Hello, I’ve been working with SBOMs with nix for a while and realized there’s many things missing. As nixpkgs is a community project, I believe it would be good for many of us to come together and discuss how to best approach it. I’ve created a matrix room (https://matrix.to/#/#nixpkgs-sbom:matrix.org) that anyone is free to join. The goal is to form a plan on how to best provide accurate metadata in packages for SBOMs. From there, that will be implemented in nixpkgs and scaled up. If you have any questions, feel free to join and ask.
@RossComputerGuy What’s the status of this team? Since you work for DetSys, I assume there’s team collaboration happening regarding the recent FlakeBOM DetSys announcement, right?
There’s not been much activity, the hope has been to standardize on meta for SBOM’s. Since PURL’s landed, that’s been great. Been wanting meta.packageTypes so a package can declare something like the CycloneDX Component Type or SPDX type but no activity on that PR.