google / google/deps.dev

Support `GetDependencies` to consider "context" information

Open
#64 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
443
Forks
54
Avg merge
1d 22h
Merged PRs (30d)
3

Description

As [your own blog article](https://blog.deps.dev/zillions-of-sboms/index.html#downstream-consumers-control-the-composition) nicely explains, resolved dependencies depend on the context of the downstream consumer, i.e. the application. So when aiming to [create a "build-type-SBOM"](https://www.cisa.gov/sites/default/files/2023-04/sbom-types-document-508c.pdf), additional context has to be provided to the resolution mechanism, like the target framework fur NuGet applications, or the JDK version for Maven applications.

However, currently it seems the `GetDependencies` API cannot take any such context information, making me wonder what the default assumptions about the above-mentioned contexts are.

Ideally, the API would take `system`-dependent context parameters to allow the user to specify these explicitly.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.