Repository navigation
Use shared sbom parser for mirror sources - #510
Conversation
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
simonchrz
left a comment
simonchrz
left a comment
There was a problem hiding this comment.
Approving. One behaviour change worth knowing about: nested CycloneDX components are now mirrored too, where before only top-level ones were. metadata.component still isn't, which matters now that #502 fails the run on a mirror error. This needs a rebase after #516 for go.mod/go.sum. I resolved it locally with go get github.com/git-pkgs/sbom@v0.1.7 && go mod tidy and the mirror tests pass.
Use
git-pkgs/sbom.Parsefor mirroring CycloneDX JSON/XML and SPDX JSON/tag-value documents. Preserve every package PURL, scoped package identities, and container image options while removing the separate CycloneDX and SPDX parser dependencies.Uses sbom
v0.1.7, which includes git-pkgs/sbom#18.