Repository navigation
(Scanner) new API to read/walk an SBOM #493
Description
Sometimes we have an SBOM (json file) as input manifest. Package such as @cyclonedx/cdxgen can produce that file for a given local project (package.json).
My idea is to implement a new API that could take the JSON and walk on it.
Activity
fraxken commentedon Jul 19, 2025
Note: probably not easy at all because we draw to draw relationships between the SBOM components
Or a brand new walker that would just take the list of flat dependencies without any need to iterate on sub-dependencies and walk across the tree (since the SBOM expose the tree as a flat list of components from my current understanding)
fraxken commentedon Apr 3, 2026
Now scanner use mama through depWalker. I think we should explore if we can implement SBOM support through ManifestManager class and on what area we have breaking or missing data.