Teach ManifestValidator about extensions by DaveTryon · Pull Request #1033 · microsoft/sbom-tool (original) (raw)

The ManifestValidator class works against a static list of manifest types. This constant list doesn't allow us to specify a ManifestInfo for a single extension, which is problematic. The ManifestGeneratorProvider class knows about all registered manifest types, so is it the authoritative list of valid types that should be accepted.

Validated with our internal client that has additional manifest types.

Note: I considered completely removing Constants.SupportedSpdxManifests completely, but it is used in both ComponentDetectionBaseWalker and BaseManifestConfigHandler. I wanted to keep this PR tightly focused, but we should consider removing this constant in the future if it's not too much effort.