Is it possible to add the NuGet package source URL to the report

[paulomorgado]

I have multiple NuGet sources mapped in my NuGet.config file.

I know where each package comes from, but if I hand over the SBOM to a person that does not know it, it can be a daunting task figuring out where each package comes from.

Is there a way to add the NuGet source to each reported NuGet package?

Refernces:

• nuget.config reference > Package source mapping section
• Package Source Mapping > Enable by manually editing nuget.config

[mtsfoni]

Currently it is not possible.

I created an "Issue" and will think about it.
Need to see if a) i can extract that information in a reasonable way and b) find a good field in the cyclonedx standard to store the information.