Please remove cdxgen from sbombenchmark.dev about sbomqs HOT 4 CLOSED

Hi @prabhu - While there are challenges with getting the right CPE, as there is no fully reliable transition plan from CPE to PURL yet, both SPDX 3 and CDX 1.6 continue to treat CPE as a first-class citizen.

Therefore, identifying missing identifiers is an important step in evaluating what SBOM capabilities are useful.

Of course, as the organizational needs change, there has been a need to customize to specific rules, and sbomqs comes ready with that option

We are tuned to if we will find a single reliable ID and will make changes once that happens. But in the meantime, if you continue to believe cdxgen should opt-out, we can make that changes this weekend. Please let us know.

from sbomqs.

Sure! It's been deployed.

from sbomqs.

Thanks for reporting this, @prabhu. I agree that a valid CPE vs purely generated CPE can be a challenge regarding how the rules are written. As we are hard-pressed on CRA support, please give us a few days to think over it, and if we cannot come up with a fair way to address CDXgen's unique concerns, we'll remove it from SBBM.

from sbomqs.

Please do. Thank you!

from sbomqs.