Conversation
| EcosystemTerraform = "Terraform" | ||
| EcosystemTerraformModule = "TerraformModule" | ||
| EcosystemTerraformProvider = "TerraformProvider" | ||
| EcosystemPHPComposer = "Composer" |
There was a problem hiding this comment.
The Ecosystem for PHP Composer is actually called Packagist
https://osv.dev/list?ecosystem=Packagist
| "github.com/safedep/vet/pkg/models" | ||
| ) | ||
|
|
||
| type ComposerJSON struct { |
There was a problem hiding this comment.
Can you add a comment with reference to Composer JSON specification from official source? We need to see if we need any other information like dependency relationships for building dependency graph.
| case customParserTerraform: | ||
| return models.EcosystemTerraform | ||
| case customParserComposer: | ||
| return models.EcosystemPHPComposer |
There was a problem hiding this comment.
It should be packagist ecosystem
| models.EcosystemSpdxSBOM: true, | ||
| models.EcosystemGitHubActions: true, | ||
| models.EcosystemTerraform: true, | ||
| models.EcosystemPHPComposer: true, |
There was a problem hiding this comment.
This is not required. We should just use the Packagist ecosystem
|
@insaaniManav As I read more about Composer, I see there are two files
This is similar to I think we should spend some time reading about Composer and decide on how to handle it. |
|
According to my research
|
2 participants
Fixes #257