Update patch per review

Hopefully I've got them all and understood correctly. You can do what ever needed changes needed.

Update patch against review

But probably this one and others should be closed then..

In D53318#1224441, @bapt wrote:

if I have in mind something like Jfrog's xray to generate a sbom, I woud push my build packages into a artifactory repository and let xray extract the needed information from the packages, not from the build framework.

Sorry I don't quite get this. If I understand this done on packaging level and not on source level? It just uses packaging information from FreeBSD ports and not touch currently source at all. If you mean with packaging level making SBOM from running system from installed packages it's ofcourse totally diffrent case.

In D51414#1175013, @bofh wrote:

In D51414#1174997, @tuukka.pasanen_ilmi.fi wrote:

I've tested few random packages in ports.

• It's bit confusing that check-spdx-license compiles things when one might just want to check license. What I mean is that it should just extract and check license file in current port directory not try to compile whole package?

I think that is what this is doing. It's extracting and checking the license. There is no compiling involved.

Then is just me.. I find it confusing in some tested ports like Go ones just print so much stuff and it looks like it starts compile something.

I've tested few random packages in ports.