@sethmlarson, I tried to use generate_sbom.py:

$ python3 Tools/build/generate_sbom.py
Version '4.0.0' for package 'mpdecimal not in all 'externalRefs[].referenceLocator' fields

Do I have to manually edit Misc/sbom.spdx.json?

@SethMichaelLarson, I tried to use generate_sbom.py:

$ python3 Tools/build/generate_sbom.py
Version '4.0.0' for package 'mpdecimal not in all 'externalRefs[].referenceLocator' fields

Do I have to manually edit Misc/sbom.spdx.json?

I think you mean @sethmlarson :)

Thanks for reporting this @erlend-aasland and apologies for the trouble. It wasn't the intent to require the user to update the CPE value, I've opened a PR to automatically update the CPE version value.

If you need to get this update in ASAP, I recommend updating the CPE value manually in Misc/externals.spdx.json.

Thanks for reporting this @erlend-aasland and apologies for the trouble. It wasn't the intent to require the user to update the CPE value, I've opened a PR to automatically update the CPE version value.

Thank you so much!

If you need to get this update in ASAP, I recommend updating the CPE value manually in Misc/externals.spdx.json.

I tried to manually update the value in 3031684.