How to construct certain public types?

[cyclonedx]

How to construct certain public types?

[amy-keibler]

Hi, @jadamcrain. Thanks for following up. I think that it would be worthwhile for you to try using cyclonedx-bom at this point and let us know if you run into any further issues. we've been working on writing documentation for the library and using that to ensure that every type can be constructed via a user of the library, but we're not quite done yet and so there might be parts of the library that are unused by the CLI that still might have rougher edges.

[jadamcrain]

Awesome. I will give it a try in the next few weeks and provide feedback here. If I run into easily fixed issues I will start a running PR.

[amy-keibler]

Sorry for the delayed response; I have been on vacation this week. Currently, we're in the middle of replacing the partial specification implementation in cargo-cyclonedx with a new, complete one (cyclonedx-bom). You can read about the current progress in #68. Currently, the library supports serialization and deserialization, but is lacking UX polish and documentation. I've been working on documentation and @allisonsierra has been working on the integration between cargo-cyclonedx and cyclonedx-bom. If you have specific feedback or would like to contribute, I'd appreciate it.

As for the newtypes, the intent is to avoid having third party crates as a part of our public API where possible to allow us to swap out dependencies as needed over time.

[jadamcrain]

Thanks @amy-keibler. Using newtypes to hide implementation details makes sense, I just couldn't figure out how to construct them at all.

When the cargo executable starts using this crate for the implementation, I'm sure this will work itself out.

[jadamcrain]

Hi @amy-keibler. Checking in on this issue. It looks like the cargo command now depends on cyclonedx-bom. Do you think it would be worthwhile for me to try using cyclonedx-bom to create my own BOMs now?

[jadamcrain]

Hi @amy-keibler. I've been successful in using cyclonedx-bom 0.4.0 to generate a BOM from my own custom filtering of the build manifest.

The only thing keeping me from using the cargo plugin is #230.

Closing this issue as resolved, ty.