Skip to content

Conversation

@Enkas1
Copy link

@Enkas1 Enkas1 commented Nov 10, 2025

This PR adds a supplier field to license and package metadata to support SBOM generation requirements.

Changes:

  • Added supplier attribute to license() and package_info() rules
  • Updated LicenseInfo and PackageInfo providers to include supplier field
  • Added validation requiring supplier format: "Organization: " or "Person: "
  • Updated JSON output generation in both metadata gathering systems
  • Added test coverage for supplier field functionality

Usage:

license(
    name = "my_license",
    supplier = "Organization: Test org",
    # ... other attributes
)

@Enkas1 Enkas1 requested a review from aiuto as a code owner November 10, 2025 13:36
@google-cla
Copy link

google-cla bot commented Nov 10, 2025

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@aiuto
Copy link
Collaborator

aiuto commented Nov 13, 2025

This repository is essentially abandonware, and new effort is going into work at bazel-contrib/supply-chain.
Please open an issue there, and we can start talking about the right way to do this, before sending a PR.
My quick thought is that supplier is not a feature of a license, so it should be in a different provider

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants