On 2026-05-24, Stefan Bodewig wrote: > Right now I'm trying to find people I can talk to WRT SBOMs for > tarballs. I'm pretty certain the SBOMs I've been creating for the Antlib > itself and Ant's jars are pretty fine.
I've used parts of todays holiday in Germany to read up on SBOM requirements. Both the EU CRA as well as the US NTIA requirements require supplier information which I considered to be secondary with manufacturer being more important. I'll change that. Also I believe the ASF is the supplier and not the Ant project. This is not going to change anything of the creation process, it will just change the contents of the example SBOMs. Stefan --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
