[PLANNING] VISION

[jkowalleck]

A plugin for webpack exists, that is able to produce a BOM for JS-bundles during the build process: https://github.com/CycloneDX/cyclonedx-webpack-plugin/.

A plugin for rollup exists, that is able to produce a BOM for JS-bundles during the build process: https://github.com/janbiasi/rollup-plugin-sbom/.

Nothing like this existed for esbuild

to bring yarn support to the community, this dedicated project should solve the feature lack.

Goal

Responsibilities

• create SBOM in JSON or XML during esbuild runs
• ... to be continued ...

Capabilities / Features

basically: copy all functionality from https://github.com/CycloneDX/cyclonedx-webpack-plugin/

• can create reproducible results (feature switch)
• can create results in CDX spec 1.2 to 1.x (feature switch)
• can create results in XML or JSON (feature switch)
• MUST NOT publish any API or internal interfaces.
• ... to be continued ...

Architecture

This project is intended to implement an esbuld plugin; Read the docs: https://esbuild.github.io/plugins/

This plugin might be written in JavaScript or Go.

If JavaScript

this project should utilize https://github.com/CycloneDX/cyclonedx-javascript-library

If Go

this project should utilize https://github.com/CycloneDX/cyclonedx-go

misc

• ... to be continued ...

---

You want to contribute or champion this tool? ❤️ see #4

[jkowalleck]

maybe there is no need for a plugin....
maybe it can all work together with esbuild metafile data ... see evanw/esbuild#1740
similar to the little license-extractor script here: https://github.com/CycloneDX/cyclonedx-node-yarn/blob/1.0-dev/tools/write-3rd-party-licenses.cjs