Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Yarn 1.x: Report devDependencies in the SBOM #631

Closed
taylormadore opened this issue Sep 4, 2024 · 0 comments
Closed

Yarn 1.x: Report devDependencies in the SBOM #631

taylormadore opened this issue Sep 4, 2024 · 0 comments
Labels
yarn Pull requests/issues related to our yarn handling module
Milestone
Implement Yarn 1....

Comments

@taylormadore
Copy link
Contributor

All SBOM components that are strict devDependencies should be reported with the property cdx:npm:package:development. Use the Cachito yarn module as inspiration for determining which dependencies are strictly dev.

Acceptance criteria

  • Components that are strict devDependencies are reported in the SBOM with the cdx:npm:package:development property
@taylormadore taylormadore added the yarn Pull requests/issues related to our yarn handling module label Sep 4, 2024
slimreaper35 added a commit to slimreaper35/cachi2 that referenced this issue Dec 4, 2024
@slimreaper35
Update bom.json for yarn-classic e2e tests with npm development property
69282bd 
All SBOM components that are strict devDependencies should be reported
with the property `cdx:npm:package:development`. Similarly as the
previous patch by running integration tests and setting our custom env
variable: `CACHI2_GENERATE_TEST_DATA=true`

closes containerbuildsystem#631

Signed-off-by: Michal Šoltis <[email protected]>
slimreaper35 added a commit to slimreaper35/cachi2 that referenced this issue Dec 9, 2024
@slimreaper35
Update bom.json for yarn-classic e2e tests with npm development property
3aa8dee 
closes containerbuildsystem#631

Signed-off-by: Michal Šoltis <[email protected]>
slimreaper35 added a commit to slimreaper35/cachi2 that referenced this issue Dec 16, 2024
@slimreaper35
yarn-v1: Update bom.json for e2e tests
42d18a7 
closes containerbuildsystem#631
closes containerbuildsystem#636

Signed-off-by: Michal Šoltis <[email protected]>
slimreaper35 added a commit to slimreaper35/cachi2 that referenced this issue Dec 16, 2024
@slimreaper35
yarn-v1: Update bom.json for e2e tests
272037e 
closes containerbuildsystem#631
closes containerbuildsystem#636

Signed-off-by: Michal Šoltis <[email protected]>
slimreaper35 added a commit to slimreaper35/cachi2 that referenced this issue Dec 17, 2024
@slimreaper35
yarn-v1: Update bom.json for e2e tests
a7da9e1 
closes containerbuildsystem#631
closes containerbuildsystem#636

Signed-off-by: Michal Šoltis <[email protected]>
github-merge-queue bot pushed a commit that referenced this issue Dec 17, 2024
@slimreaper35
yarn-v1: Update bom.json for e2e tests
e8eca60 
closes #631
closes #636

Signed-off-by: Michal Šoltis <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
yarn Pull requests/issues related to our yarn handling module
Projects
None yet
Milestone
Implement Yarn 1.x Support
Development

No branches or pull requests
2 participants
@taylormadore @slimreaper35