📣 looking for contributors

[jkowalleck]

CycloneDX is a community effort, free for all.

Based on #8
This project is currently looking for contributors/champions.

Drop a note, or ping, if you are interested.

[sbernard31]

(Just in case it helps : yarnpkg/berry#6063)

[AugustusKling]

@jkowalleck I've experimented yesterday with creating a Yarn plugin to generate CycloneDX SBoMs. The generated files look good at first glance.

Note however that I don't want to make any promises just yet without doing some further assessments if the taken approach is sound. Expect some update on this in a couple of days.

[AugustusKling]

@jkowalleck, @sbernard31 see draft in PR #13. This plugin generates correctly looking SBOMs for the projects I've tested with as far as I can judge.

Easiest way to test on existing Yarn projects is yarn plugin import https://raw.githubusercontent.com/AugustusKling/cyclonedx-node-yarn/1.0-dev/bundles/%40yarnpkg/plugin-sbom.js followed by yarn sbom --component-type=application --output-file=sbom.cdx.json if you want to trust minified code by a random guy.

The more sensible way is:

1. Checkout the repo.
2. yarn install
3. Carefully check source code.
4. Build using yarn build or yarn build:dev
5. Change to your project directory.
6. Import plugin yarn plugin import /wherever-your-checkout-is/bundles/@yarnpkg/plugin-sbom.js
7. yarn sbom --component-type=application --output-file=sbom.cdx.json

[jkowalleck]

Implementation is coming to an end, nearly all features are done.
closing issue