[PLANNING] VISION

[jkowalleck]

A plugin for webpack exists, that is able to produce a BOM for JS-bundles during the build process: https://github.com/CycloneDX/cyclonedx-webpack-plugin/.

A plugin for rollup exists, that is able to produce a BOM for JS-bundles during the build process: https://github.com/janbiasi/rollup-plugin-sbom/.

Nothing like this existed for esbuild

to bring yarn support to the community, this dedicated project should solve the feature lack.

Goal

Responsibilities

• create SBOM in JSON or XML during esbuild runs
• ... to be continued ...

Capabilities / Features

basically: copy all functionality from https://github.com/CycloneDX/cyclonedx-webpack-plugin/

• can create reproducible results (feature switch)
• can create results in CDX spec 1.2 to 1.x (feature switch)
• can create results in XML or JSON (feature switch)
• MUST NOT publish any API or internal interfaces.
• ... to be continued ...

Architecture

This project is intended to implement an esbuld plugin; Read the docs: https://esbuild.github.io/plugins/

This plugin might be written in JavaScript or Go.

If JavaScript

this project should utilize https://github.com/CycloneDX/cyclonedx-javascript-library

If Go

this project should utilize https://github.com/CycloneDX/cyclonedx-go

misc

• ... to be continued ...

---

You want to contribute or champion this tool? ❤️ see #4

[jkowalleck]

maybe there is no need for a plugin....
maybe it can all work together with esbuild metafile data ... see evanw/esbuild#1740
similar to the little license-extractor script here: https://github.com/CycloneDX/cyclonedx-node-yarn/blob/1.0-dev/tools/write-3rd-party-licenses.cjs

[Fatcat560]

Hi, I wanted to know if a plugin for esbuild is something you are still interested in, or if the script + metafile approach is the preferred way moving forward?

I haven't used esbuild much myself yet but with support in angular growing, I think having something to use out of the box is worth having 😄

My knowledge about creating SBOMs is limited too sadly, but I'd be happy to help out and learn in my spare time if a plugin is worth creating.

[jkowalleck]

I wanted to know if a plugin for esbuild is something you are still interested in

Yes. A plugin written in go/js is the preferred outcome.

The alternative, the "metafile", does not come out of the box for all use cases, it might require custom implementations (like this)

I can mentor with all SBOM/CycloneDX aspects, CI/CT, architecture, nodejs-packaging. For go packaging, I can probably connect with someone to mentor.
For the actual implementation, and go language, I have no experience, yet.

[Fatcat560]

I took some time to make myself a test setup in Typescript to see how the esbuild plugin system works. I'll have a look at what the webpack plugin did and then try to replicate the behaviour, though it seems promising so far 😄

I didn't really get it to behave with the Angular esbuild. The plugin always got called before the entire build was done, so the polyfills were missing. I may have to include functionality that uses the metafile as well, since I could instruct Angular to create one along the build process.

I'll report back once I've dug in a bit 👍

[Fatcat560]

@jkowalleck Hey there! I've been tinkering a bit with an actual implementation. Do you happen to have access to test projects/packages so that I can verify the output? It's still a rough implementation so there's some clean up to do, but I'd like to catch some obvious errors early on if that's possible at all.

I'll try and upload the code in the next couple of days on my fork so you can also have a look if you have time.

[jkowalleck]

i dont have any proper test beds for esbuild on hand.
you may tinker some test beds based on

• a real-world angular project: https://github.com/juice-shop/juice-shop/tree/master/frontend
• a synthetic test bed with angular17: https://github.com/CycloneDX/cyclonedx-webpack-plugin/tree/master/tests/integration/webpack5-angular17
• any example project that uses Vite, SvelteKit, Astro, Angular v17+, Vue 3+ etc ...

[jkowalleck]

worked on an implementation. expect an RC soon.

[jkowalleck]

we have a working implementation 🥳
https://www.npmjs.com/package/@cyclonedx/cyclonedx-esbuild