epugh commented on PR #4966: URL: https://github.com/apache/solr/pull/4966#issuecomment-5912426571
> Finally... what we _really_ want is likely a Cyclone DX SBOM to do comparisons. CC @epugh Agreed. The WIP is this file: https://github.com/apache/solr-site/blob/main/plugins/vex/solr-dependency-versions.json, it's only listing mappings for jars that have a vex file, so it doesn't cover everything. What I learned was that you have to look at the dist, not the source, or get you get a lot of noise. Do you think starting to publish SBOM now, even though it won't exist for previous Solrs would be useful? @ppkarwasz has https://github.com/apache/solr/pull/4690 which adds SBOM. Maybe worth a discussion at Glasgow? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
