Making explicit fixup heuristics

[JimFuller-RedHat]

Can we list out what we know in terms of fixup heuristics (include failure states - for example 'sbom contains bad data do we fail totally' ) and maybe discuss how we might organise such things going forward ?

[ctron]

Yes, we should have that.

[JimFuller-RedHat]

Minimally we should validate everything that has a schema, then there are usage conventions (ex. there are lots of usage cases for spdx/cyclonedx which might result in surprising ingestion). If we do encounter bad data how do we fixup and maybe create a audit/provenance of such a change ... from a code perspective should we adopt some common idiom for handling fixups in whatever module ?

[JimFuller-RedHat]

from @bobmcwhirter

• removing of bad spdx license assertion
• divining purls from crap CVEs