feat: add manufacturer and authors

[snyk-tim]

• adds manufacturer field to Metadata and Component
• adds authors field to Component
• adds roundtrip testdata for above

[mcombuechen]

Do we need to add logic to convert.go to achieve backwards compatibility for spec versions lower than 1.6? Also, would it make sense to convert a possibly present Component.Manufacturer to Component.Manufacture?

[nscuro]

Also, would it make sense to convert a possibly present Component.Manufacturer to Component.Manufacture?

I have asked my fellow CycloneDX maintainers how to deal with the deprecated Metadata.Manufacture. It's a bit confusing that the deprecation notice recommends to use Component.Manufacturer instead when Metadata.Manufacturer exists as well...

[snyk-tim]

I have asked my fellow CycloneDX maintainers how to deal with the deprecated Metadata.Manufacture.

Thank you

It's a bit confusing that the deprecation notice recommends to use Component.Manufacturer instead when Metadata.Manufacturer exists as well...

Yes I had the same thoughts. This follows the advice from the decouple metadata Spec PR where the message appears in the Changes summary and in each of the three schema files (XSD, JSON Schema and protobuf)

[jkowalleck]

regarding $.metadata.manufacture: this is - per description/spec - the value that describes the manufacturer of the root component.
It is deprecated in favor of the new $.metadata.component.manufacturer.

do not mistake the deprecated $.metadata.manufacture for the new $.metadata.manufacturer.
$.metadata.manufacturer is the manufacturer of the bom - similar to the new $.metadata.authors which is the author of the bom.

please read the spec/descriptions, do not simply make assumptions.

[mcombuechen]

@jkowalleck sorry, I take the blame for this one; my initial suggestion does not make any sense. I meant a conversion of $.metadata.manufacturer when converting to lower specs; but as you already pointed out, this does not make sense either.

[snyk-tim]

👋 Hi, is there anything stopping this from being approved and to get it merged into the spec/1.6 branch? 🙏