4 ms·
> Most people don't even know what their full set of transitive dependencies is, or how to even go about finding it. I think that’s the point. Also: you reall
by jmull 6y ago
> Most people don't even know what their full set of transitive dependencies is, or how to even go about finding it.
I think that’s the point.
Also: you really do know your direct dependencies since you need them to build your software. If the efforts to promote or require SBOM are successful, your dependencies will all have SBOM and your tooling will be update to help you generate yours.
- dlor 6y agoI don't think that's true in practice. Try it. I did here: https://dlorenc.medium.com/whos-at-the-helm-1101c37bf0f1 https://dlorenc.medium.com/whos-at-the-helm-1101c37bf0f1 It's basically impossible with today's tooling and practices to come up with a list of dependencies for a moderately complex application.
- Ericson2314 6y agoNot true! We do this with Nix and Guix all the time. Any regulation that tries to allow for Docker or trad distros will, yes, fail. But if it raises the bar so only things with sandboxed build steps will qualify, its perfectly possible. This is why it's really important to stear this conversation so the upset procurers don't make some shoddy thing influenced by the whinging of existing contractors, and stick with their gut instincts.