[Feature Request] Allow disbabling the BOM buildpack when building NodeJS applications

[coffee-cup]

What happened?

The BOM buildpack can take upwards of 50% of the build time for a NodeJS monorepo with Yarn. However, we are not using the bill of materials at all so it would significantly improve the build time if we could disable it.

• What were you attempting to do?

Disable the BOM buildpack with an environment variable

Build Configuration

• What platform (pack, kpack, tekton buildpacks plugin, etc.) are you
  using? Please include a version.

Pack version 0.23.0+git-0db2c77.build-3056

• What buildpacks are you using? Please include versions.

7 of 11 buildpacks participating
paketo-buildpacks/ca-certificates 3.0.3
paketo-buildpacks/node-engine     0.12.1
paketo-buildpacks/yarn            0.6.0
paketo-buildpacks/yarn-install    0.8.0
paketo-buildpacks/node-module-bom 0.2.2
paketo-buildpacks/node-run-script 0.3.2
paketo-buildpacks/yarn-start      0.7.1

• What builder are you using? If custom, can you provide the output from pack inspect-builder <builder>?

paketobuildpacks/builder:full

• Can you provide a sample app or relevant configuration (buildpack.yml,
  nginx.conf, etc.)?

N/A

[ryanmoran]

@coffee-cup I believe this has been implemented according to the specification outlined in RFC0044. Let us know if setting BP_DISABLE_SBOM is not meeting your expectations.

[robdimsdale]

I'm going to close this as there has been no activity in four months. Feel free to re-open if it's still an issue.

[candrews]

I reported some issues requesting that more buildpacks implement this RFC:

• Implement RFC0044: Disable SBOM java#1074
• Implement RFC0044: Disable SBOM ca-certificates#183
• Implement RFC0044: Disable SBOM spring-boot#370
• Implement RFC0044: Disable SBOM executable-jar#217
• Implement Paketo RFC0044: Disable SBOM buildpacks/lifecycle#1126