Missing supplier information for component detectors, Example -> Go, Conan etc

[Tarun Kumar (tarun06)]

Supplier can take information about person, organization or tool. So, Should we add Tool as the supplier information for which detector could not identifies person or organization.

My point is instead of using "NOASSERTION", Adding Tool to the supplier could be meaningful information. May i asked for suggestion?

example ->

1. Conan detector -> Supplier = "Tool: Conan"
2. GO detector -> Supplier = "Tool: Golang"

[Justin Perez (melotic)]

If I understand this correctly, Supplier is only in SPDX. Maybe this is a better question for SBOM Tool folks?

We can perhaps expose information in the typed component for the supplier of packages, if this helps them.

[Jamie Magee (JamieMagee)]

Tarun Kumar (@tarun06) can you open a discussion at https://github.com/microsoft/sbom-tool if this is the case.

[Tarun Kumar (tarun06)]

Jamie Magee (@JamieMagee) Justin Perez (@melotic) Thanks for correcting me and sharing the SBOM Tool URL.