sbom-rs
sbom-rs copied to clipboard
Integrate improvements from `cargo cyclonedx`?
I have recently overhauled a similar tool, cargo cyclonedx
. I think cargo sbom
would benefit from some of the improvements I made there, specifically:
- The ability to generate the SBOM for a specific platform with
--target
- The ability to select Cargo features via Cargo-compatible flags such as
--no-default-features
,--all-features
,--features=...
. Right nowcargo sbom
always records the dependency tree for all features. - Inclusion of the git and custom registry URLs into the PURL (there are qualifiers for it defined in the specification)
- Record the binary targets of the toplevel package (e.g.
fd-find
package has the binary calledfd
, some packages have multiple binaries)
I am not familiar with the SPDX format so I am not sure if these items also apply there.
Would you be interested in integrating similar changes into cargo sbom
? I could probably open pull requests for at least some of this.