me to request PR reviews from the following users: kubernetes-sigs/release-engineering.
Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs.
In response to [this](https://github.com/kubernetes-sigs/bom/pull/269):
>#### What type of PR is this?
>/kind bug
>
>#### What this PR does / why we need it:
>
>This PR modifies the json serializer to add the supplier and originator data. It seems that we forgot to add it to the type and SBOMs encoded in JSON were missing the supplier info. It's there now:
>
>```json
> {
> "SPDXID": "SPDXRef-Package-SPDXRef-Package-index.docker.io-library-debian-f5802c738e07905ae30f1006c922c1cce3a4955574751a44d5344e9cefabca8c-sha256-015f7b32198b1c57333fa9e151a0b54ccfe05dfef57e98b87c27d426f134db80-66d94da4-a71b-40b7-adc6-6d927d0f47e1",
> "name": "libp11-kit0",
> "versionInfo": "0.24.1-2",
> "filesAnalyzed": false,
> "supplier": "Person: Debian GnuTLS Maintainers (pkg-gnutls-maint@lists.alioth.debian.org)",
> "copyrightText": "NOASSERTION",
> "checksums": [],
> "externalRefs": [
> {
> "referenceCategory": "PACKAGE-MANAGER",
> "referenceLocator": "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=arm64",
> "referenceType": "purl"
> }
> ]
> }
>```
>
>None
>
>#### Special notes for your reviewer:
>
>This PR also adds a unit test to ensure we are parsing the data in the debian db as expected.
>
>/cc @kubernetes-sigs/release-engineering
>
>#### Does this PR introduce a user-facing change?
>
>```release-note
>JSON-encoded files now include supplier and originator data.
>```
>
Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
What type of PR is this?
/kind bug
What this PR does / why we need it:
This PR modifies the json serializer to add the supplier and originator data. It seems that we forgot to add it to the type and SBOMs encoded in JSON were missing the supplier info. It's there now:
None
Special notes for your reviewer:
This PR also adds a unit test to ensure we are parsing the data in the debian db as expected.
/cc @kubernetes-sigs/release-engineering
Does this PR introduce a user-facing change?