@dbuenzli soonish I will have to provide a software bill of materials and thought of an opam dependency list per release (package names + versions). How would you suggest to assemble such?

No idea. I guess @hannes knows better.

Try How does one pin/freeze a version of the dependencies of an opam project/package and then install the project with such specified dependencies? - #7 by kit-ty-kate

If you just need the package name, version and license, and if you are happy with a potential over-approximation you can use the same runes as in VPNKit. ie. install your package in a switch and call opam list with the magic options: $ opam list --installed --required-by=<your-package> --recursive…

currently have the project just ad-hoc, not as a formal opam package yet, but will opamify it. https://seppo.social/sourcecode

On builds.robur.coop we use Orb GitHub - roburio/orb: check opam package reproductibility to build packages and software. It records what opam packages and system packages are installed and is output to files opam-switch and system-packages. It can be inspected at e.g. this build: https://builds.rob…

As mentioned by @reynir , we use orb for https://builds.robur.coop It really depends how you assemble your piece of software. I recommend to just use orb (from GitHub - roburio/orb: check opam package reproductibility ) – which uses the opam library for conducting the build of a single opam package. …

If your build involves more than opam, you might also consider the dkml-runtime-common install_reproducible_* functions . It is a single script you can source, is available from the opam repository (but wget from Makefile is easier), and works on opam build platforms (Linux/macOS/Alpine/etc.) and Win…

currently the release.sh is a bit messy (create changelog, build, sign source, copy to download server, deploy to demo) but I hesitate to pull in infrastructure yet or containerise. Also I want to currently focus on developing software rather than doing infra. Nevertheless I want to be prepared for…

Generating a bills of material for a build

Learning

nojb July 27, 2026, 11:07am 10

A few years later there is now [ANN] ocaml-sbom 0.1.0 (just in case this is still relevant).

Cheers,
Nicolas

Topic		Replies	Views
Bill of Materials for a given (dune) build Ecosystem bom	2	597	July 27, 2026
How does one pin/freeze a version of the dependencies of an opam project/package and then install the project with such specified dependencies? Learning opam	10	1341	February 22, 2023
[ANN] opam 2.1.0~beta4 Ecosystem opam , announce	0	2173	February 10, 2021
Vendoring opam package Ecosystem opam	1	210	December 12, 2024
[ANN] opam build & opam test: the opam plugins that simplifies your dev setup Ecosystem opam , announce , build	1	1163	March 2, 2024

Generating a bills of material for a build

Related topics