Sorry about this hustle. Didn't remember that every sentence in own line rule. Now it should be better and solid.

Used grammar tool to verify language and added some commas where they where suggested. Bit worked a language and removed some repeating and added some also. Also split every sentence to own line.

Hopefully I got it correct this time.

Updated wording from reviewed version.

All seems to be making text better. Should mark them done or upload new patch with changes?

Updated using git-arc to make sure they are in sync

Update patch per review

Hopefully I've got them all and understood correctly. You can do what ever needed changes needed.

Update patch against review

But probably this one and others should be closed then..

In D53318#1224441, @bapt wrote:

if I have in mind something like Jfrog's xray to generate a sbom, I woud push my build packages into a artifactory repository and let xray extract the needed information from the packages, not from the build framework.

Sorry I don't quite get this. If I understand this done on packaging level and not on source level? It just uses packaging information from FreeBSD ports and not touch currently source at all. If you mean with packaging level making SBOM from running system from installed packages it's ofcourse totally diffrent case.

In D51414#1175013, @bofh wrote:

In D51414#1174997, @tuukka.pasanen_ilmi.fi wrote:

I've tested few random packages in ports.

• It's bit confusing that check-spdx-license compiles things when one might just want to check license. What I mean is that it should just extract and check license file in current port directory not try to compile whole package?

I think that is what this is doing. It's extracting and checking the license. There is no compiling involved.

Then is just me.. I find it confusing in some tested ports like Go ones just print so much stuff and it looks like it starts compile something.

I've tested few random packages in ports.