Skip to content

do not add self to metadata.tools #673

@jkowalleck

Description

@jkowalleck

If the Bom.metadata.tools are found empty, this library adds an entry to it, to represent itself.

This might look like a cute idea at first, but it alters the original data on deserialization:
when deserialization of a CycloneDX BOM that did not hold any data about tools, the library will add itself to the tools. This is unexpected behavior.

A suitable solution would be to add this library not to the SBOM at all.
Instead, the library should provide functionality in the form of a builder, to generate itself's representation as a tool/component, so that downstream users may use it.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions