Add plumbing to collect packages from SPDX 2.2 files by DaveTryon · Pull Request #1117 · microsoft/sbom-tool (original) (raw)

This PR is all about adding the IMergeableContentProvider interface, but includes some housekeeping. Specifically, it restructures the ./samples` folder to include both SPDX 2.2 and SPDX 3.0 files. These files were built against the win64 4.0.3 release, using the win 64 tool from the same release. These samples are available for tests

It also adds a functional SPDX 2.2 implementation of IMergeableContentProvider (enabled via dependency injection) and a placeholder SPDX 3.0 implementation of IMergeableContentProvider (not yet in dependency injection).

The SbomConsolidationWorkflow.SourceSbomsTemp property is a test stub that will be removed in the near future.

This code does not yet include plumbing to pass the SBOMs discovered during validation, or plumbing to capture the MergeableContent in the generation workflow.