Supply-chain rules for Bazel

This repository contains Bazel modules for injecting and collecting supply-chain metadata into builds.

• Documentation
• Modules
  • @package_metadata

This project is the successor to rules_license.

The intended use cases are:

• declaring metadata about packages, such as
  • the licenses the package is available under
  • the canonical package name and version
  • copyright information
  • ... and more TBD in the future
• gathering license declarations into artifacts to ship with code
• applying organization specific compliance constriants against the set of packages used by a target.
• producing SBOMs for built artifacts.

[!WARNING] The code here is still in active initial development and will churn a lot.

How to participate

• Slack: #supply-chain-security
• Mailing list: bazel-supply-chain-security@bazel.build
• Weekly meeting every Thursday at 8:30am EST / 02:30pm CET (Add to calendar / meet ID / meeting notes)

Roadmap

See this page.

Background reading:

These are for learning about the problem space, and our approach to solutions. Concrete specifications will always appear in checked in code rather than documents.

• License Checking with Bazel.
• OSS Licenses and Bazel Dependency Management
• Adding OSS license declarations to Bazel