Dear TC members, We have "relationships" in CSAF (and CVRF), and it can provide the recursive SBOM information. The current limitation is "full_product_name" inside "relationship" doesn't have any vendor information, which implies "full_product_name" should be from the same vendor who publishes CSAF. ...
|