2nd tier sbom

[sparrell]

looking at first hop cyclonedx json sbom determine what is missing (from hex sbom or from manually looking at dependencies and/or build logs) and either add or make a subtending sbom.

Use https://sbom.democert.org/sbom/ to manually make sboms for 2nd tier (unless using hex sbom is easier but issue is json vs xml and hex sbom doesn't support cyclonedx with relationships and with json)

[sigu]

Confirm that the current implementation can do 2nd tier for bot npm and hex packages

[WanjikuMac]

Confirmed! the boms generated contain 2nd tier deps for hex packages, the npm specified deps don't have 2nd tier deps (confirmed here), this is both in xml and json outputs.

[sigu]

The link you provided https://www.npmjs.com/package/package, leads to a totally different package.
How did you confirm that the npm package dont have 2nd tier deps?

[WanjikuMac]

@sigu under that link when you look at the dependencies tab, you'll find that the core dependencies used under npm have no 2nd tier dependencies. Let me know if this makes sense.

[sigu]

Not really making sense. Let me attempt to explain what I understand by 2nd tier dependency.

Have a look at a dependency called @babel/core, it's on your dev dependancies

This is one dependency that has other dependencies too

• @babel/parser link
• @babel/template link
• @babel/traverse link
• and many others

The dependencies listed above are considered 2nd tier dependencies (our dependency has them as a dependency)

[WanjikuMac]

I will generate a new bom file for the npm deps including the devdeps and then give an update on whether the 2nd tier is catered for. Thank you for flagging this.