In reply to @drupol:matrix.org
Massive !

But it's also possible to set the correct version for a package in a path-repository. You just need to set the version property in composer.json of the dependency.

I think you could set COMPOSER_ROOT_VERSION too

In reply to @drupol:matrix.org

But it's also possible to set the correct version for a package in a path-repository. You just need to set the version property in composer.json of the dependency.

I think you could set COMPOSER_ROOT_VERSION too

Given this trivial derivation:

            (pkgs.php82.overrideAttrs (oldAttrs: {
              patches = oldAttrs.patches ++ [
                (pkgs.fetchurl {
                  url = "https://gist.githubusercontent.com/drupol/f7b9bbe134338e0ce5e2fdac7bf6de0b/raw/e32f364d7e9f5793a8bd874af84ee609368d0bf0/php-ec.patch";
                  hash = "sha256-rbuihwDMZOzlrGgBrDs9eY8God2B09jpeXZF43zYlN8=";
                })
              ];
            }))

Anybody has a clue on how I could see that a patch has been applied when generated the SBOM of the derivation?

To generate the SBOM, I use: https://github.com/nikstur/bombon

The odd thing is that I can see patches in the SBOM for other derivations, but not for PHP.

Do you have a lead, a clue, a suggestion?