In D56474#1375309, @khorben wrote:

In D56474#1369872, @mat wrote:

1. the framework would generate a ${PKGBASE}.pc file during staging, put it in, say, /usr/local/share/sbom/pc and add it to the package.

I don't think this intermediate ${PKGBASE}.pc file needs to be kept.

2. a pkg trigger would run a script on install to run bomtool on the pc file and generate a .spdx file in /usr/local/share/sbom/spdx-2.2, and run spdxtool to generate the .jsonld file in /usr/local/share/sbom/spdx-3.0.1.
3. another pkg trigger would remove the .jsonld and the .spdx files on deinstall.

Why not simply generate the .jsonld and .spdx files during package creation, and include them in the plist?
Then there is no need for any triggers.

Oh, no, the two ports that actually uses do-fetch are already broken, this patch is not what breaks them.

Thank you.

Fixup things and add ports that need fixing.
There are two other ports that define do-fetch and actually call do-fetch.sh biology/gatk and lang/bun, those need more fixing

In D59664#1370294, @dvl wrote:

Are you saying that make -V RUN_DEPENDS will still pull back the usual stuff? Same with make -V BUILD_DEPENDS ... hmm.

In D56474#1369338, @khorben wrote:

In D56474#1369278, @mat wrote:

I have been thinking about sbom for ports a lot the past week, and this gives me a good idea of which way I should head into.

Awesome!

I have been thinking about sbom for ports a lot the past week, and this gives me a good idea of which way I should head into.

In D59664#1369215, @dvl wrote:

I'm guessing you want to implement this ASAP to get it in use.

I will amend FreshPorts to extract this variable. If I got that work done before this change goes into use, it would capture all future uses. If I don't, it's just a one-off script to refresh the database from the ports tree.

NOTE: I'm just thinking out loud because it helps my planning process.

Simplify a bit, no functionnal change

Probably fix makesum and checksum

I may have "fixed" makesum, but maybe not, and I do not seem to find a port to test things.

makesum will need a re-design, thinking about it.

I refactored the 3 targets that had the exact same content. It's missing makesum, which will have the same problem.

As a proof of concept, I only changed the DISTFILES part of do-fetch.

Maybe using \0 instead of \n is better there, and juggling with IFS to split on \0, in case some distfile has a strange file name.

I'm not sure this would fix the command line length, it it just moves the length around.
I've been thinking of a real fix for this, and I think it needs to put it all in a temporary file, kinda