Include support for package.json files also about cyclonedx-dotnet

[stevespringett]

What is needed is a dedicated tool for BOM merging. Adding this capability into every CycloneDX implementation would be a lot of work and re-creating the wheel. But I agree, a dedicated tool that has this functionality is needed.

Since Javascript is typically used alongside other tech stacks, the CycloneDX Node module has an optional parameter (-a) which allows you to specify additional BOMs to append to the one you're creating.

So, the workflow would be to first create the .NET BOM, then create the Node BOM but specify the .NET BOM as an additional BOM to merge in. This functionality exists today. However, it will not deduplicate, ensure unique bom-refs, or account for schema extensions. So, by using this feature, it's possible to create a BOM that doesn't validate and will be stripped of extensions (if you use them). Because of this, its typically ok to merge in two or more BOMs from different ecosystems, but merging in BOMs from the same ecosystem (e.g. two NPM BOMs) will likely result in an invalid BOM.

Merging BOMs can be a bit complex, which is why a dedicated tool is necessary. But go ahead and give the above workflow a try. It may work in your case. I personally use it with a Java stack all the time and it works fine.

[Duncan-Howe]

@stevespringett Thanks for the reply. I have successfully installed the Node-module version and have run that and merged the output of the dotNet tool - very good, thank you.

I am just getting started with producing SBOMs automatically so it is good to know that I might face some challenges later on with duplicates et.c. I look forward to the dedicated tool.

[akshaydeodare]

Since Javascript is typically used alongside other tech stacks, the CycloneDX Node module has an optional parameter (-a) which allows you to specify additional BOMs to append to the one you're creating.

About this , there is no more such functionality for appending two BOMs right @stevespringett ?

[stevespringett]

@akshaydeodare The CycloneDX CLI has this ability built-in and is the recommended method of merging, given the complexity involved.