Hacker News new | past | comments | ask | show | jobs | submit login

Debian is my SBOM.



100% of your deps are Debian packages?


Yep, if they aren't then we add them to Debian. For those who aren't yet Debian members, you can do something similar but publish to your own repo instead.


What language are you programming in? Just thinking about how this would work if you are using say React.


Lots of different ones, Perl, Python, C, C++ being the main ones. I think there is JavaScript but I don't work on those parts. Looks like node-react is available in Debian now.

https://packages.debian.org/sid/node-react


Alright, cool. It's a bit confusing to me to create a dependency from your programming language dependency system to the operating system. But whatever works for you.

Wouldn't it be tedious to repackage libraries in Debian format? Why not use cpan or similar directly? Or a local artifact server already supporting existing package formats.


Dependencies across different language ecosystems exist (for eg Python stuff often depends on JavaScript stuff for documentation, or C libraries for faster machine code), it is convenient to encode them all in one package manager format. Repackaging ecosystem libraries is pretty much automated these days but still exposes you to the internals of each library since you need to do QA on everything to get it up to Debian standards first. Once things are in Debian you get an entire community of QA too, checking for new build failures due to changes in other packages, notifying you of new security issues etc.

https://wiki.debian.org/AutomaticPackagingTools




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: