SamuraiAku / PkgToSoftwareBOM.jl

Produces a Software Bill of Materials (SBOM) describing your Julia Pkg environment. SBOM is in the SPDX format
MIT License
17 stars 2 forks source link

Extract subdirectory info when tracking a repository if it exists #24

Open SamuraiAku opened 1 year ago

SamuraiAku commented 1 year ago

The DownloadLocation field of SpdxPackageV2 has a space for marking when a package is not at the root of a repository:

<vcs_tool>+<transport>://<host_name>[/<path_to_repository>][@<revision_tag_or_branch>][#<sub_path>]

For an example of when this is true, see RecipesBase.jl which is in a subdirectory of the Plots.jl repository. If you're getting the package through a registry we can fill in the information from the registry.

But when tracking a repository directly, there is no registry information and the subdirectory is not in the package infomation, just the repository root. There must be a registry-like piece of information somewhere in Pkg for tracking this. Need to find that and somehow incorporate it into the code.