Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: populate component.authors #648

Open
fkleon opened this issue Jan 10, 2024 · 4 comments
Open

feat: populate component.authors #648

fkleon opened this issue Jan 10, 2024 · 4 comments
Labels

Comments

@fkleon
Copy link

fkleon commented Jan 10, 2024

Relating to the (upcoming) 4.0.0 release:

The author field is currently missing in the resulting SBOM but could be populated from the project.authors field in pyproject.toml (although pyproject allows multiple authors).

See:

@jkowalleck jkowalleck added the enhancement New feature or request label Jan 10, 2024
@jkowalleck
Copy link
Member

jkowalleck commented Jan 10, 2024

need to reflect:

@jkowalleck
Copy link
Member

jkowalleck commented Jan 10, 2024

the "authors" feature was removed in v4 for the fact thast some things were just uncertain.
CycloneDX allows exactly one author. Python projects may have multiple ...

to be clarified: which parts of the "author" should be used? there are multiples:

  • name
  • email-address

to be clarified: how to describe multiple authors? see CycloneDX/specification#335

  • concatenate multiple with a & or |?
  • just use the first author and thats is it
  • just use the first author and add a "et al."(Latin "and others", commonly practice in legal area) - ala Jane Doe <[email protected]> et al.

need to clarify with CycloneDX core team and specification partners.

@jkowalleck jkowalleck changed the title feat: populate component metadata author information from pyproject.toml feat: populate component.author Jan 10, 2024
@jkowalleck jkowalleck changed the title feat: populate component.author feat: populate component.author Jan 10, 2024
@jkowalleck jkowalleck added the good first issue Good for newcomers label Feb 2, 2024
@jkowalleck
Copy link
Member

since v4 was published and released (:tada:), this feature request is open for contributors. Feel free to discuss solutions or open pull requests. Please see the existing requirements and spec descriptions above.

@jkowalleck jkowalleck added the help wanted Extra attention is needed label Feb 2, 2024
@jkowalleck
Copy link
Member

jkowalleck commented May 3, 2024

further: CycloneDX 1.6 got versatile support for $.components[].authors (deprecating $.components[].author)

expected result could be: Populate $.components[].authors with a structure, and, additionally, populate $.components[].author with a derived string.

@jkowalleck jkowalleck changed the title feat: populate component.author feat: populate component.authors May 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants