Missing supplier information for component detectors, Example -> Go, Conan etc

[tarun06]

Supplier can take information about person, organization or tool. So, Should we add Tool as the supplier information for which detector could not identifies person or organization.

My point is instead of using "NOASSERTION", Adding Tool to the supplier could be meaningful information. May i asked for suggestion?

example ->

1. Conan detector -> Supplier = "Tool: Conan"
2. GO detector -> Supplier = "Tool: Golang"

[melotic]

If I understand this correctly, Supplier is only in SPDX. Maybe this is a better question for SBOM Tool folks?

We can perhaps expose information in the typed component for the supplier of packages, if this helps them.

[JamieMagee]

@tarun06 can you open a discussion at https://github.com/microsoft/sbom-tool if this is the case.

[tarun06]

@JamieMagee @melotic Thanks for correcting me and sharing the SBOM Tool URL.