I've played a bit with trying to generate SBOM for an old project that I've thrown into Bazel just for fun, to see if this would be compatible with an SPDX GitHub action: https://github.com/marketplace/actions/spdx-dependency-submission-action
Since I didn't feel like figuring out Bzlmod (especially not figuring out registries or potentially rewriting some sensitive Skylark rules), I've locked down this project onto 6.5.0 -- like most other things where I used Bazel.
Unfortunately:
Error: 'TransitiveMetadataInfo' value has no field or method 'other_metadata'
Available attributes: deps, licenses, traces
I arbitrarily picked 8.0.0, but that's already complaining about removal of WORKSPACE support and failing to find a http_archive repo declared in the WORKSPACE, scolding me for not being modern and up to date.
I understand it's well overdue for me to move to modules, but any time I look at the migration guide, I'm not looking forward to it: https://bazel.build/external/migration and even less so since I'll have to set up a custom registry: https://bazel.build/external/registry given the custom rules and repos this old project depends on would all1 be a terrible fit for the central registry.
Avoiding 8.0.0, I tried 7.7.0, however, the same error persists.
Is there any chance of making the basic @rules_license//rules_gathering:generate_sbom.bzl generate_sbom() work with Bazel 6.5.0 or at least Bazel 7.7.0, avoiding the 8.x series for those who really have little interest in dealing with modules or index registries? Does the gathering process otherwise depend on modules?
I've played a bit with trying to generate SBOM for an old project that I've thrown into Bazel just for fun, to see if this would be compatible with an SPDX GitHub action: https://github.com/marketplace/actions/spdx-dependency-submission-action
Since I didn't feel like figuring out Bzlmod (especially not figuring out registries or potentially rewriting some sensitive Skylark rules), I've locked down this project onto 6.5.0 -- like most other things where I used Bazel.
Unfortunately:
I arbitrarily picked 8.0.0, but that's already complaining about removal of
WORKSPACEsupport and failing to find ahttp_archiverepo declared in theWORKSPACE, scolding me for not being modern and up to date.I understand it's well overdue for me to move to modules, but any time I look at the migration guide, I'm not looking forward to it: https://bazel.build/external/migration and even less so since I'll have to set up a custom registry: https://bazel.build/external/registry given the custom rules and repos this old project depends on would all1 be a terrible fit for the central registry.
Avoiding 8.0.0, I tried 7.7.0, however, the same error persists.
Is there any chance of making the basic
@rules_license//rules_gathering:generate_sbom.bzlgenerate_sbom()work with Bazel 6.5.0 or at least Bazel 7.7.0, avoiding the 8.x series for those who really have little interest in dealing with modules or index registries? Does the gathering process otherwise depend on modules?Footnotes
Two out of three repos are rules that have no uses beyond the 'old project' -- one of those is not even really distributable. The only usable one, SDL 1.2, is barely working. ↩