Skip to content

Generate and store an NPM SBOM on the Enterprise image #660

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jviotti merged 1 commit into from
Feb 24, 2026
Merged

Generate and store an NPM SBOM on the Enterprise image #660

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion enterprise/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,16 @@
FROM debian:trixie AS builder

# NodeSource provides npm >= 10, required for the "npm sbom" command
RUN apt-get --yes update && apt-get install --yes --no-install-recommends \
build-essential ca-certificates cmake sassc esbuild shellcheck nodejs npm \
build-essential ca-certificates cmake sassc esbuild shellcheck curl gnupg \
openssl libssl-dev openssl-provider-fips \
&& curl --fail --silent --show-error --location \
https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
| gpg --dearmor -o /usr/share/keyrings/nodesource.gpg \
&& echo "deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" \
> /etc/apt/sources.list.d/nodesource.list \
&& apt-get --yes update \
&& apt-get install --yes --no-install-recommends nodejs \
&& apt-get clean && rm -rf /var/lib/apt/lists/*

# Enable the OpenSSL FIPS provider by running the module self-tests
Expand All @@ -28,6 +36,9 @@ COPY test/unit /source/test/unit
COPY test/js /source/test/js

RUN cd /source && npm ci
RUN mkdir -p /usr/share/sourcemeta/one \
&& cd /source && npm sbom --sbom-format spdx --sbom-type library --omit dev \
> /usr/share/sourcemeta/one/npm-packages.spdx.json

ARG SOURCEMETA_ONE_BUILD_TYPE=Release
ARG SOURCEMETA_ONE_PARALLEL=2
Expand Down