Program components registration using project metadata

A system comprising:

• a processor;
• and
• a non-transitory storage medium storing instructions executable on the processor to:
• receive, at a proxy, build command information from a build tool, the build command information comprising a build command wrapped, by the build tool, with wrapping information including project metadata, the build command for building a deliverable;
• associate, by the proxy based on the wrapping information, the project metadata with the build command information,
• the project metadata relating to a project associated with building the deliverable comprising program components;
• initiate, by the proxy, a registration of the program components with the project metadata in a provenance repository;
• based on the build command, obtain, by the proxy, the program components from one or more program repositories for building the deliverable;
• receive a request to build component information for the deliverable, wherein the request comprises project information that is part of the project metadata;
• and
• responsive to the request, perform a lookup of the provenance repository using the project information, and generate, based on the lookup of the provenance repository, component information identifying the program components that are part of the deliverable.

A method comprising:

• receiving, by a proxy from a build tool, a proxy command comprising a build command wrapped, by the build tool, with wrapping information including project metadata, the build command used for building a deliverable, and the proxy executed by a system comprising a hardware processor;
• based on the proxy command,
• obtaining, by the proxy, program components from one or more program repositories for building the deliverable with the build tool;
• associating, by the proxy based on the wrapping information, the project metadata with the build command,
• the project metadata relating to a project associated with building the deliverable comprising the program components;
• initiating, by the proxy, a registration of the program components with the project metadata in a provenance repository;
• generating, using the provenance repository, a software bill of materials (SBOM) identifying the collection of program components associated with the deliverable.