Should `manufacture` be a property of `component`, rather than `metadata`?

[nscuro]

The majority of fields under metadata refer to the BOM itself.

However, metadata.manufacture technically refers to metadata.component:

specification/schema/bom-1.5.schema.json

Lines 263 to 267 in 299209a

	"manufacture": {
	"title": "Manufacture",
	"description": "The organization that manufactured the component that the BOM describes.",
	"$ref": "#/definitions/organizationalEntity"
	},

This can cause confusion because, as mentioned, everything else refers to the BOM, not metadata.component.

Should manufacture be a property of component instead, to make the association more clear?

[stevespringett]

IMO, we should likely add manufacturer to component and update the description of manufacture in the metadata section to reflect the BOM. Thoughts @jkowalleck @coderpatros

[coderpatros]

I agree with that

[jkowalleck]

add manufacturer to component

we already have component.group for that, right?

The grouping name or identifier. This will often be a shortened, single name of the company or project that produced the component, or the source package or domain name. Whitespace and special characters should be avoided. Examples include: apache, org.apache.commons, and apache.org.

---

update the description of manufacture in the metadata section to reflect the BOM

Though this would not change the schema, it still would be a change of the meaning of an element. Which would be a breaking change.

[nscuro]

Though this would not change the schema, it still would be a change of the meaning of an element. Which would be a breaking change.

I agree that this change in semantics could be problematic for BOMs that were generated prior to this.

[stevespringett]

Is this something we want to address for v1.6?

[jkowalleck]

IMO, we should likely add manufacturer to component and update the description of manufacture in the metadata section to reflect the BOM. Thoughts @jkowalleck @coderpatros

Sounds good

will open a pullrequest adding the component manufacturer to components.
this is related to #370 (comment)

PS: possible fix here #372 // #379