Add command to remove dependencies from SPDX source SBOM

[kikofernandez]

Adds command to remove dependencies from SPDX source SBOM.

For example, removing the SPDX package SPDXRef-otp-xmerl implies

• Removing all files from the files section of the SPDX document
• Removing the SPDX package
• Removing depends on this package (reflexive and transitive closure of dependencies)

To facilitate removing dependents, we provide the following command, where the removed.json file contains a list of strings with the packages to be removed.

.github/scripts/otp-compliance.es sbom remove-packages --sbom-file otp.spdx.json --input_file removed.json

[github-actions]

CT Test Results

  1 files   11 suites   3m 38s ⏱️
 95 tests  91 ✅ 4 💤 0 ❌
111 runs  107 ✅ 4 💤 0 ❌

Results for commit 7696b12.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

• Complete CT logs (Download Logs)
• HTML Documentation (Download HTML Docs)
• Windows Installer

// Erlang/OTP Github Action Bot

[garazdawi]

Would it not be better if we did it the other way around? That is give the tool a list of which applications to keep?

[kikofernandez]

We could. My assumption would be that many apps from Erlang/OTP are used.

I am not sure what is best... since this is only for source SBOM, whoever clones our repo probably needs all of it, I would think.
Someone should only remove SPDX packages if they are not part of the clone of Erlang/OTP that they work on...

I do not mind to change it the other way around. I think we need feedback from internal customers or Erlang users to understand what is better.

[kikofernandez]

I can always add one more command call keep-packages instead of remove-packages.
TBH, I am not really sure what are the most common use cases, so maybe it is better to wait until we gather feedback of the most common use case and how we can help them?