[PLANNING] VISION #1
Description
the current https://github.com/CycloneDX/cyclonedx-node-module
users expect it to support yarn, but the yarn support is limited and flawed. see the issues list of the project ...
to bring yarn support to the community, this dedicated project should solve the feature lack.
Goal
Responsibilities
- create SBOM in JSON or XML from yarn environments
- ... to be continued ...
Capabilities / Features
- runs in CLI
- can create reproducible results (feature switch)
- can create results in CDX spec 1.2 to 1.4 (feature switch)
- can create results in XML or JSON (feature switch)
- supports yarn v1, v2, v3 -- if this is not possible, the project could split for dedicated support of the versions
- MUST NOT publish any API or internal interfaces.
- ... to be continued ...
Architecture
this project should utilize https://github.com/CycloneDX/cyclonedx-javascript-library
Option: yarn plugin
implement a yarn plugin, that adds a new yarn command an can produce the SBOM as expected.
https://yarnpkg.com/features/plugins
need to do a Prove of concept, that showed that the plugin can run a command, and this command has access to yarns internal data structures ...
or find other capabilities ....
misc
- ... to be continued ...