Taking a look at how we present SBOM packages (or components as it's called in CycloneDX land):
Instead of showing a package, we actually show PURL information. However, the data structure actually is:
- SBOM Package
- Name (1)
- Version (0..1)
- PURLs (0..*)
- CPEs (0..*)
- Hashes (0..*) (we don't expose them yet)
For me, this leads to confusion about what actually is. It also lacks information that we actually have.
Taking a look at how we present SBOM packages (or components as it's called in CycloneDX land):
Instead of showing a package, we actually show PURL information. However, the data structure actually is:
For me, this leads to confusion about what actually is. It also lacks information that we actually have.