k8-sig's BOM

[dgutson]

Hi, I wanted to ask about the functionality relationship between ORT and https://github.com/kubernetes-sigs/bom:

• can ORT benefit from it with some integration?
• or, are they mutually exclusive by running at the same functional level?

Thanks.

[sschuberth]

Looks like the bom tool basically accepts two types of input: containers and directories / files. Only if the directory happens to contain a Go module, package-level dependencies are determined. I.e. bom completely lacks ORT's package-manager support. If the directory is not a Go module, its files are being listed as part of the SPDX BOM.

So bottom line, bom rather seems to complement ORT than offering the same functionality, and eventually bom could be used to implement #1833.

[dgutson]

Thanks, you might want to update #1833 (comment) then.