Document new BOM manufacturer setting

docs/concepts/projects.md

@@ -18,7 +18,10 @@ Each project has:
   [classifier list](../reference/projects.md#classifiers).
 - Optional ecosystem identifiers: a Package URL, a CPE, or a SWID tag.
 - Descriptive metadata such as a group, a description, authors, a supplier, a manufacturer,
-  and external references.
+  and external references. A project's manufacturer describes who makes the software the
+  project represents, which differs from the
+  [BOM manufacturer](../reference/file-formats.md#bom-manufacturer) that identifies who
+  produced the BOM document.
 - Tags (categorical labels) and project properties (typed key-value metadata).
 - An optional parent, forming a hierarchy.
 - An access list controlling which teams can see it.

docs/guides/administration/.pages

@@ -10,6 +10,7 @@ nav:
   - configuring-http-proxy.md
   - configuring-timezone.md
   - configuring-banner.md
+  - configuring-bom-manufacturer.md
   - configuring-vulnerability-sources.md
   - running-air-gapped.md
   - configuring-observability.md

docs/guides/administration/configuring-bom-manufacturer.md

@@ -0,0 +1,51 @@
+# Configuring the BOM manufacturer
+
+Dependency-Track can record the organization that produces the BOMs it generates.
+This guide covers how administrators configure that organization for the whole instance.
+
+## Overview
+
+CycloneDX documents generated by Dependency-Track can identify their producer in the
+`metadata.manufacturer` entry.
+
+Configure the instance-wide manufacturer from the administration UI under
+**Administration → Configuration → General** (route `/admin/configuration/general`).
+
+!!! note
+    Access to the general configuration requires the `SYSTEM_CONFIGURATION`
+    permission.
+
+## Settings
+
+The **BOM Manufacturer** section exposes the following fields:
+
+| Setting | Description |
+| --- | --- |
+| **Name** | Name of the organization that produces the BOMs. |
+| **URL** | Website of the organization. |
+| **Contact name** | Name of the contact within the organization. |
+| **Contact email** | The contact's email address. |
+
+All four fields are optional. Leaving them empty removes the instance-wide fallback, so
+only projects that carry their own manufacturer keep the entry in their generated
+documents.
+
+## Configuring the manufacturer
+
+1. Open **Administration → Configuration → General**.
+2. Enter the organization details in the **BOM Manufacturer** fields.
+3. Select **Update** to save.
+
+The values apply to every project that does not supply its own manufacturer.
+
+## Project-specific manufacturers
+
+When an uploaded BOM records a manufacturer of its own, Dependency-Track stores that value
+with the project and uses it for that project's exports, in place of the instance-wide
+setting. Every other project falls back to the instance-wide setting. See
+[BOM manufacturer](../../reference/file-formats.md#bom-manufacturer).
+
+!!! note
+    CycloneDX added `metadata.manufacturer` in version 1.6, and generated documents use
+    CycloneDX 1.5 by default. Request version 1.6 or later when exporting to include the
+    manufacturer entry. See [Output version](../../reference/file-formats.md#output-version).

docs/reference/file-formats.md

@@ -23,6 +23,29 @@ Dependency-Track also **generates** CycloneDX documents in several forms:
 | VEX | A Vulnerability Exploitability Exchange document containing analysis decisions (states, justifications) for a project's findings. |
 | VDR | A Vulnerability Disclosure Report containing full vulnerability data for a project's components. |
 
+### Output version
+
+Generated documents use CycloneDX 1.5 by default. The `version` query parameter of the
+export endpoints selects a different version of the specification.
+
+### BOM manufacturer
+
+Generated documents can carry a `metadata.manufacturer` entry identifying the organization
+that produced the BOM. Dependency-Track takes the first value available from:
+
+1. The manufacturer recorded in the project's most recently imported BOM.
+2. The instance-wide manufacturer under **Administration → Configuration → General**,
+   described in
+   [Configuring the BOM manufacturer](../guides/administration/configuring-bom-manufacturer.md).
+
+Documents omit the entry when neither holds a value.
+
+CycloneDX added `metadata.manufacturer` in version 1.6. Documents generated in earlier
+versions of the specification omit the entry, including the 1.5 default.
+
+The BOM manufacturer is distinct from the manufacturer of the project itself, which
+describes the subject of the BOM rather than its producer.
+
 ## Finding Packaging Format (FPF)
 
 The Finding Packaging Format (FPF) is a Dependency-Track-native JSON format for