Repository navigation
TF-PSA-Crypto sbom should be improved #1103
Description
Below manifest fetches TF-PSA-Crypto correctly:
manifest:
version: '0.1'
remotes:
- name: github
url-base: https://github.com/
projects:
- name: TF-PSA-Crypto
vcs: archive
remote: github
dst: ext/TF-PSA-Crypto/TF-PSA-Crypto
repo-path: Mbed-TLS/TF-PSA-Crypto/releases/download/tf-psa-crypto-1.0.0/tf-psa-crypto-1.0.0.tar.bz2
integrity:
hash: sha256:31f0df2ca17897b5db2757cb0307dcde267292ba21ade831663d972a7a5b7d40
but when generating an sbom with dfetch report -t sbom.
Few things happen:
- the dual license cannot be determined:
> Could not determine license in LICENSE
TF-PSA-Crypto files are provided under a dual [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)
OR [GPL-2.0-or-later](https://spdx.org/licenses/GPL-2.0-or-later.html) license.
This means that users may choose which of these licenses they take the code
under.
The full text of each of these licenses is given below.
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
- the purl uses generic type instead of github:
{
"concludedValue": "pkg:generic/github.com/tf-psa-crypto-1.0.0@sha256:31f0df2ca17897b5db2757cb0307dcde267292ba21ade831663d972a7a5b7d40?download_url=https://github.com/Mbed-TLS/TF-PSA-Crypto/releases/download/tf-psa-crypto-1.0.0/tf-psa-crypto-1.0.0.tar.bz2",
"field": "purl",
"methods": [
{
"confidence": 0.4,
"technique": "manifest-analysis",
"value": "Determined from https://github.com/Mbed-TLS/TF-PSA-Crypto/releases/download/tf-psa-crypto-1.0.0/tf-psa-crypto-1.0.0.tar.bz2 as used for the project TF-PSA-Crypto in dfetch.yaml"
}
],- I would prefer
tf-psa-crypto-1.0.0as version,Mbed-TLS/TF-PSA-Crypto/releases/download/tf-psa-crypto-1.0.0/tf-psa-crypto-1.0.0.tar.bz2, for github releases this could be deduced from thegithub.com/<org>/<repo>/releases/download/<version>/<artifact> - Group is not
Mbed-TLSbut"group": "github.com",
Activity