Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add distribution url to SBOM #47

Closed
jkowalleck opened this issue Mar 26, 2024 · 1 comment · Fixed by #110
Closed

add distribution url to SBOM #47

jkowalleck opened this issue Mar 26, 2024 · 1 comment · Fixed by #110
Assignees
@jkowalleck
Labels
enhancement New feature or request
Milestone
v1.0

Comments

@jkowalleck
Copy link
Member

jkowalleck commented Mar 26, 2024 •
edited

a yarn lockfile sould include enough info to determine the distribution source - where a package was fetched from

goal:
each component has a external reference with

  • the url to where the thing was downloaded from ...
  • optional: the hash of the downloaded thing

docs 📖 read
@jkowalleck jkowalleck added the enhancement New feature or request label Mar 26, 2024
@jkowalleck jkowalleck transferred this issue from CycloneDX/cyclonedx-javascript-library Mar 26, 2024
@jkowalleck jkowalleck added this to the v1.0 milestone Mar 26, 2024
@jkowalleck jkowalleck self-assigned this May 23, 2024
@jkowalleck
Copy link
Member Author

check with some things from npmjs, and some from alternative registries. like this one: https://github.com/CycloneDX/cyclonedx-javascript-library/pkgs/npm/cyclonedx-library

@jkowalleck jkowalleck mentioned this issue May 24, 2024
Merged
jkowalleck added a commit that referenced this issue May 27, 2024
@jkowalleck
feat: distribution url to SBOM (#110)
5a29592 
fixes #47

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jkowalleck jkowalleck

Labels
enhancement New feature or request
Projects
None yet
Milestone
v1.0
Development

Successfully merging a pull request may close this issue.

feat: distribution url to SBOM CycloneDX/cyclonedx-node-yarn
1 participant
@jkowalleck