Skip to content

RFC: SBOM generation #714

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 22 commits into
base: main
Choose a base branch
from
Open

RFC: SBOM generation #714

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
fac44c2
rfc for npm cli sbom generation
bdehamer Aug 7, 2023
0b6acf7
sbom rfc refinement
bdehamer Aug 8, 2023
be514e6
spdx example clean-up
bdehamer Aug 9, 2023
649fde5
spdx example clean-up
bdehamer Aug 9, 2023
677ca7c
cyclonedx example clean-up
bdehamer Aug 10, 2023
b354cce
spdx example clean-up
bdehamer Aug 10, 2023
b550c58
clarify cyclonedx npm properties
bdehamer Aug 10, 2023
ab2cea9
clarify cyclonedx sbom output
bdehamer Aug 10, 2023
23170c0
clarify use of workspace flags
bdehamer Aug 14, 2023
0912839
mention @cyclonedx/cyclonedx-library package
bdehamer Aug 14, 2023
52bb0e4
mention @cyclonedx/cyclonedx-npm in prior art
bdehamer Aug 14, 2023
f9738a1
drop section on linked packages
bdehamer Aug 22, 2023
070d29f
update recommendation about format neutrality
bdehamer Aug 23, 2023
9db5619
add --sbom-type flag
bdehamer Sep 12, 2023
617337e
add info about cdx lifecycle phase
bdehamer Sep 12, 2023
fd7783d
add info about negated --workspaces command
bdehamer Sep 12, 2023
7da3739
switch recommended cdx format to 1.5
bdehamer Sep 12, 2023
777f3dc
update impl description
bdehamer Sep 12, 2023
1ff7335
remove bikeshedding about re-using npm-ls
bdehamer Sep 12, 2023
d20e4c5
formatting fixup
bdehamer Sep 12, 2023
4f140b9
update spdx exmample
bdehamer Sep 12, 2023
8370368
update cdx example
bdehamer Sep 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
128 changes: 100 additions & 28 deletions accepted/0000-sbom-command.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,51 +207,57 @@ The proposed CycloneDX SBOM generated for the project above would look like the

```json
{
"$schema": "https://cyclonedx.org/schema/bom-1.5.schema.json",
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"serialNumber": "urn:uuid:f2fa9eae-72f1-430c-a9b3-986ffe05bc6e",
"serialNumber": "urn:uuid:0ffefc31-0159-4197-8551-26103dd0280f",
"version": 1,
"metadata": {
"timestamp": "2023-08-10T00:19:08.697Z",
"timestamp": "2023-09-12T21:40:13.091Z",
"lifecycles": [
{ "phase": "build" }
{
"phase": "build"
}
],
"tools": [
{
"vendor": "npm",
"name": "cli",
"version": "9.8.1"
"version": "10.1.0"
}
],
"component": {
"bom-ref": "[email protected]",
"type": "application",
"name": "hello-world",
"version": "1.0.0",
"scope": "required",
"purl": "pkg:npm/[email protected]",
"properties": [
{
"name": "cdx:npm:package:path",
"value": ""
}
],
"externalReferences": [],
"licenses": [
{
"license": {
"id": "ISC"
}
}
]
}
},
"components": [
{
"bom-ref": "@tsconfig/[email protected].3",
"bom-ref": "@tsconfig/node14@14.1.0",
"type": "library",
"name": "@tsconfig/node14",
"version": "1.0.3",
"scope": "required",
"purl": "pkg:npm/%40tsconfig/[email protected]",
"externalReferences": [
{
"type": "distribution",
"url": "https://registry.npmjs.org/@tsconfig/node14/-/node14-1.0.3.tgz"
}
],
"version": "14.1.0",
"scope": "optional",
"description": "A base TSConfig for working with Node 14.",
"purl": "pkg:npm/%40tsconfig/[email protected]",
"properties": [
{
"name": "cdx:npm:package:path",
Expand All @@ -262,10 +268,35 @@ The proposed CycloneDX SBOM generated for the project above would look like the
"value": "true"
}
],
"externalReferences": [
{
"type": "distribution",
"url": "https://registry.npmjs.org/@tsconfig/node14/-/node14-14.1.0.tgz"
},
{
"type": "vcs",
"url": "git+https://github.com/tsconfig/bases.git"
},
{
"type": "website",
"url": "https://github.com/tsconfig/bases#readme"
},
{
"type": "issue-tracker",
"url": "https://github.com/tsconfig/bases/issues"
}
],
"hashes": [
{
"alg": "SHA-512",
"content": "cac4fc9a1762c562..."
"content": "566b021b4e18479f..."
}
],
"licenses": [
{
"license": {
"id": "MIT"
}
}
]
},
Expand All @@ -275,24 +306,45 @@ The proposed CycloneDX SBOM generated for the project above would look like the
"name": "debug",
"version": "4.3.4",
"scope": "required",
"author": "Josh Junon",
"description": "Lightweight debugging utility for Node.js and the browser",
"purl": "pkg:npm/[email protected]",
"properties": [
{
"name": "cdx:npm:package:path",
"value": "node_modules/debug"
}
],
"externalReferences": [
{
"type": "distribution",
"url": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz"
}
],
"properties": [
},
{
"name": "cdx:npm:package:path",
"value": "node_modules/debug"
"type": "vcs",
"url": "git://github.com/debug-js/debug.git"
},
{
"type": "website",
"url": "https://github.com/debug-js/debug#readme"
},
{
"type": "issue-tracker",
"url": "https://github.com/debug-js/debug/issues"
}
],
"hashes": [
{
"alg": "SHA-512",
"content": "3d15851ee494dde0..."
}
],
"licenses": [
{
"license": {
"id": "MIT"
}
}
]
},
{
Expand All @@ -301,24 +353,44 @@ The proposed CycloneDX SBOM generated for the project above would look like the
"name": "ms",
"version": "2.1.2",
"scope": "required",
"description": "Tiny millisecond conversion utility",
"purl": "pkg:npm/[email protected]",
"properties": [
{
"name": "cdx:npm:package:path",
"value": "node_modules/ms"
}
],
"externalReferences": [
{
"type": "distribution",
"url": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz"
}
],
"properties": [
},
{
"name": "cdx:npm:package:path",
"value": "node_modules/ms"
"type": "vcs",
"url": "git+https://github.com/zeit/ms.git"
},
{
"type": "website",
"url": "https://github.com/zeit/ms#readme"
},
{
"type": "issue-tracker",
"url": "https://github.com/zeit/ms/issues"
}
],
"hashes": [
{
"alg": "SHA-512",
"content": "b0690fc7e56332d9..."
}
],
"licenses": [
{
"license": {
"id": "MIT"
}
}
]
}
],
Expand All @@ -327,11 +399,11 @@ The proposed CycloneDX SBOM generated for the project above would look like the
"ref": "[email protected]",
"dependsOn": [
"[email protected]",
"@tsconfig/[email protected].3"
"@tsconfig/node14@14.1.0"
]
},
{
"ref": "@tsconfig/[email protected].3",
"ref": "@tsconfig/node14@14.1.0",
"dependsOn": []
},
{
Expand Down