-
Notifications
You must be signed in to change notification settings - Fork 713
Open
Labels
Description
What would you like to be added:
Static-Built-Using (formerly 'X-Cargo-Built-Using'/'Built-Using') should be parsed/retained in 'parseDpkgStatusEntry'.
Why is this needed:
Go/Rust packages make use of static linking in Debian. The 'Static-Built-Using' field in the binary package is used as a record of the exact version of source code that was used during the build. This information is an important constituent part of SBOM that should be preserved.
Additional context:
A few heavily abridged examples from Debian Trixie:
Package: docker.io
Source: docker.io (26.1.5+dfsg1-9)
Version: 26.1.5+dfsg1-9+b9
Built-Using: golang-go.crypto (= 1:0.25.0-1)
Package: debiman
Version: 0.0~git20220907.a582536-1.1
Static-Built-Using: golang-go.crypto (= 1:0.23.0-1)
Package: ripgrep
Source: rust-ripgrep (14.1.1-1)
Version: 14.1.1-1+b4
X-Cargo-Built-Using: rust-serde (= 1.0.217-1)
spiffcs and kzantow
Metadata
Metadata
Assignees
Labels
Type
Projects
Status
Ready