nisha

@pombredanne Of course! It's Python 3.7 in a virtual environment. I'll add that to the issue description.

@pombredanne Confirmed - I don't see the error when running scancode at the the head of develop. I believe 3.1.1 is the latest pip release?

@tgerla The `org.json` is the groupID which for CycloneDX is a separate property. One thing to note is that the SBOMs were not generated by Syft but by the SPDX...

@willmurphyscode For SPDX, I used the maven plugin which can either print out the project name or `groupID:artifactID` as the SPDX name. SPDX doesn't have a `group` property like CycloneDX.

cc: @goneall @kzantow You may be interested in the CycloneDX `group` to SPDX `name` compatibility.

I will leave a comment about our usage of Dockerhub. We may be able to get some suggestions as to how to test without dockerhub.

> If, for some reason, the Docker-Sponsored Open-Source Program isn't working out, we are happy to help you out. We operate a Harbor-based [container registry as a service ](https://container-registry.com/)that has...

@rnjudge To clarify, does the error occur when running `cp -r container_layer_dir working_dir` where `container_layer_dir` is a symlink to `random_dir_path`?

@lumjjb Any movement on implementing SPDX 3.0 based on the RC-2 release?

Even better, clone all the dependencies of that project as well.