Yarn community need a good CycloneDx SBOM generator.

[sbernard31]

About checking vulnerabilities it seems that industry is moving to generation of standard SBOM (like SPDX or CycloneDX) which is then used to check vulnerabilities or licenses compliance or ...

It seems that yarn doesn't have dedicated tools to do that.
It exists a lot of all-in-one tools which allow to generate that :

• CycloneDX Generator / cdxgen
• Trivy
• OSS Review Toolkit / ort
• syft
• dep-scan

But not a small dedicated tool easily integrable in yarn (classic to stable) build.
There is some initiative at : https://github.com/CycloneDX/cyclonedx-node-yarn
Scope of the project is described at : CycloneDX/cyclonedx-node-yarn#8
But currently the project is not really active : CycloneDX/cyclonedx-node-yarn#10
And is searching contributor : CycloneDX/cyclonedx-node-yarn#12

So I share this, just in case yarn community could be interested in it.

Just to let you know when I write that lines :

• npm world has this kind of tool : https://github.com/CycloneDX/cyclonedx-node-npm
• pnpm world is in same situation than yarn : https://github.com/CycloneDX/cyclonedx-node-pnpm

[jkowalleck]

Greetings from the CycloneDX team 👋

Nowadays, developers of package managers know that SBOM is a thing, they are waiting for a community request, to justify the effort of implementation ;-)
We, the CycloneDX team, had already good experience with this approach: community members did the first request to the ecosystems, and then we successfully supported the package manager developers and ecosystem maintainers on their way of getting CycloneDX SBOM as a first party feature.
(see npm and conan2)
We would support yarn implementing an SBOM feature themselves. If you need something, feel free to contact us.

If the @yarnpkg people don't see a need for this topic or don't want to provide the feature themselves, then sure come back to CycloneDX/cyclonedx-node-yarn#12 and CycloneDX/cyclonedx-node-yarn#8, so we can discuss a possible community-owned solution there.

PS: in general, the CycloneDX community is proud of their own solutions and implementations to get ecosystems enabled to do proper supply chain assessment, and we will continue doing so. We also love to see ecosystems adopting the topic. 🚀

CC @CycloneDX/core-team

[jkowalleck]

well, some time went by, and here we are: https://github.com/CycloneDX/cyclonedx-node-yarn/ is ready to use - it is a working and fully-featured CycloneDX SBOM generator as yarn plugin:

[kdeldycke]

Do you think Meta Package Manager can do the trick? Like:

$ mpm --yarn sbom --spdx ./sbom.json