Skip to content

RFC: SBOM generation #714

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 22 commits into
base: main
Choose a base branch
from
Open

RFC: SBOM generation #714

Changes from 1 commit
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
fac44c2
rfc for npm cli sbom generation
bdehamer Aug 7, 2023
0b6acf7
sbom rfc refinement
bdehamer Aug 8, 2023
be514e6
spdx example clean-up
bdehamer Aug 9, 2023
649fde5
spdx example clean-up
bdehamer Aug 9, 2023
677ca7c
cyclonedx example clean-up
bdehamer Aug 10, 2023
b354cce
spdx example clean-up
bdehamer Aug 10, 2023
b550c58
clarify cyclonedx npm properties
bdehamer Aug 10, 2023
ab2cea9
clarify cyclonedx sbom output
bdehamer Aug 10, 2023
23170c0
clarify use of workspace flags
bdehamer Aug 14, 2023
0912839
mention @cyclonedx/cyclonedx-library package
bdehamer Aug 14, 2023
52bb0e4
mention @cyclonedx/cyclonedx-npm in prior art
bdehamer Aug 14, 2023
f9738a1
drop section on linked packages
bdehamer Aug 22, 2023
070d29f
update recommendation about format neutrality
bdehamer Aug 23, 2023
9db5619
add --sbom-type flag
bdehamer Sep 12, 2023
617337e
add info about cdx lifecycle phase
bdehamer Sep 12, 2023
fd7783d
add info about negated --workspaces command
bdehamer Sep 12, 2023
7da3739
switch recommended cdx format to 1.5
bdehamer Sep 12, 2023
777f3dc
update impl description
bdehamer Sep 12, 2023
1ff7335
remove bikeshedding about re-using npm-ls
bdehamer Sep 12, 2023
d20e4c5
formatting fixup
bdehamer Sep 12, 2023
4f140b9
update spdx exmample
bdehamer Sep 12, 2023
8370368
update cdx example
bdehamer Sep 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions accepted/0000-sbom-command.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ A new `sbom` command will be added to the npm CLI which will generate an SBOM fo

Supported command options:

`--sbom-format` - SBOM format to use for output. Valid values are “spdx” or “cyclonedx”. In the future, the set of valid values can be expanded to select differents versions of the supported output formats (e.g. "cyclonedx1.4" vs "cyclonedx1.5")
`--sbom-format` - SBOM format to use for output. Valid values are “spdx” or “cyclonedx”. In the future, the set of valid values can be expanded to select differents versions of the supported output formats (e.g. "cyclonedx1.4" vs "cyclonedx1.5").

`--omit` - Dependency types to omit from generated SBOM. Valid values are “dev”, “optional”, and “peer” (can be set multiple times). By default, all development, optional, and peer dependencies will be included in the generated SBOM unless explicitly excluded.

Expand Down Expand Up @@ -162,7 +162,7 @@ _Recommendation: Add a distinct command for generating an SBOM._

* Does `npm-sbom` command have a notion of a “default” SBOM format? Do we give preference to one of CycloneDX/SPDX or do we remain totally neutral (possibly at the expense of DX)? \
\
_Recommendation: Default to SPDX if no format is specified._
_Recommendation: Remain neutral with regard to SPDX vs CycloneDX. Make the `--sbom-format` flag mandatory.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

npm should still be listing the options, at which point, why not default to all of them? being neutral would encourage users to support everything until the ecosystem (maybe) picks a winner.


* Both CycloneDX and SPDX support multiple document formats (JSON, XML, Protocol Buffers, etc). Should we support output of multiple formats, or do we stick w/ JSON? \
\
Expand Down