Is it possible to add the NuGet package source URL to the report

[mtsfoni]

Discussed in #1096

^{Originally posted by paulomorgado May 27, 2026}
I have multiple NuGet sources mapped in my NuGet.config file.

I know where each package comes from, but if I hand over the SBOM to a person that does not know it, it can be a daunting task figuring out where each package comes from.

Is there a way to add the NuGet source to each reported NuGet package?

Refernces:

• nuget.config reference > Package source mapping section
• Package Source Mapping > Enable by manually editing nuget.config

[paulomorgado]

Hi @mtsfoni,

I maybe be able to help with that.

There are MSBuild ways to do that, or you can use the existing NuGet.config mappings.

It all depends how that is being done now.

[coderpatros]

In regards to the mechanism for storing this information in the BOM, it can be added as a package URL repository_url qualifier