Skip to content

Commit 070d29f

Browse files
committed
update recommendation about format neutrality
Signed-off-by: Brian DeHamer <[email protected]>
1 parent f9738a1 commit 070d29f

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

accepted/0000-sbom-command.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ A new `sbom` command will be added to the npm CLI which will generate an SBOM fo
2323

2424
Supported command options:
2525

26-
`--sbom-format` - SBOM format to use for output. Valid values are “spdx” or “cyclonedx”. In the future, the set of valid values can be expanded to select differents versions of the supported output formats (e.g. "cyclonedx1.4" vs "cyclonedx1.5")
26+
`--sbom-format` - SBOM format to use for output. Valid values are “spdx” or “cyclonedx”. In the future, the set of valid values can be expanded to select differents versions of the supported output formats (e.g. "cyclonedx1.4" vs "cyclonedx1.5").
2727

2828
`--omit` - Dependency types to omit from generated SBOM. Valid values are “dev”, “optional”, and “peer” (can be set multiple times). By default, all development, optional, and peer dependencies will be included in the generated SBOM unless explicitly excluded.
2929

@@ -162,7 +162,7 @@ _Recommendation: Add a distinct command for generating an SBOM._
162162

163163
* Does `npm-sbom` command have a notion of a “default” SBOM format? Do we give preference to one of CycloneDX/SPDX or do we remain totally neutral (possibly at the expense of DX)? \
164164
\
165-
_Recommendation: Default to SPDX if no format is specified._
165+
_Recommendation: Remain neutral with regard to SPDX vs CycloneDX. Make the `--sbom-format` flag mandatory.
166166

167167
* Both CycloneDX and SPDX support multiple document formats (JSON, XML, Protocol Buffers, etc). Should we support output of multiple formats, or do we stick w/ JSON? \
168168
\

0 commit comments

Comments
 (0)