Post B6OPkR3Vx82n5NsDxY by jab01701mid@mastodon.social
 (DIR) More posts by jab01701mid@mastodon.social
 (DIR) Post #B6OOPTUbb5EubmzE1I by jab01701mid@mastodon.social
       0 likes, 0 repeats
       
       @dalias When I've done this kind of thing, I call it a "Software Inventory" or "Manifest", not a BOM. It's organized around security and licensing as you say, but not "here's every part you need to build something commercial-grade from this pile of SW (which itself is moving beneath you)"
       
 (DIR) Post #B6OOPThMpdRpFMxPua by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @jab01701mid @dalias isn’t a manifest "this is what I ship", with checksums? (IIRC this is what CPAN uses?)Inventory… fits better.I just called it "list of recurse dependencies", with scopes for compile-time and/or test-time and/or runtime, provided or bundled, is what I used when I wrote my licence analysis helpers for Maven projects.
       
 (DIR) Post #B6OPkR3Vx82n5NsDxY by jab01701mid@mastodon.social
       0 likes, 1 repeats
       
       @mirabilos @dalias Way back in the day, Quarterdeck made a little utility to summarize your computer's HW, CPU, RAM, display tech, and OS/BIOS, and it was called "Manifest", so I'm influenced by that usage !One day, I was filling out the HDMI compliance document for BigCorp, and it asked for the manufacturer and part number of the actual physical connector used on the product, which had to be from the approved list. Nobody had noticed until then that our vendor was not on the list...
       
 (DIR) Post #B6OSj2mF2BExMNp38i by drmikepj@mastodon.social
       0 likes, 0 repeats
       
       @dalias I’m a hardware engineer. You’re right that a BOM is a list of components, and some of those are custom to the product, some are single-source proprietary, some are multi-sourceable (or substitutes), and some are fully generic. So a BOM can be extended to include supplier information and alternative sources (“second-sourcing” is often an important strategy to deal with sudden peaks in demand or failure in the supply chain).
       
 (DIR) Post #B6OSj2voSatdq4Ih3g by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @dalias @drmikepj still more of an interface definition than a post-fact shopping list
       
 (DIR) Post #B6OSj3DBQ0n6hwQZ8K by drmikepj@mastodon.social
       0 likes, 0 repeats
       
       @dalias Software can be the same, but you’re right that a supply chain analysis isn’t the same as a BOM.