Laurent Goderre

@yosifkit example of an SBOM created buy another tool: https://explore.ggcr.dev/?blob=laurentgoderre689/clearlinux@sha256:bdb988504c07acf67d1b35c44fd2a982430ebf5984d3827596b9a7d2a70593b2&mt=application%2Fvnd.in-toto%2Bjson&size=14958

I still think it is

@rainviigipuu is this right as well?

This error message is by design, it tells you that the package file is from a newer version of yarn. You would need to update yarn in your image.

I don't love the added dist either but couldn't get rid of it with the extract command alone. If I use sttip-components 2, the package.json doesn't get extracted

@tianon ok to merge?

I am going to add my response to this here: https://github.com/docker-library/postgres/issues/1319#issuecomment-2665855932

This PR should address this: * https://github.com/k3s-io/k3s/pull/12788