feat: validate results

.github/ISSUE_TEMPLATE/ValidationError-report.md

@@ -0,0 +1,34 @@
+---
+name: ValidationError report
+about: Report a ValidationError to help us improve
+title: "[ValidationError]"
+labels: ValidationError
+assignees: ''
+
+---
+
+## To Reproduce
+
+Steps to reproduce the behavior:
+
+1. How was _@cyclonedx/cyclonedx-npm_  called?
+   <!-- e.g. `npx @cyclonedx/cyclonedx-npm --omit=dev ...` -->
+2. What kind of evidence was processed?
+   <!-- upload a complete project or set of `package*.json` to this issue, or a pastebin of you choice and put the link here. -->
+3. Error report:
+   <!-- upload the complete output to this issue, or a pastebin of you choice and put the link here. -->
+4. Expected result:
+   <!-- run the original call again
+   with parameters `--no-validate --output-reproducible --output-file=-`, 
+   then upload the output this issue, or to a pastebin of you choice and put the link here. -->
+
+## Environment
+
+- _@cyclonedx/cyclonedx-npm_ version: <!-- e.g. `v3.2.0`. get via `cyclonedx-npm --version` -->
+- NPM version: <!-- get via `npm --version` -->
+- Node version: <!-- get via `node --version` -->
+- OS: <!-- e.g. windows 11, ubuntu linux, ... -->
+
+## Additional context
+
+Add any other context about the problem here.

.github/workflows/nodejs.yml

@@ -34,7 +34,7 @@ jobs:
           node-version: ${{ env.NODE_ACTIVE_LTS }}
           cache: 'npm'
       - name: setup subject
-        run: npm ci --ignore-scripts
+        run: npm ci --ignore-scripts --loglevel=silly
       - name: build
         run: npm run build
       - name: artifact build result
@@ -59,7 +59,7 @@ jobs:
           node-version: ${{ env.NODE_ACTIVE_LTS }}
           cache: 'npm'
       - name: install subject
-        run: npm ci
+        run: npm ci --loglevel=silly
       - name: run tests
         run: npm run test:standard
   test-jest:
@@ -92,7 +92,12 @@ jobs:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
       - name: setup subject
-        run: npm ci --ignore-scripts
+        shell: bash
+        run: |
+          set -ex
+          npm ci --ignore-scripts --loglevel=silly
+          ## rebuild deps for which scripts were ignored, or partially installed - since "ignore-scripts" was used
+          npm rebuild --loglevel=silly libxmljs2 || npm uninstall --no-save libxmljs2
       - name: fetch build artifact
         # see https://github.com/actions/download-artifact
         uses: actions/download-artifact@v3
@@ -153,7 +158,12 @@ jobs:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
       - name: setup subject
-        run: npm i --ignore-scripts
+        shell: bash
+        run: |
+          set -ex
+          npm ci --ignore-scripts --omit=dev --loglevel=silly
+          ## rebuild deps for which scripts were ignored, or partially installed - since "ignore-scripts" was used
+          npm rebuild --loglevel=silly libxmljs2 || npm uninstall --no-save libxmljs2
       - name: fetch build artifact
         # see https://github.com/actions/download-artifact
         uses: actions/download-artifact@v3

HISTORY.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 
 ## unreleased
 
+* Added
+  * SBOM results might be validated (via [#660])  
+    This feature is enabled per default and can be disabled via CLI switch `--no-validate`.  
+    Validation is skipped, if dependencies are missing or not met.
+    Requires [transitive optional dependencies](https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/README.md#optional-dependencies)  
+
+[#660]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/660
+
 ## 1.10.0 - 2023-04-17
 
 * Added

README.md

@@ -69,7 +69,7 @@ Usage: cyclonedx-npm [options] [--] [<package-manifest>]
 Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.
 
 Arguments:
-  <package-manifest>        Path to project's manifest file. 
+  <package-manifest>        Path to project's manifest file.
                             (default: "package.json" file in current working directory)
 
 Options:
@@ -84,8 +84,9 @@ Options:
                             (choices: "dev", "optional", "peer", default: "dev" if the NODE_ENV environment variable is set to "production", otherwise empty)
   --flatten-components      Whether to flatten the components.
                             This means the actual nesting of node packages is not represented in the SBOM result.
+                            (default: false)
   --short-PURLs             Omit all qualifiers from PackageURLs.
-                            This causes information loss in trade of shorter PURLs, which might improve digesting these strings. 
+                            This causes information loss in trade of shorter PURLs, which might improve digesting these strings.
                             (default: false)
   --spec-version <version>  Which version of CycloneDX spec to use.
                             (choices: "1.2", "1.3", "1.4", default: "1.4")
@@ -97,6 +98,9 @@ Options:
   --output-file <file>      Path to the output file.
                             Set to "-" to write to STDOUT.
                             (default: write to STDOUT)
+  --validate                Validate resulting BOM before outputting. Validation is skipped, if requirements not met.
+                            (default: true)
+  --no-validate             Disable validation of resulting BOM.
   --mc-type <type>          Type of the main component.
                             (choices: "application", "firmware", "library", default: "application")
   -V, --version             output the version number
@@ -121,7 +125,8 @@ Read more on the topic in the [dedicated docs "Component Deduplication"](https:/
 
 ## Internals
 
-This tool utilizes the [CycloneDX library][cyclonedx-library] to generate the actual data structures.
+This tool utilizes the [CycloneDX library][cyclonedx-library] to generate the actual data structures, and serialize and validate them.  
+Validation requires [transitive optional dependencies](https://github.com/CycloneDX/cyclonedx-javascript-library/blob/main/README.md#optional-dependencies).
 
 This tool does **not** expose any additional _public_ API or classes - all code is intended to be internal and might change without any notice during version upgrades.
 

bin/cyclonedx-npm-cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-try {
-  require('../dist/cli.js').run(process)
-} catch (e) {
+require('../dist/cli.js').run(process).catch(e => {
   process.stderr.write(`\n${e}\n`)
-  process.exit(Math.floor(Number(e?.code)) || 1)
-}
+  return Math.max(1, Math.floor(Number(e?.code)) || 254)
+}).then(exitCode => {
+  process.exitCode = exitCode
+})