Supporting pnpm through --package-manager pnpm flag

[deluksic]

Hi all,

My company uses pnpm because it's faster and less buggy than npm. This unfortunately means we wouldn't be able to use cyclonedx. However, pnpm has a very similar API to npm so I thought I'd give it a go: https://github.com/deluksic/cyclonedx-node-npm

In this repo (branch deluksic/pnpm-support) I added a flag --package-manager pnpm which modifies just a few lines of code in order to support pnpm. It seems to work quite well. I understand this is not a long term solution, where ideally there would be cyclonedx-pnpm tool directly, but just wanted to show that it only requires a few LOC changes to support both.

Thank you for supporting open source,
David

[jkowalleck]

@deluksic

First, your forked version of @cyclonedx/cyclonedx-npm that you published as @deluksic/cyclonedx-npm
has some issues, that you should address:

• it claims the homepage to be the one from the original
• it claims the repository to be the one from the original
• in its readme it mimics the original. it explains in no way that it is an outdated/modified version, and not the original.

Second, @cyclonedx/cyclonedx-npm is for NPM only. It is unfavorable to support multiple ecosystems and package-managers in a single project.
PNPM is in scope of https://github.com/CycloneDX/cyclonedx-node-pnpm, which has not reached a release, yet. Please direct your PNPM-related efforts to there, pull requests are welcome. :D

[deluksic]

@jkowalleck
Thank you for getting back to me,

Sorry, I'm not familiar with how forking should work in great detail with regards to homepage / repository handling / giving credit etc. I have a custom branch in there where I implemented these features. Should I make those changes only on that branch and then publish again? Would it be enough to have a large disclaimer at the top of the readme?

I did it here just as a proof of concept, I do not expect this to be merged as is or done in this fashion. Just wanted to show how this project could be used as a base for supporting pnpm as well and what changes would be necessary.

I originally looked into cyclonedx-node-pnpm but it looked unfinished, so I did not feel confident suggesting changes against it.
Closing this one is totally understandable.

[jkowalleck]

There are no issues with your fork in general, as this is free software publishund under Apache-2.0 license with addendum/notice text.

The issue is with your publication to NPM as @deluksic/cyclonedx-npm
Please make sure the modified publication discloses that is not the original, but a modified version, and not the original.
References to the original are welcome, if stated, but claiming the repo and hopepage of the fork was the original would confuse your users.

PS: this is me giving no explicit permissions to anything, but giving my opinion on the situation.