Skip to content

Commit ecda95a

Browse files
bdehamerbdehamer
authoredOct 6, 2023
feat: add npm sbom command (#6841)
·
v9.9.4arborist-v6.5.0
1 parent 7cd329d commit ecda95a

27 files changed

+10317
-56
lines changed
 

‎DEPENDENCIES.md

+6
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ graph LR;
106106
npm-->libnpmversion;
107107
npm-->make-fetch-happen;
108108
npm-->nopt;
109+
npm-->normalize-package-data;
109110
npm-->npm-audit-report;
110111
npm-->npm-install-checks;
111112
npm-->npm-package-arg;
@@ -496,6 +497,9 @@ graph LR;
496497
normalize-package-data-->semver;
497498
normalize-package-data-->validate-npm-package-license;
498499
npm-->abbrev;
500+
npm-->ajv-formats-draft2019;
501+
npm-->ajv-formats;
502+
npm-->ajv;
499503
npm-->archy;
500504
npm-->cacache;
501505
npm-->chalk;
@@ -534,6 +538,7 @@ graph LR;
534538
npm-->nock;
535539
npm-->node-gyp;
536540
npm-->nopt;
541+
npm-->normalize-package-data;
537542
npm-->npm-audit-report;
538543
npm-->npm-install-checks;
539544
npm-->npm-package-arg;
@@ -569,6 +574,7 @@ graph LR;
569574
npm-->semver;
570575
npm-->sigstore;
571576
npm-->spawk;
577+
npm-->spdx-expression-parse;
572578
npm-->ssri;
573579
npm-->supports-color;
574580
npm-->tap;

‎docs/lib/content/commands/npm-sbom.md

+223
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
---
2+
title: npm-sbom
3+
section: 1
4+
description: Generate a Software Bill of Materials (SBOM)
5+
---
6+
7+
### Synopsis
8+
9+
<!-- AUTOGENERATED USAGE DESCRIPTIONS -->
10+
11+
### Description
12+
13+
The `npm sbom` command generates a Software Bill of Materials (SBOM) listing the
14+
dependencies for the current project. SBOMs can be generated in either
15+
[SPDX](https://spdx.dev/) or [CycloneDX](https://cyclonedx.org/) format.
16+
17+
### Example CycloneDX SBOM
18+
19+
```json
20+
{
21+
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
22+
"bomFormat": "CycloneDX",
23+
"specVersion": "1.5",
24+
"serialNumber": "urn:uuid:09f55116-97e1-49cf-b3b8-44d0207e7730",
25+
"version": 1,
26+
"metadata": {
27+
"timestamp": "2023-09-01T00:00:00.001Z",
28+
"lifecycles": [
29+
{
30+
"phase": "build"
31+
}
32+
],
33+
"tools": [
34+
{
35+
"vendor": "npm",
36+
"name": "cli",
37+
"version": "10.1.0"
38+
}
39+
],
40+
"component": {
41+
"bom-ref": "simple@1.0.0",
42+
"type": "library",
43+
"name": "simple",
44+
"version": "1.0.0",
45+
"scope": "required",
46+
"author": "John Doe",
47+
"description": "simple react app",
48+
"purl": "pkg:npm/simple@1.0.0",
49+
"properties": [
50+
{
51+
"name": "cdx:npm:package:path",
52+
"value": ""
53+
}
54+
],
55+
"externalReferences": [],
56+
"licenses": [
57+
{
58+
"license": {
59+
"id": "MIT"
60+
}
61+
}
62+
]
63+
}
64+
},
65+
"components": [
66+
{
67+
"bom-ref": "lodash@4.17.21",
68+
"type": "library",
69+
"name": "lodash",
70+
"version": "4.17.21",
71+
"scope": "required",
72+
"author": "John-David Dalton",
73+
"description": "Lodash modular utilities.",
74+
"purl": "pkg:npm/lodash@4.17.21",
75+
"properties": [
76+
{
77+
"name": "cdx:npm:package:path",
78+
"value": "node_modules/lodash"
79+
}
80+
],
81+
"externalReferences": [
82+
{
83+
"type": "distribution",
84+
"url": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz"
85+
},
86+
{
87+
"type": "vcs",
88+
"url": "git+https://github.com/lodash/lodash.git"
89+
},
90+
{
91+
"type": "website",
92+
"url": "https://lodash.com/"
93+
},
94+
{
95+
"type": "issue-tracker",
96+
"url": "https://github.com/lodash/lodash/issues"
97+
}
98+
],
99+
"hashes": [
100+
{
101+
"alg": "SHA-512",
102+
"content": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
103+
}
104+
],
105+
"licenses": [
106+
{
107+
"license": {
108+
"id": "MIT"
109+
}
110+
}
111+
]
112+
}
113+
],
114+
"dependencies": [
115+
{
116+
"ref": "simple@1.0.0",
117+
"dependsOn": [
118+
"lodash@4.17.21"
119+
]
120+
},
121+
{
122+
"ref": "lodash@4.17.21",
123+
"dependsOn": []
124+
}
125+
]
126+
}
127+
```
128+
129+
### Example SPDX SBOM
130+
131+
```json
132+
{
133+
"spdxVersion": "SPDX-2.3",
134+
"dataLicense": "CC0-1.0",
135+
"SPDXID": "SPDXRef-DOCUMENT",
136+
"name": "simple@1.0.0",
137+
"documentNamespace": "http://spdx.org/spdxdocs/simple-1.0.0-bf81090e-8bbc-459d-bec9-abeb794e096a",
138+
"creationInfo": {
139+
"created": "2023-09-01T00:00:00.001Z",
140+
"creators": [
141+
"Tool: npm/cli-10.1.0"
142+
]
143+
},
144+
"documentDescribes": [
145+
"SPDXRef-Package-simple-1.0.0"
146+
],
147+
"packages": [
148+
{
149+
"name": "simple",
150+
"SPDXID": "SPDXRef-Package-simple-1.0.0",
151+
"versionInfo": "1.0.0",
152+
"packageFileName": "",
153+
"description": "simple react app",
154+
"primaryPackagePurpose": "LIBRARY",
155+
"downloadLocation": "NOASSERTION",
156+
"filesAnalyzed": false,
157+
"homepage": "NOASSERTION",
158+
"licenseDeclared": "MIT",
159+
"externalRefs": [
160+
{
161+
"referenceCategory": "PACKAGE-MANAGER",
162+
"referenceType": "purl",
163+
"referenceLocator": "pkg:npm/simple@1.0.0"
164+
}
165+
]
166+
},
167+
{
168+
"name": "lodash",
169+
"SPDXID": "SPDXRef-Package-lodash-4.17.21",
170+
"versionInfo": "4.17.21",
171+
"packageFileName": "node_modules/lodash",
172+
"description": "Lodash modular utilities.",
173+
"downloadLocation": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
174+
"filesAnalyzed": false,
175+
"homepage": "https://lodash.com/",
176+
"licenseDeclared": "MIT",
177+
"externalRefs": [
178+
{
179+
"referenceCategory": "PACKAGE-MANAGER",
180+
"referenceType": "purl",
181+
"referenceLocator": "pkg:npm/lodash@4.17.21"
182+
}
183+
],
184+
"checksums": [
185+
{
186+
"algorithm": "SHA512",
187+
"checksumValue": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
188+
}
189+
]
190+
}
191+
],
192+
"relationships": [
193+
{
194+
"spdxElementId": "SPDXRef-DOCUMENT",
195+
"relatedSpdxElement": "SPDXRef-Package-simple-1.0.0",
196+
"relationshipType": "DESCRIBES"
197+
},
198+
{
199+
"spdxElementId": "SPDXRef-Package-simple-1.0.0",
200+
"relatedSpdxElement": "SPDXRef-Package-lodash-4.17.21",
201+
"relationshipType": "DEPENDS_ON"
202+
}
203+
]
204+
}
205+
```
206+
207+
### Package lock only mode
208+
209+
If package-lock-only is enabled, only the information in the package
210+
lock (or shrinkwrap) is loaded. This means that information from the
211+
package.json files of your dependencies will not be included in the
212+
result set (e.g. description, homepage, engines).
213+
214+
### Configuration
215+
216+
<!-- AUTOGENERATED CONFIG DESCRIPTIONS -->
217+
## See Also
218+
219+
* [package spec](/using-npm/package-spec)
220+
* [dependency selectors](/using-npm/dependency-selectors)
221+
* [package.json](/configuring-npm/package-json)
222+
* [workspaces](/using-npm/workspaces)
223+

‎docs/lib/content/nav.yml

+3
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,9 @@
150150
- title: npm run-script
151151
url: /commands/npm-run-script
152152
description: Run arbitrary package scripts
153+
- title: npm sbom
154+
url: /commands/npm-sbom
155+
description: Generate a Software Bill of Materials (SBOM)
153156
- title: npm search
154157
url: /commands/npm-search
155158
description: Search for packages

0 commit comments

Comments
 (0)
Please sign in to comment.