slawekjaranowski commented on issue #1544: URL: https://github.com/apache/tooling-trusted-releases/issues/1544#issuecomment-5514261470
@alitheg thanks, I confirm now is ok for simple project with only one `source-release` I will check in a few days more complicated release like we have for Maven core we have files: ``` binaries/apache-maven-4.0.0-rc-6-bin.tar.gz binaries/apache-maven-4.0.0-rc-6-bin.zip source/apache-maven-4.0.0-rc-6-src.tar.gz source/apache-maven-4.0.0-rc-6-src.zip ``` and we will have one SBOM in root of deployment ``` apache-maven-4.0.0-rc-6-cyclonedx.json ``` We have one Maven core poroject and generate artifacts with source code, binary with multiple format - tar.gz and zip so as is one project it will have one SBOM. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
