[![CI](https://github.com/janbiasi/rollup-plugin-sbom/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/janbiasi/rollup-plugin-sbom/actions/workflows/ci.yml) [![CodeQL](https://github.com/janbiasi/rollup-plugin-sbom/actions/workflows/github-code-scanning/codeql/badge.svg?branch=main)](https://github.com/janbiasi/rollup-plugin-sbom/actions/workflows/github-code-scanning/codeql) ![npm](https://img.shields.io/npm/v/rollup-plugin-sbom) ![npm peer dependency version (scoped)](https://img.shields.io/npm/dependency-version/rollup-plugin-sbom/peer/rollup?logo=rollupdotjs&color=%23EA483F) ![img](https://img.shields.io/badge/semver-2.0.0-green?logo=semver) ![npm type definitions](https://img.shields.io/npm/types/rollup-plugin-sbom) [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/janbiasi/rollup-plugin-sbom/badge)](https://securityscorecards.dev/viewer/?uri=github.com/janbiasi/rollup-plugin-sbom) [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8443/badge)](https://www.bestpractices.dev/projects/8443) # rollup-plugin-sbom Create [SBOMs]() _(Software Bill of Materials)_ in [CycloneDX](https://cyclonedx.org/) format for your [Vite](https://vitejs.dev/) and [Rollup](https://rollupjs.org/) projects, including only the software you're really shipping to production. > A โ€œsoftware bill of materialsโ€ (SBOM) has emerged as a key building block in software security and software supply chain risk management. A SBOM is a nested inventory, a list of ingredients that make up software components. > > โ€“ [CISA (.gov)](https://www.cisa.gov) [[full article](https://www.cisa.gov/sbom)] ## Documentation - [Requirements and compatibility](#requirements-and-compatibility) - [Installation](#installation) - [Usage guide](#usage) - [Usage with Vite](#usage-with-vite) - [Usage with Rollup](#usage-with-rollup) - [Configuration options and defaults](#configuration-options) - [Contributing](#contributing) - [Make your first contribution](#good-first-issues) - [Contributors](#contributors) --- ### Requirements and Compatibility | Plugin | Vite | Rollup | Node | CDX Spec | | ------ | ---------- | ------ | ---------- | -------- | | v1 | v4, v5 | v3, v4 | 18, 20 | 1.5 | | v2 | v4, v5, v6 | v3, v4 | 18, 20, 22 | 1.6 | We're always supporting LTS Node.js versions and versions which still have security support. Plugin support will be dropped once a Node.js version reaches its final EOL. ### Installation You can install the plugin via [NPM](https://www.npmjs.com/package/rollup-plugin-sbom) with your favorite package manager: ```sh npm install --save-dev rollup-plugin-sbom pnpm install -D rollup-plugin-sbom yarn add --dev rollup-plugin-sbom ``` ### Usage #### Usage with [Vite](https://vitejs.dev/) ```ts import { defineConfig } from "vite"; import sbom from "rollup-plugin-sbom"; export default defineConfig({ plugins: [sbom()], }); ``` #### Usage with [Rollup](https://rollupjs.org/) ```js import sbom from "rollup-plugin-sbom"; export default { plugins: [sbom()], }; ``` #### Configuration Options | Name | Default | Description | | ------------------- | ----------------- | ---------------------------------------------------------- | | `specVersion` | `1.6` | The CycloneDX specification version to use | | `rootComponentType` | `application` | The root component type, can be `library` or `application` | | `outDir` | `cyclonedx` | The output directory where the BOM file will be saved. | | `outFilename` | `bom` | The base filename for the SBOM files. | | `outFormats` | `['json', 'xml']` | The formats to output. Can be any of `json` and `xml`. | | `saveTimestamp` | `true` | Whether to save the timestamp in the BOM metadata. | | `autodetect` | `true` | Whether to get the root package registered automatically. | | `generateSerial` | `false` | Whether to generate a serial number for the BOM. | | `includeWellKnown` | `true` | Whether to generate a SBOM in the `well-known` directory. | | `supplier` | - | Provide organizational entity information | ## Contributing The main purpose of this repository is to continue evolving the plugin, making it faster and easier to use. We are grateful to the community for contributing bugfixes and improvements. Read below to learn how you can take part in improving the plugin. ### Good First Issues We have a list of [good first issues](https://github.com/janbiasi/rollup-plugin-sbom/labels/good%20first%20issue) that contain bugs that have a relatively limited scope. This is a great place to get started. ### Contributors Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
Jan R. Biasi
Jan R. Biasi
๐Ÿ’ผ ๐Ÿ’ฌ ๐Ÿง‘โ€๐Ÿซ ๐Ÿ’ป		 Jan Kott
Jan Kott
๐Ÿ’ป ๐Ÿค” ๐Ÿ–‹		 xenobytezero
xenobytezero
๐Ÿ› ๐Ÿ’ป
### License The plugin is licensed under [MIT License](./LICENSE)