4 ms·

Sandwich Bill of Materials

241 points by zdw 9mo ago

owlninja 8mo ago
They better load the SBOM correctly in SAP.
benatkin 8mo ago
What's the purl (Package URL) equivalent of surl:mystery, for stuff like Claude Code, which now only supports running a script to install? It does have a pretty easy to read install script, but the docs don't suggest reading it before running it as an option, they just say to run it https://code.claude.com/docs/en/setup https://code.claude.com/docs/en/setup Also it doesn't address mold: harmful on bread, wonderful when intentionally added to cheese Edit: Claude Code has a homebrew cask, and homebrew supports Linux (I haven't been using it on Linux so it didn't occur to me when reading this). It can be specified in purl using pkg:brew.
TZubiri 8mo ago
Mmmmmh, specifications
McGlockenshire 8mo ago
> AGPL (Affero General Pickle License): Same as GPL, but if you serve the sandwich over a network (delivery apps), you must also publish the recipe. This is why most restaurants avoid AGPL pickles. I love a good APGL joke, and this one especially tickles me because I'm currently a delivery driver instead of a dev.
ThrowawayTestr 8mo ago
The most delightful thing I've read in a while.
SauntSolaire 8mo ago
Hopefully this has built in support for second sourcing
- wiml 8mo ago
  Don't think he knows about second sourcing, Pip.
johndhi 8mo ago
love it - is this a thing that's mostly used in government contracting, or do people encounter SBOM stuff more broadly than that?
- xbar 8mo ago
  I review an SBOM 3 days out of the week before lunch. If you can source your butter and cheese from the same dairy repo you can reduce the overhead of a grilled cheese by about 20%.
- ozim 8mo ago
  You can encounter it when someone is doing due diligence while buying software company. Also it is now hot topic because of CRA in EU.
arealaccount 8mo ago
> The 2025 egg price crisis was a cascading failure equivalent to a left-pad incident, except it affected breakfast.
phendrenad2 8mo ago
> SHA-256 hash of the ingredient at time of acquisition I put mayonnaise on my RAM but I don't know how to hash it.
- all2 8mo ago
  Dice the mayo and sticks of RAM and place in a cast iron skillet over medium heat. Turn it every two or three minutes. Remove when you can smell the magic smoke.
snarky123 8mo ago
Finally, something the software industry can learn from: sandwiches have dependency management figured out.
bzmrgonz 8mo ago
You forgot to accomodate for MCP. You don't expect us to build the sandwiches manually as if we were cavemen living in 2023 do you???
- zdw 8mo ago
  If The Princess Bride is to be believed, MCP stands for the "Mutton Context Protocol".
  - jpitz 8mo ago
    When the tokens are nice and lean.
    - BrenBarn 8mo ago
      But that's not what he said! He distinctly said "AI", so you were probably playing capitalism, and he cheated!
SAI_Peregrinus 8mo ago
This promotes impractical version pinning. That leads to spoilage unless the lockfiles are updated every few hours. Freshness should be checked at build time, and the resolved version for each ingredient recorded in the SBOM but a lockfile SHOULD NOT be used for perishable ingredients. Bacteria will result in Spoilage Vulnerabilities if versions are locked inappropriately.
ponestar 8mo ago
So is "toasting the bread a little bit" in the semver for the bread? Is this part of the integrity hash? Where are post assembly instructions stored? Panini and croque monsieur sandwiches are left out of this spec. Author didn't post the repo so I don't know where to submit an issue.
elzbardico 8mo ago
This is fantastic, now, after implementing SAP home edition at your house, you’ll be able to use the procurement module and leverage EDI to source the ingredients of your sandwich while maintaining full traceability according to the relevant ISO standards.
aranw 8mo ago
I asked claude to use this and create a ham salad sandwich with no onion for me https://gist.github.com/aranw/c2b59f42b20eb47e01bc66841233c2b6 https://gist.github.com/aranw/c2b59f42b20eb47e01bc66841233c2... I'll email this over to my local bakery on Monday for my lunch order might need to make some modifications for there build environment
zahlman 8mo ago
Some sandwich ingredients are known to be used both as standard toppings and as sauce components. To avoid ambiguity, condiments such as guacamole and relish (as well as ketchup) SHOULD define a stable API (Avocado and Pickle Interface).
Animats 8mo ago
What, you've never seen industrial strength sandwich production? [1] https://www.youtube.com/watch?v=_YdWBEJMFyE https://www.youtube.com/watch?v=_YdWBEJMFyE [2] https://www.youtube.com/watch?v=tRUfdBEpFJg https://www.youtube.com/watch?v=tRUfdBEpFJg
gerdesj 8mo ago
Great fun but I will point out that Sandwich is a town in Kent (England, UK). The BoM for Sandwich will be rather more involved than for a sandwich (which will be multiple sub-assemblies of the whole). etc etc, soz!
avs733 8mo ago
Now do something something soup something https://soup.gua-le-ni.com/ https://soup.gua-le-ni.com/

241 points by zdw 9mo ago

They better load the SBOM correctly in SAP.

What's the purl (Package URL) equivalent of surl:mystery, for stuff like Claude Code, which now only supports running a script to install? It does have a pretty easy to read install script, but the docs don't suggest reading it before running it as an option, they just say to run it https://code.claude.com/docs/en/setup https://code.claude.com/docs/en/setup Also it doesn't address mold: harmful on bread, wonderful when intentionally added to cheese Edit: Claude Code has a homebrew cask, and homebrew supports Linux (I haven't been using it on Linux so it didn't occur to me when reading this). It can be specified in purl using pkg:brew.

TZubiri 8mo ago

Mmmmmh, specifications

McGlockenshire 8mo ago

> AGPL (Affero General Pickle License): Same as GPL, but if you serve the sandwich over a network (delivery apps), you must also publish the recipe. This is why most restaurants avoid AGPL pickles. I love a good APGL joke, and this one especially tickles me because I'm currently a delivery driver instead of a dev.

ThrowawayTestr 8mo ago

The most delightful thing I've read in a while.

SauntSolaire 8mo ago

Hopefully this has built in support for second sourcing

wiml 8mo ago
Don't think he knows about second sourcing, Pip.

johndhi 8mo ago

love it - is this a thing that's mostly used in government contracting, or do people encounter SBOM stuff more broadly than that?

xbar 8mo ago
I review an SBOM 3 days out of the week before lunch. If you can source your butter and cheese from the same dairy repo you can reduce the overhead of a grilled cheese by about 20%.
ozim 8mo ago
You can encounter it when someone is doing due diligence while buying software company. Also it is now hot topic because of CRA in EU.

arealaccount 8mo ago

> The 2025 egg price crisis was a cascading failure equivalent to a left-pad incident, except it affected breakfast.

phendrenad2 8mo ago

> SHA-256 hash of the ingredient at time of acquisition I put mayonnaise on my RAM but I don't know how to hash it.

all2 8mo ago
Dice the mayo and sticks of RAM and place in a cast iron skillet over medium heat. Turn it every two or three minutes. Remove when you can smell the magic smoke.

snarky123 8mo ago

Finally, something the software industry can learn from: sandwiches have dependency management figured out.

bzmrgonz 8mo ago

You forgot to accomodate for MCP. You don't expect us to build the sandwiches manually as if we were cavemen living in 2023 do you???

zdw 8mo ago
If The Princess Bride is to be believed, MCP stands for the "Mutton Context Protocol".
- jpitz 8mo ago
  When the tokens are nice and lean.
  - BrenBarn 8mo ago
    But that's not what he said! He distinctly said "AI", so you were probably playing capitalism, and he cheated!

SAI_Peregrinus 8mo ago

This promotes impractical version pinning. That leads to spoilage unless the lockfiles are updated every few hours. Freshness should be checked at build time, and the resolved version for each ingredient recorded in the SBOM but a lockfile SHOULD NOT be used for perishable ingredients. Bacteria will result in Spoilage Vulnerabilities if versions are locked inappropriately.

ponestar 8mo ago

So is "toasting the bread a little bit" in the semver for the bread? Is this part of the integrity hash? Where are post assembly instructions stored? Panini and croque monsieur sandwiches are left out of this spec. Author didn't post the repo so I don't know where to submit an issue.

elzbardico 8mo ago

This is fantastic, now, after implementing SAP home edition at your house, you’ll be able to use the procurement module and leverage EDI to source the ingredients of your sandwich while maintaining full traceability according to the relevant ISO standards.

aranw 8mo ago

I asked claude to use this and create a ham salad sandwich with no onion for me https://gist.github.com/aranw/c2b59f42b20eb47e01bc66841233c2b6 https://gist.github.com/aranw/c2b59f42b20eb47e01bc66841233c2... I'll email this over to my local bakery on Monday for my lunch order might need to make some modifications for there build environment

zahlman 8mo ago

Some sandwich ingredients are known to be used both as standard toppings and as sauce components. To avoid ambiguity, condiments such as guacamole and relish (as well as ketchup) SHOULD define a stable API (Avocado and Pickle Interface).

Animats 8mo ago

What, you've never seen industrial strength sandwich production? [1] https://www.youtube.com/watch?v=_YdWBEJMFyE https://www.youtube.com/watch?v=_YdWBEJMFyE [2] https://www.youtube.com/watch?v=tRUfdBEpFJg https://www.youtube.com/watch?v=tRUfdBEpFJg

gerdesj 8mo ago

Great fun but I will point out that Sandwich is a town in Kent (England, UK). The BoM for Sandwich will be rather more involved than for a sandwich (which will be multiple sub-assemblies of the whole). etc etc, soz!

avs733 8mo ago

Now do something something soup something https://soup.gua-le-ni.com/ https://soup.gua-le-ni.com/