mcc0nnell commented on issue #825: URL: https://github.com/apache/celix/issues/825#issuecomment-5952441070
I think the VEX/report-only approach makes sense, and #825 probably should not have to wait for #845. One thought: once #845 is available, I would still use its SBOM as the canonical Conan input. `trivy fs` is useful in the meantime and probably worth keeping as an additional check, but it is not quite the same thing as scanning the exact graph resolved by `conan/safe-defaults.lock`. So something like: `#845 Conan baseline -> SBOM -> #825 scan -> VEX triage` That lets #825 move now without creating a second definition of the Conan security baseline. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
