Demo

There are multiple demo projects:

• devReq which composer-dev-requires a testing framework/package phpunit and others.
  The demo is intended to run on every environment.
  This also means, the output might not be reproducible on independent systems, due to the fact that version-locks are fluid, and the composer-lock file is not shipped as code.
• laravel-7.12.0 which composer-requires laravel/framework:7.12.0.
  The output is reproducible, due to the shipped composer-locked versions.
  ATTENTION: this demo might use vulnerable dependencies for showcasing purposes.
• local which composer-requires a private/local package cyclonedx/cyclonedx-php-composer-local-demo-dependency and other locals.
  The output is reproducible, due to the shipped composer-locked versions.
• symfony which composer-requires symfony/symfony:@stable in a fluid unlocked version.
  The demo is intended to run on every environment.
  This also means, the output might not be reproducible on independent systems, due to the fact that version-locks are fluid, and the composer-lock file is not shipped as code.

Purpose is to demonstrate how cyclonedx-php-composer integrates, can be used, and how the generated output will look like.

Maintenance

Resulting SBOM data may be generated during integration tests.

Files in **/project/** are marked as linguist-vendored in the .gitattributes.
Therefore, the requirements/dependencies are not maintained by dependabot.

Files in **/example-results/** are marked as linguist-generated in the .gitattributes.
Files in **/results/** are marked as linguist-generated in the .gitattributes.