:mega: looking for contributors

[jkowalleck]

This project is currently looking for contributors.

Drop a note, or ping, if you are interested.

[busywhistling]

Hello, I'd be interested in helping contribute & maintain this package for pnpm repos.

[jkowalleck]

@busywhistling I've contacted you via email.

[Sytten]

Was there any work that was performed in this repo or would someone need to start from scratch

[jkowalleck]

You could start from scratch, if you liked. This would allow you to work on a green field without any restrictions.
Regarding test cases, we have some in other projects, that you could use for inspiration:

• https://github.com/CycloneDX/cyclonedx-node-npm/tree/main/demo
• https://github.com/CycloneDX/cyclonedx-node-yarn/tree/main/tests/_data/testbeds

[coronoro]

We (@OrbisK and me) would also like to contribute to this package.

[OrbisK]

Perhaps we could reuse some of the work from this repository: https://github.com/antfu/node-modules-inspector.

[jkowalleck]

Feel free to pull request any implementation - candidate/draft/etc.

Do you need any mentoring or help?

[officerNordberg]

I might be a third or fourth wheel but I could add some sweat equity as well given I could use this library as early as yesterday.

[OrbisK]

@jkowalleck We have now sat down together and discussed the matter in detail, and we see two ways in which we could proceed:

A: Develop @cyclonedx/cyclonedx-pnpm based on the model of @cyclonedx/cyclonedx-npm.
B: Develop @cyclonedx/cyclonedx-pnpm based on node-module-tools package manager agnostically (@cyclonedx/cyclonedx-node (?)).

We can see advantages in both approaches.

With A, we would probably be more flexible in terms of specific pnpm features and would not have to convert the dep tree into a “meta structure” first (performance).

With B, however, we also see the possibility of combining the generation for all PMs into one, if necessary. We also see some synergy effects in the vite ecosystem (vite dev-tools,...), and of course directly in node-modules-inspector.

If it would make it easier to discuss our ideas, we are also happy to arrange a meeting via Discord or Slack.

[jkowalleck]

re: #9 (comment)

There is just no need for yet another one-thing-that-can-do-everything polyglot - we have multiple of them already (cdx-gen, snyk, blackduck, etc), and none is feature complete, since they struggle with interoperability and complexity.

I'd love to have this CycloneD-pnpm solution to be scoped on PNPM only and being easy to use for PNPM users.
This way, we have a very narrow focus on the important things, and don't need to over-generalize things for "related" scopes. In the spirit of "do one thing, and do it right".

---

Regarding Vite: as far as I understood, they use "rollup" to produce web-deliverables - meaning they can already use https://github.com/janbiasi/rollup-plugin-sbom for generating the SBOM for the (bundled) web-deliverables, and if they have non-bundled things, they might use the yarn/npn/pnpm tooling for an Operations Bill of Materials (OBOM).

WHat do you think?