sbom-tool
sbom-tool copied to clipboard
Wrong supplier in RootPackage of SBOM
Hey there,
I am working on generating an SBOM for a GitHub Action that sets up this SBOM-Tool in a convenient way (see: https://github.com/philips-software/sbom-tool-installer-action). After generating the SBOM, I noticed that the supplier field of the RootPackage
is set to Organization: Microsoft
, which seems incorrect.
There should be a parameter to control this value.
I uploaded the SBOM as a Gist. Please have a look here: https://gist.github.com/Brend-Smits/90b62120de7abc989c2768c92a2a49c8#file-sbom-tool-installer-action-sbom-L10757-L10772
Thanks for bringing this to our attention, will add a parameter to the tool for this.
Thanks for bringing this to our attention, will add a parameter to the tool for this.
Is this something I can help with? I don't mind opening a PR.
Thanks @Brend-Smits , @ByAgenT is already working on a fix for this. But how about you help us fixing https://github.com/microsoft/sbom-tool/issues/85?