Nordix / bomres

Software Bill-of-Material Resolver
Apache License 2.0
7 stars 6 forks source link

Two types of resolved SBOM #94

Open hans-lammda opened 1 year ago

hans-lammda commented 1 year ago

There is two kinds of package dependencies.

Transitive could also introduce new packages.

The current implementation of the resolved.json indicates with a key if the all dependencies being included. The download command should be blocked if transitive packages are missing.