Skip to content

document version is missing despite useful details in the SBOM #25

@surendrapathak

Description

@surendrapathak

For the SBOM here -
https://sbomlc.s3.amazonaws.com/sbom4python-0.8.0_paramiko-3.1.0.spdx.tv?AWSAccessKeyId=AKIA2ZBFUJ4NNQGYD5OF&Signature=eyV1wX%2F%2Beg2TaXQTS5UQxE%2FpRd4%3D&Expires=1711592216

sbomgr packages -EP 'pypi/cryptography' -O 'filen,docn,docv,pkgn,pkgv' ../sbomlc/sbom4python-0.8.0_paramiko-3.1.0.spdx.tv
../sbomlc/sbom4python-0.8.0_paramiko-3.1.0.spdx.tv	Python-paramiko	http://spdx.org/spdxdocs/Python-paramiko-f7ea4f38-99df-4880-87d8-ab4d19b9f707	cryptography	40.0.1		

docv results in blank.

However, we have two signals that should lead us to the document version

Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1-paramiko
PackageName: paramiko
SPDXID: SPDXRef-Package-1-paramiko
PackageVersion: 3.1.0

I recommend rechecking the logic for dov to ensure the above case can be handled.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions