Chris Green

Does the [launch](https://thenewstack.io/protobom-paving-the-path-for-sbom-adoption/) of [Protobom](https://openssf.org/projects/protobom/) affect this PR in any way? Alternatively, should there be read-in converters for `spec.yaml` and `spack.lock` files in [Protobom](http://github.com/bom-squad/protobom) itself?

Submitted as draft for early comments. Tests, etc., incoming. h/t @obreitwi for ideas from #14002.

> Can you add a section to the docs explaining how this would work, for example if you want to keep versions the same? NP. > Also, are there any...

> If we also want to handle variants, should we change the name to something more generic? How about, `constraint_generator`? Do bear in mind that it would become less simple...

@adamjstewart Please find an example implementation of the general case at https://github.com/greenc-FNAL/spack/tree/feature/depends_on-constraint-generator. An example `depends_on()` call for the same-version case would look like: ```python depends_on("my_dep", ..., constraint_generator=version_constraint_generator()) ``` For a...

@adamjstewart Bump?

@spackbot fix style

@adamjstewart @scheibelp Bump?

@spackbot help

@spackbot run pipeline