SBOMs via Bazel: Roadmap Update
summary
A working SBOM pipeline now produces SBOMs in Bazel CI by combining rules_pkg/rules_license annotations with package-manager lockfiles, primarily reads Maven lock files to fill gaps; internal tooling exports SPDX today and plans to export CycloneDX as well. Roadmap includes parsing the Bzlmod lockfile, a per‑package override table to correct upstream license claims, reference SBOM generators not one‑size‑fits‑all, and performance work to avoid descending aspects into tool-only deps so graph collection runs faster.
AI-written summary · about