3 ms·

this looks cool but apparently the entire project seems to just boot up a few days ago

• rswail 5y ago
  Well, that's a good thing if they are open to creating a community, which is what they're looking for on first inspection. The idea of using a directed acyclic graph, along with content addressable artifacts (or representation of external artifacts) could potentially work well alongside spdx and other standards for identifying packages and dependencies at a higher level of abstraction. Delivering a git repo as your SBOM has distinct advantages in terms of tooling and reproducability, and general "gitops"/git flow processes accomodate multiple releases and signed tags to provide roots of trust for SBOMs.