Best way to generate an SBOM for a Flutter app?


Keeping in mind the versatility of Flutter as a framework I'm curious if there is any tool out there that integrates well with it to auto generate Bill of Material for a multi-module multi-platform Flutter project.

I am aware of and have tried pana, flutter_oss_manager, Trivy, Syft, cdxgen, even scancode-toolkit with their dashboard to inspect scans

After playing around with all of them many work poorly or are roughly able to generate something but never a full output (finding all transitive deps, their fingerprints, licenses, etc.). Best outputs I found was from a direct gradle plugin from cdxgen which potentially solves 1 out of 5 platforms.

This has to be a solved problem though, right? Anyone who successfully prepared a workflow for SBOM/dependency summary for a flutter project please advise.

1
Mar 20 at 7:38 PM
User AvatarPiotr
#android#ios#flutter#flutter-dependencies#sbom

No answer found for this question yet.