ppkarwasz commented on PR #4690: URL: https://github.com/apache/solr/pull/4690#issuecomment-5200657120
Yesterday's Apache Trusted Releases presentation made me reconsider the "SBOM location" decision above. Rather than shipping `bom.json` inside `solr-11.0.0.tgz`, I'd now lean towards a `solr-11.0.0.tgz.cdx.json` sidecar next to it on `downloads.apache.org`, matching the `.asc`/`.sha512` pattern. This is the model ATR already supports: e.g. [this test catalog page](https://release-catalog-test.apache.org/tooling-trusted-releases/0.1/index.html), where each artifact lists Download / Signature / Checksum / SBOM as siblings. This does give up the two properties I argued for earlier (the SBOM travelling with the archive so it can't get detached, and being auto-discoverable via the recognized CycloneDX filename patterns inside the archive) in exchange for consistency with how ATR expects to publish and surface SBOMs alongside the rest of the release metadata. Open to keeping both if that's not considered redundant: sidecar for ATR/downloads.apache.org discovery, `bom.json` retained inside the archive for anyone working from a downloaded copy. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
