Implement Paketo RFC 0038: CycloneDX + Syft SBOM

[fg-j]

To implement Paketo RFC0038, this buildpack (and the implementation buildpacks inside) will need to move from storing SBOM information in layer metadata to storing it in files that the CNB lifecycle can manipulate during the build. The RFC outlines what these files are and what they should contain.

This issue serves as a meta-issue for work required to complete this work for the Nodejs language family. This will require (link Github issues as they are created):

• Updating SBOM format for node-engine buildpack Generate SBOM for node dependencies node-engine#408
• Updating SBOM format for yarn buildpack Generate SBOM for yarn dependencies yarn#177
• Generate node_module SBOM for npm apps Generate SBOM for node_modules npm-install#296
• Remove the node-module-bom buildpack from the order groups in this language family
• Generate node_module SBOM for yarn apps Generate SBOM for node_modules yarn-install#280
• Potentially, changes to yarn -start, npm-start, and node-start buildpacks to generate SBOMs as well Edit: Removing this step and deferring this work in these investigation issues:
  • Investigate generating an SBOM with this buildpack yarn-start#170
  • Investigate generating an SBOM with this buildpack npm-start#167

[fg-j]

This is currently blocked on adding sbom features in packit paketo-buildpacks/packit#255

[robdimsdale]

If we remove the node.js module bom buildpack then we should also remove it from the build plans defined in this meta buildpack. I'd feel comfortable using this issue to track that work, given it takes place in this repo.

[robdimsdale]

I can't edit the comment to add links directly, but I created some issues:

• node-engine
• yarn
• yarn-install
• npm-install

I didn't create issues for the -start buildpacks because I wanted to implement the module SBOM generation in yarn-install and npm-install first to see whether we also needed to generate SBOMs in the -start buildpacks.

[sophiewigmore]

This is unblocked now that Packit v2.0.0 has been released

[fg-j]

Implementing this feature is blocked on platform integration issues. Platform integration is resolved with pack CLI v0.24.0

[fg-j]

@paketo-buildpacks/nodejs-maintainers What's missing before we are able to close out this issue?

[ryanmoran]

I think this is done.