SBOM Author in SBOM

[MacOS]

Hi all,

I have a question pertaining to SBOM.

Can ORT automatically add the SBOM author information based on some config? This is imporant because it is a required SBOM field as per BSI-TR-03183-2 - search in the document for Creator of the SBOM. Please note that it should be possible to add an E-Mail address or at least a URL. In CycloneDX 1.6, this relates to the authors field in the metadata. In SPDX 2.3, this relates to the creators field within creationInfo.

many thanks.

[sschuberth]

Thanks for bringing up those questions! For CycloneDX, we currently do not set the authors field at all, but that should be very easy to add via a reporter-specific option. For SPDX, there already is a reporter-specific option to set the creationInfo.comment, but I guess the author should go as a Person: entry into creationInfo.creators, right?

[MacOS]

Yes. But now that you write it out, my intention of distinguishing between creationInfo.person and creationInfo.organization was to set the necessary prefixes internally. I'll amend my change.

Thank you!

No, that's not possible yet (for any reporter), and would be a bigger change.

Out of interest, what would be these changes?

[sschuberth]

Out of interest, what would be these changes?

Turns out I was partly mislead: ORT already can read reporter-specific options from the global config.yml, but such options cannot currently be overridden by the repository-specific .ort.yml.

[MacOS]

That is great!

I still suspect that there is a common use case where organisations want to set the author, and other metadata, on a repository-specific .ort.yml

[sschuberth]

I still suspect that there is a common use case where organisations want to set the author, and other metadata, on a repository-specific .ort.yml

Probably. Please file a feature request issue for it to track the ask.

[MacOS]

I will!

Thank you again for the fast responses to my questions and remarks, as well as the fast pull request. I highly appreciate that!