Bill of Materials for a given (dune) build

is there a way to semi-automatically get a comprehensive opam package version list for all transitive dependencies of a build?

E.g. when building for a security audit that would come in handy.

Dear @mro,

not explicitly dune related, but there is orb, which is an alternative to use opam (it uses opam libraries under the hood), and produces a three-fold:

From these three things, in case your opam package and dependencies are reproducible, you can reproduce the exactly same artifact. Be aware that orb is as well tested for reproducibility on a daily fashion, and we have both Debian/Ubuntu packages (at and FreeBSD packages (

It is meant to be executed in a clean container/jail, and doesn’t cleanup the system packages. Thus it is a good idea to start with a nearly empty container :slight_smile:

Enjoy and don’t hesitate to ask further questions.

1 Like