Add git entries for libarchive and boost in cgmanifest.json (#40155)
The OSPO notice@0 task cannot resolve licenses for components registered with type 'other' (source tarballs). Add parallel type 'git' entries pointing at the GitHub repos with the exact commit SHAs for the release tags (v3.7.7 and boost-1.90.0). The existing 'other' entries are kept for accurate provenance tracking of the actual tarball downloads used by CMake FetchContent. The 'git' entries enable the notice generator to look up licenses from ClearlyDefined. Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ben Hillis committed
Apr 13, 2026 at 08:40 UTC
b61bb853b838711f9ed047e41f8b7f513acd41f9
1 file changed
+29
cgmanifest.json
+29
@@ -11,6 +11,15 @@
11
}
12
}
13
},
14
+ {
15
+ "component": {
16
+ "type": "git",
17
+ "git": {
18
+ "repositoryUrl": "https://github.com/libarchive/libarchive",
19
+ "commitHash": "b439d586f53911c84be5e380445a8a259e19114c"
20
+ }
21
+ }
22
+ },
23
{
24
"component": {
25
"type": "other",
@@ -22,6 +31,26 @@
31
}
32
}
33
},
34
+ {
35
+ "component": {
36
+ "type": "git",
37
+ "git": {
38
+ "repositoryUrl": "https://github.com/boostorg/boost",
39
+ "commitHash": "1bed2b0712b2119f20d66c5053def9173c8462a5"
40
+ }
41
+ }
42
+ },
43
+ {
44
+ "component": {
45
+ "type": "other",
46
+ "other": {
47
+ "name": "boost",
48
+ "version": "1.90.0",
49
+ "downloadUrl": "https://archives.boost.io/release/1.90.0/source/boost_1_90_0.tar.gz",
50
+ "hash": "sha256:5e93d582aff26868d581a52ae78c7d8edf3f3064742c6e77901a1f18a437eea9"
51
+ }
52
+ }
53
+ },
54
{
55
"component": {
56
"type": "other",