Skip to content

Commit

Permalink
update recommendation about format neutrality
Browse files Browse the repository at this point in the history
Signed-off-by: Brian DeHamer <bdehamer@github.com>
  • Loading branch information
bdehamer committed Aug 23, 2023
1 parent f9738a1 commit 070d29f
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions accepted/0000-sbom-command.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ A new `sbom` command will be added to the npm CLI which will generate an SBOM fo

Supported command options:

`--sbom-format` - SBOM format to use for output. Valid values are “spdx” or “cyclonedx”. In the future, the set of valid values can be expanded to select differents versions of the supported output formats (e.g. "cyclonedx1.4" vs "cyclonedx1.5")
`--sbom-format` - SBOM format to use for output. Valid values are “spdx” or “cyclonedx”. In the future, the set of valid values can be expanded to select differents versions of the supported output formats (e.g. "cyclonedx1.4" vs "cyclonedx1.5").

`--omit` - Dependency types to omit from generated SBOM. Valid values are “dev”, “optional”, and “peer” (can be set multiple times). By default, all development, optional, and peer dependencies will be included in the generated SBOM unless explicitly excluded.

Expand Down Expand Up @@ -162,7 +162,7 @@ _Recommendation: Add a distinct command for generating an SBOM._

* Does `npm-sbom` command have a notion of a “default” SBOM format? Do we give preference to one of CycloneDX/SPDX or do we remain totally neutral (possibly at the expense of DX)? \
\
_Recommendation: Default to SPDX if no format is specified._
_Recommendation: Remain neutral with regard to SPDX vs CycloneDX. Make the `--sbom-format` flag mandatory.

* Both CycloneDX and SPDX support multiple document formats (JSON, XML, Protocol Buffers, etc). Should we support output of multiple formats, or do we stick w/ JSON? \
\
Expand Down

0 comments on commit 070d29f

Please sign in to comment.