Conversation
vaintroub
changed the title
vaintroub
force-pushed
the
bb-11.8-MDEV-41072
branch
from
September 15, 2026 10:47
bf4c9b3 to
09af433
Compare
vaintroub
force-pushed
the
bb-11.8-MDEV-41072
branch
from
September 16, 2026 08:43
09af433 to
123e6ef
Compare
vuvova
approved these changes
Sep 16, 2026
There was a problem hiding this comment.
🟡 Changes recommended
Two moderate issues remain regarding email validation and JSON escaping.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Updates MariaDB SBOM metadata to use configured package ownership/contact information and identify the SBOM generation tool.
Changes:
- Derives author name and email from CPack metadata.
- Validates the configured contact email.
- Adds SBOM generator tool metadata.
File summaries
| File | Summary |
|---|---|
cmake/sbom.json.in |
Uses configured author metadata and adds tool metadata; vendor values require JSON escaping. |
cmake/generate_sbom.cmake |
Extracts and validates contact email; the validation pattern requires correction. |
Review details
Suppressed comments (1)
cmake/sbom.json.in:36
- [should-fix]
CPACK_PACKAGE_VENDORis inserted verbatim into JSON. Because this CMake value can be overridden, a vendor such asAcme "DB"produces invalid JSON in this newauthors.namefield (and the existingcomponent.supplier.namehas the same issue). Escape the value for JSON beforeconfigure_fileand use the escaped form in both places.
"name": "@CPACK_PACKAGE_VENDOR@"
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # can be found, since the SBOM schema requires the author's email to be a | ||
| # real address. | ||
| FUNCTION(SBOM_GET_CONTACT_EMAIL varname) | ||
| SET(email_regex "^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]+$") |
- set SBOM author to ${CPACK_PACKAGE_VENDOR}
- extract email address from ${CPACK_PACKAGE_CONTACT}
- add metadata.tools.components describing the generator
vaintroub
force-pushed
the
bb-11.8-MDEV-41072
branch
from
September 16, 2026 09:45
57ee0b9 to
2213007
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
metadata.authors[0].namenow usesCPACK_PACKAGE_VENDORinstead of a hardcoded string.metadata.authors[0].emailis now derived fromCPACK_PACKAGE_CONTACT(parsed to pull a valid email out of the "Display Name " RFC 5322 mailbox format, or accept a bare email), instead of being hardcoded.SBOM_GET_CONTACT_EMAIL()incmake/generate_sbom.cmake, which fails the CMake configure with a clear error ifCPACK_PACKAGE_CONTACTdoesn't contain a valid email, since the SBOM schema requires a real address.Test plan
cmake -Pfor:"Name <email>"form, bare"email"form, and an invalid contact string (confirmed it fails withFATAL_ERROR).sbom.jsonhas the expectedsupplier/authorsfields.🤖 Generated with Claude Code