Skip to content

Commit 1ff7335

Browse files
committed
remove bikeshedding about re-using npm-ls
Signed-off-by: Brian DeHamer <[email protected]>
1 parent 777f3dc commit 1ff7335

File tree

1 file changed

+0
-6
lines changed

1 file changed

+0
-6
lines changed

accepted/0000-sbom-command.md

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -156,12 +156,6 @@ As it relates to the CycloneDX SBOM format, much of the capability described as
156156

157157
## Unresolved Questions and Bikeshedding
158158

159-
* There’s a case to be made that SBOM generation should just be a flag on the existing `npm-ls` command – an SBOM is really just a different format of the output already generated by `npm-ls` (in fact, the CycloneDX tool described above parses the output from `npm-ls` in order to generate its SBOM). However, many of the arguments supported by `npm-ls` don’t really make sense in the context of SBOM generation (package spec filtering, depth, etc…) so it feels like a bit of an awkward fit. \
160-
\
161-
Making it a distinct command allows us to add SBOM-specific features in the future like a `--sign` flag which could be used to generate a signed SBOM. \
162-
\
163-
_Recommendation: Add a distinct command for generating an SBOM._
164-
165159
* Does `npm-sbom` command have a notion of a “default” SBOM format? Do we give preference to one of CycloneDX/SPDX or do we remain totally neutral (possibly at the expense of DX)? \
166160
\
167161
_Recommendation: Remain neutral with regard to SPDX vs CycloneDX. Make the `--sbom-format` flag mandatory.

0 commit comments

Comments
 (0)