Running west spdx using NCS 3.4.0 / Zephyr 4.4.0), the generated zephyr.spdx file (generated in CI) for our application contains a Gitlab token in PackageDownloadLocation.
##### Package: drivers-sources
PackageName: drivers-sources
SPDXID: SPDXRef-drivers-sources
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
PrimaryPackagePurpose: SOURCE
PackageDownloadLocation: git+gitlab-ci-token:glcbt-....gitlab.....com/.../project.git@...
PackageVersion: ...
FilesAnalyzed: false
PackageComment: Utility target; no files
Our build steps: - west spdx --init -d build/${BOARD}/project
- west build -b ${BOARD} -p
- west spdx -d build/${BOARD}/project -s artifacts/west-spdx/ --spdx-version 2.3
Note, that is not the west ncs-sbom, but west spdx.
Is this a known issue?
Is this already fixed in the updated tooling for SPDX 3.0 coming with the next NCS/Zephyr release?
