CycloneDX / CycloneDX/cyclonedx-node-yarn

[FEATURE] library mode

Open
#252 1 comment 0 reactions 0 assignees View on GitHub
CycloneDX 1.7 enhancement help wanted idea
Dominant language
JavaScript
Stars
26
Forks
11
Avg merge
17m
Merged PRs (30d)
1

Description

## Is your feature request related to a problem? Please describe.

if i build a SBOM for a **library**, i do not want to have non-bundled component listed as if they were concrete.
These dependencies are "external" (a feature sincce CycloneDX 1.7 - [`$.components[].isExternal`](https://cyclonedx.org/docs/1.7/json/#components_items_isExternal)) and the version of them is not clear - it is resolved on install-time .
Also, transitive dependencies of those are not clear until install-time.

This should be reflected in the SBOM.

## Describe the solution you'd like

Spec:

add a n option to have
- only the bundled dependencies and the direct dependencies as components in the SBOM result.
- direct dependencies' components must have no version.
- direct dependencies's components must have a version range - [#321]
- direct dependencies are marked as "extraneous" - [#321]
- the dependency composition completeness is set to "incomplete_first_party_only" - see https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-SBOM-en.pdf page 59

option could be called (list of ideas)
- `--library-mode`
- `--mark-extraneous`
- `--bundled-only`
- add your idea in the comments

new option MUST imply `--omit dev` and must cause

new option MUST be disabled bu default
new option MUST be marked as experimental in help page
new option might set `--mc-type=library'

## Describe alternatives you've considered

- we could make it, so that the existing option `--mc-type=library' causes this behaviour by default, but that would be a breaking change

## Additional context

for libraries, non-bundled components are "extraneous" - this is discussed in [#321]

`package.json` knows the concept of
- `dependencies`
- `bundleDependencies` - definitely shipped
- `peerDependencies` - definitely extraneous
- they can be optional, in addition. example:
```
"peerDependenciesMeta": {
"webpack-cli": {
"optional": true
}
}
```
- `devDependencies` - no intention to be shipped.
might shadow allof the above on build-time

## Contribution

- [ ] I am willing to provide an implementation
- [x] I will wait until somebody else implements it

[#321]: https://github.com/CycloneDX/specification/issues/321

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.