!npm
!npm peer dependency version (scoped) !img !npm type definitions   !NPM Downloads

rollup-plugin-sbom

Create [SBOMs]() _(Software Bill of Materials)_ in CycloneDX format for your Vite and Rollup projects, including only the software you're really shipping to production.

> A “software bill of materials” (SBOM) has emerged as a key building block in software security and software supply chain risk management. A SBOM is a nested inventory, a list of ingredients that make up software components.
>
> – CISA (.gov) [full article]

Documentation

- Requirements and compatibility
- Installation
- Usage guide
- Usage with Vite
- Usage with Rollup
- Configuration options and defaults
- Debugging
- Sequence chart
- Contributing
- Contribution workflow
- Make your first contribution
- Contributors

---

$3

| Plugin | Vite | Rollup | Node | CDX Spec |
| ------ | ---------- | ------ | ---------- | -------- |
| v1 | v4, v5 | v3, v4 | 18, 20 | 1.5 |
| v2 | v4, v5, v6 | v3, v4 | 18, 20, 22 | 1.6 |
| v3 | v5, v6, v7 | v4 | 20, 22, 24 | 1.6 |

We're always supporting LTS Node.js versions and versions which still have security support.
Plugin support will be dropped once a Node.js version reaches its final EOL.

$3

You can install the plugin via NPM with your favorite package manager:

``sh
npm install --save-dev rollup-plugin-sbom
pnpm install -D rollup-plugin-sbom
yarn add --dev rollup-plugin-sbom
`

$3

#### Usage with Vite

`ts
import { defineConfig } from "vite";
import sbom from "rollup-plugin-sbom";

export default defineConfig({
plugins: [sbom()],
});

// or

export default defineConfig({
build: {
rollupOptions: {
plugins: [rollupPluginSbom],
},
},
});
`

#### Usage with Rollup

`js
import sbom from "rollup-plugin-sbom";

export default {
plugins: [sbom()],
};
`

#### Configuration Options

| Name | Default | Description |
| ------------------- | ------------- | ------------------------------------------------------------------------------------------- |
| specVersion | 1.6 | The CycloneDX specification version to use |
| rootComponentType | application | The root component type, can be library or application |
| outDir | cyclonedx | The output directory where the BOM file will be saved. |
| outFilename | bom | The base filename for the SBOM files. |
| outFormats | ['json'] | The formats to output. Can be any of json and xml (note: xml requires xmlbuilder2). |
| saveTimestamp | true | Whether to save the timestamp in the BOM metadata. |
| autodetect | true | Whether to get the root package registered automatically. |
| generateSerial | false | Whether to generate a serial number for the BOM. |
| includeWellKnown | true | Whether to generate a SBOM in the well-known directory. |
| supplier | - | Provide organizational entity information |
| beforeCollect | - | Enhance the BOM before before collecting dependencies |
| afterCollect | - | Transform the BOM before after collecting dependencies |

$3

Some features require optional peer dependencies — see package.json for version details.

- Serialization to XML on Node.js requires any of:
- xmlbuilder2

$3

This plugin added debug logs to gather information about how your SBOM is built so you can
understand why which dependency was added to the graph. To enable debugging, you can set the logLevel option to "debug".

`ts
// rollup
export default {
logLevel: "debug",
};

// vite
export default defineConfig({
build: {
rollupOptions: {
logLevel: "debug",
},
},
});
`

$3

`mermaid
sequenceDiagram
participant Bundler
box Hook Phases
participant SB as Start Build
participant MP as Module Parsed
participant GB as Generate Bundle
participant EF as Emit Files
end
box Plugin
participant AN as Analyzer
participant PR as Package Registry
end
activate Bundler
activate SB
Bundler->>SB: Register Root Component
Bundler->>SB: Register Tools
deactivate SB
Bundler-->>MP: Invoke for each module
activate MP
MP-->>PR: Find and load package.json
deactivate MP
activate GB
Bundler->>GB: Invoke with generated chunks
AN->>AN: Build tree (recursive)
GB->>AN: Analyze generated chunk
AN->>GB: Send module tree
GB->>PR: Request package.json for module
PR->>GB: Return normalized package
GB->>EF: Emit SBOM files
GB->>EF: Emit Well Known
deactivate GB
EF->>Bundler: Finish build
deactivate Bundler
`

Contributing

The main purpose of this repository is to continue evolving the plugin, making it faster and easier to use. We are grateful to the community for contributing bugfixes and improvements. Read below to learn how you can take part in improving the plugin.

$3

1. Fork the repository to your personal account
2. Ensure that all tests succeed (pnpm build-fixtures & pnpm test`)
3. Propose changes within a PR to the original repository and write down the information required by the pull request template
4. Wait for an approval for running the required workflow checks and a code-review from one of the maintainers

$3

We have a list of good first issues that contain bugs that have a relatively limited scope. This is a great place to get started.

$3

Thanks goes to these wonderful people (emoji key):

Jan R. Biasi 💼 💬 🧑‍🏫 💻

Jan Kott 💻 🤔 🖋

xenobytezero 🐛 💻

DesselBane 🐛

Sponsors

License

The plugin is licensed under MIT License