Skip to content

Merging two reports together #62

@Jeeppler

Description

@Jeeppler

Is this tool able to merge to reports together. For example, Report-A.spdx and Report-B.spdx`?

Activity

goneall

goneall commented on Jun 23, 2022

@goneall
Member

@Jeeppler Not currently. It wouldn't be too difficult to create the feature, but I probably won't have time to work on it until after the SPDX 2.3 release changes are complete.

If you and Java experience and want to contribute changes to support this functionality, I can give you some pointers to get you started.

spatil00

spatil00 commented on Aug 9, 2022

@spatil00

I am not sure how it will work. If you have two SBoM from different components , each will have their own headers ( Document Creation section in SPDX specification) , I am not sure if SPDX specification gives options to keep headers for two components ?

goneall

goneall commented on Aug 9, 2022

@goneall
Member

@spatil00 I was thinking you could create a new SPDX document with it's own document creation section but include relationships from the new documents to the old documents. You could create External Document References for the 2 original docs. A relationship type DESCENDANT_OF and/or AMENDS could be used to describe the new SPDX document is derived from the 2 original documents. A relationship type of COPY_OF could be used to refer back to the original package/file/snippets from the original package if you want to make the entire operation traceable.

rnjudge

rnjudge commented on Mar 20, 2023

@rnjudge

@Jeeppler check out https://github.com/vmware-samples/sbom-composer for combining SPDX docs. This is in the process of being moved under the OpenSSF.

added theissue type on Apr 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Development

      No branches or pull requests

        Participants

        @bact@goneall@Jeeppler@rnjudge@spatil00

        Issue actions

          Merging two reports together · Issue #62 · spdx/tools-java