pnoltes commented on code in PR #845: URL: https://github.com/apache/celix/pull/845#discussion_r3944789453
########## documents/building/sbom.md: ########## @@ -21,35 +21,82 @@ limitations under the License. # Software Bill of Materials -The Linux Conan CI build first creates the `celix/3.0.0` Conan binary package. -For the GCC Release configuration, CI then consumes that package with the same -settings and options and runs Conan's `full_deploy` and `cyclone_1.6` deployers -in the same dependency-graph resolution: +Apache Celix provides a committed `conan.lock` and a matching CycloneDX 1.6 +SBOM for one documented Conan configuration. Together they provide a +reproducible **safe-default dependency baseline** for development and +vulnerability review. + +The lockfile is not a repository-wide dependency mandate. Celix users remain +free to build without the lockfile, override dependency versions, or maintain a +lockfile for their own application configuration. When those inputs change, +the resulting dependency graph and SBOM can change as well. Review Comment: 👍 nice addition -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
