Generating SBOM with application using this library (SubLibraries Version?)

[Asaf-E]

Hi,
I'm using one of the versions of this library (Old one, 1.21)
I know that this library is aggregating multiple libraries (for example: libaws-c-cal),
Is there a way to know what is the version of these libraries?

Thanks!

[jmklix]

Yes, but it's a slightly tedious process to figure it out. Here are the steps I followed to figure this out:

1. go to the releases page on github and find the version of this sdk that you're looking for (1.21.0)
2. click on the commit for that release (b63562f)
3. click on the "Browse files" button in the top right to open the files for that commit (commit b63562f)
4. open the crt folder (crt)
5. here you you will find the commits for aws-c-iot (09ded2b) and aws-crt-cpp (7ff9e03) that are tagged to release 1.21.0
6. to find the version of aws-crt-cpp you can search for the commit in the tags page for that repo
7. this shows that aws-crt-cpp version 0.19.7 was used aws-iot-device-sdk-cpp-v2 1.21.0

Following the above steps and this graph it shows that version 0.5.20 of the aws-c-cal is what was used in version 1.21.0. This is a little tedious, but I'm not sure if there is an easier way. Please let me know if you find a simpler method of figuring this out and/or you have any other questions about this sdk.

[Asaf-E]

Hi, Thank you very much, currently I don't have a simpler method, but this seems like a good options for now.

It is usually possible to use package manager like "conan", whereas the conan center describes all the transitive dependencies, but I couldn't find this library there (Only the sub libraries). Perhaps in the future it will be added there.