Record module version - Githubissues

kubernetes-sigs / bom

A utility to generate SPDX-compliant Bill of Materials manifests

https://kubernetes-sigs.github.io/bom/

Apache License 2.0

331 stars 48 forks source link

Record module version #438

Open puerco opened 4 months ago

puerco commented 4 months ago

What would you like to be added:

A big oversight when scanning go modules from a directory is that we are not recording the module name or its version. The generated package should contain the following:

Go module name
Module Version (we can read it from the tag if its @HEAD or add the commit sha)
Package URL

Why is this needed:

SBOM completeness

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle stale
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 1 week ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle rotten
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten