❯ git bisect bad
042a8c212801aeac42b7a41b42cd1185ae28123a is the first bad commit
commit 042a8c212801aeac42b7a41b42cd1185ae28123a
Author: Jordi Boggiano <j.boggiano@seld.be>
Date:   Wed Jan 10 13:33:49 2024 +0100

    Ensure dist url/type/checksum remain the same when doing lock hash updates, refs #11787

 src/Composer/DependencyResolver/LockTransaction.php | 3 +++
 1 file changed, 3 insertions(+)
~/C/d/composer > 042a8c2(BISECTING)  > php ❯

In reply to @stephank:stephank.nl
I wrote about dealing with private packages: https://stephank.nl/p/2024-02-17-using-nix-flake-inputs-with-php-composer.html

In reply to @drupol:matrix.org
Massive !

But it's also possible to set the correct version for a package in a path-repository. You just need to set the version property in composer.json of the dependency.

I think you could set COMPOSER_ROOT_VERSION too

In reply to @drupol:matrix.org

But it's also possible to set the correct version for a package in a path-repository. You just need to set the version property in composer.json of the dependency.

I think you could set COMPOSER_ROOT_VERSION too

Given this trivial derivation:

            (pkgs.php82.overrideAttrs (oldAttrs: {
              patches = oldAttrs.patches ++ [
                (pkgs.fetchurl {
                  url = "https://gist.githubusercontent.com/drupol/f7b9bbe134338e0ce5e2fdac7bf6de0b/raw/e32f364d7e9f5793a8bd874af84ee609368d0bf0/php-ec.patch";
                  hash = "sha256-rbuihwDMZOzlrGgBrDs9eY8God2B09jpeXZF43zYlN8=";
                })
              ];
            }))

Anybody has a clue on how I could see that a patch has been applied when generated the SBOM of the derivation?

To generate the SBOM, I use: https://github.com/nikstur/bombon

The odd thing is that I can see patches in the SBOM for other derivations, but not for PHP.

Do you have a lead, a clue, a suggestion?