sbom-rs icon indicating copy to clipboard operation
sbom-rs copied to clipboard

Integrate improvements from `cargo cyclonedx`?

Open Shnatsel opened this issue 1 year ago • 3 comments

I have recently overhauled a similar tool, cargo cyclonedx. I think cargo sbom would benefit from some of the improvements I made there, specifically:

  • The ability to generate the SBOM for a specific platform with --target
  • The ability to select Cargo features via Cargo-compatible flags such as --no-default-features, --all-features, --features=.... Right now cargo sbom always records the dependency tree for all features.
  • Inclusion of the git and custom registry URLs into the PURL (there are qualifiers for it defined in the specification)
  • Record the binary targets of the toplevel package (e.g. fd-find package has the binary called fd, some packages have multiple binaries)

I am not familiar with the SPDX format so I am not sure if these items also apply there.

Would you be interested in integrating similar changes into cargo sbom? I could probably open pull requests for at least some of this.

Shnatsel avatar Nov 13 '23 23:11 Shnatsel