Version 0.2.0 of the PkgToSoftwareBOM.jl package has been released.
PkgToSoftwareBOM.jl produces a Software Bill of Materials (SBOM) describing your Julia environment. At this time, the SBOM produced is in the (SPDX) format. Contributions to support other SBOM formats are welcome.
I created PkgToSoftwareBOM.jl to help the Julia ecosystem get prepared for the emerging future of software supply chain security. If we want to see Julia adoption to continue to grow, then we need to be able to easily create SBOMs to supply to the organizations using Julia packages.
This release includes some minor breaking changes that should not affect most users. Please see the README and CHANGELOG for further details.
Since the last announcement (v0.1.12), two new keywords have been added that provide additional functionality.
Keyword workspace
Julia 1.12 introduced the workspaces feature. Workspaces can be thought of as optional additions to the project. By default PkgToSoftwareBOM does not include the root packages and dependencies of workspace packages.
The user can include workspaces in the SBOM through the use of the keyword `workspace` when creating an spdxCreationData object
Keyword exclude_stdlib
Since v0.1.16, PkgToSoftwareBOM by default includes standard libraries in the SBOM. There are scenarios where a user would wish to exclude them from the SBOM. For example when getting corporate approvals for a package and its dependencies there is no point in including the stdlibs since they are part of the Julia installation and may cause confusion. Stdlibs may be excluded through the use of the keyword exclude_stdlib when creating a spdxCreationData object