This tutorial illustrates how to create an SBOM from Yarn projects using the CycloneDX-Node-Yarn module.
- Yarn package manager >= 3.
- Node >= 18.
To install the cyclonedx-node-yarn module:
Run:
yarn plugin import https://github.com/CycloneDX/cyclonedx-node-yarn/releases/latest/download/yarn-plugin-cyclonedx.cjsVerify Install by running:
yarn cyclonedx --helpRun:
yarn add --dev @cyclonedx/yarn-plugin-cyclonedxVerify Install by running:
yarn exec cyclonedx-yarn --helpSimply verify, with:
yarn dlx @cyclonedx/yarn-plugin-cyclonedx --helpUpon verification, you should see the resultant output:
Generates CycloneDX SBOM for current workspace.
━━━ Usage ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
$ yarn cyclonedx
━━━ Options ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
--spec-version #0 Which version of CycloneDX to use. (choices: 1.2, 1.3, 1.4, 1.5, 1.6, default: 1.5)
--output-format #0 Which output format to use. (choices: JSON, XML, default: JSON)
--output-file #0 Path to the output file. Set to "-" to write to STDOUT. (default: write to STDOUT)
--production,--prod Exclude development dependencies. (default: true if the NODE_ENV environment variable is set to "production", otherwise false)
--mc-type #0 Type of the main component. (choices: application, library, firmware, default: application)
--short-PURLs Omit all qualifiers from PackageURLs. This causes information loss in trade-off shorter PURLs, which might improve ingesting these strings.
--output-reproducible Whether to go the extra mile and make the output reproducible. This might result in loss of time- and random-based values.
--verbose,-v Increase the verbosity of messages. Use multiple times to increase the verbosity even more.
━━━ Details ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Recursively scan workspace dependencies and emits them as
Software-Bill-of-Materials(SBOM) in CycloneDX format.To create an SBOM file:
Run:
yarn dlx @cyclonedx/yarn-plugin-cyclonedx --output-file <file.name>Run:
yarn cyclonedx --output-file <file.name>Run:
yarn exec cyclonedx-yarn --output-file <file.name>Where file.name is the given name for your file.
An SBOM with the given filename will be created in your working directory.
-
Installing via the plugin method appears to be the most reliable and least prone to error.
-
Without the
--output-fileflag, the SBOM outputs to your terminal. -
Errors may arise if a
.pnp.cjsfile has been created in your home directory. Deleting it appears to mitigate most errors.
- CycloneDX. (n.d.). CycloneDX/cyclonedx-node-yarn: Create cyclonedx software bill of materials (SBOM) from node.js yarn projects. GitHub. https://github.com/CycloneDX/cyclonedx-node-yarn