@citolab/tspci-tao 2.11.0 → 2.12.0

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [2.12.0](https://github.com/Citolab/tspci/compare/v2.11.0...v2.12.0) (2026-08-19)
+
+
+### Features
+
+* include the SBOM in the exported package by default ([376b89a](https://github.com/Citolab/tspci/commit/376b89a5651bb9a420fbd2973d221a7e5200bd35))
+
+
+
+
+
 # [2.11.0](https://github.com/Citolab/tspci/compare/v2.10.0...v2.11.0) (2026-08-19)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@citolab/tspci-tao",
-  "version": "2.11.0",
+  "version": "2.12.0",
   "description": "create a zip file that can be imported into TAO",
   "author": "patrick <patrick.deklein@cito.nl>, Marcel Hoekstra <marcel.hoekstra@cito.nl>",
   "repository": "",
@@ -16,5 +16,5 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "gitHead": "ad0858f9b665b6778cdf19685e858e167847e930"
+  "gitHead": "eb7676525e9bf75daa9b2f42f035faed9b8e9a70"
 }

package/readme.md

@@ -134,7 +134,14 @@ Add a svg file with the name {typeIdentifier}.svg in the root of the PCI directo
 
 ## sbom
 
-A CycloneDX SBOM of the bundle is copied next to the zip in `dist/` as
-`tao-pci-<typeIdentifier>_<version>.sbom.cdx.json`. Pass `--include-sbom` to also add `sbom.cdx.json`
-to the package itself, or `--no-sbom` to skip generating one. See [@citolab/tspci](https://github.com/Citolab/tspci/tree/main/lib/tspci#sbom)
-for the configuration.
+A CycloneDX SBOM of the bundle is included in the package as `interaction/runtime/js/sbom.cdx.json`,
+next to the bundle it describes, and copied next to the zip in `dist/` as
+`tao-pci-<typeIdentifier>_<version>.sbom.cdx.json` for your own technical documentation.
+
+Note that `imsPciCreator.json` does not list the SBOM in `runtime.src`. It travels with the zip you hand
+over, but whether TAO keeps the file after registering the PCI is untested: TAO copies the files from
+the src lists. Adding it there is a one line change, but a rejected registration is worse than a missing
+file, so that is not done by default.
+
+Use `--no-include-sbom` to keep it out of the package, or `--no-sbom` to skip generating one. See
+[@citolab/tspci](https://github.com/Citolab/tspci/tree/main/lib/tspci#sbom) for the configuration.

package/release-notes.md

@@ -1,3 +1,9 @@
+# 2.12.0
+
+- the SBOM is included in the package as `interaction/runtime/js/sbom.cdx.json`, next to the bundle
+- it is not listed in `runtime.src` of `imsPciCreator.json`, so whether TAO keeps the file after registering the PCI is untested
+- `--no-include-sbom` keeps it out of the package
+
 # 2.11.0
 
 - a CycloneDX SBOM of the bundle is copied next to the zip in `dist/` as `tao-pci-<typeIdentifier>_<version>.sbom.cdx.json`

package/src/createPackage.mjs

@@ -330,11 +330,13 @@ export const bundle = () => {
   }
   // console.log(propertiesToReplace.short)
 
-  // SBOM: delivered next to the package by default, optionally inside it
+  // SBOM: shipped inside the package next to the bundle it describes, and
+  // copied next to the package for your own technical documentation
   handleSbom({
     distDirectory: path.join(PACKAGE_ROOT_PATH, path.dirname((packageData.main || "dist/index.js").replace(/^\//, ""))),
     outputDirectory,
     packageTempDirectory: outputDirectoryTemp,
+    packageDirectory: path.posix.join("interaction", "runtime", "js"),
     baseName: `tao-pci-${propertiesToReplace.typeIdentifier}_${packageData.version}`,
     packageData,
   });
@@ -436,11 +438,12 @@ function isBoolean(val) {
   }
 }
 
-// The CRA requires an SBOM as part of the technical documentation, not as part
-// of the delivery to the customer, so it is written next to the package per
-// version. Use --include-sbom (or config.tspci.sbom.includeInPackage) to also
-// ship it inside the package, and --no-sbom to skip it altogether.
-function handleSbom({ distDirectory, outputDirectory, packageTempDirectory, baseName, packageData }) {
+// The SBOM travels inside the package, because a file next to the zip does not
+// survive an import into another system, and that is exactly the party that
+// needs it. A copy is left next to the package for your own technical
+// documentation. Use --no-include-sbom (or config.tspci.sbom.includeInPackage:
+// false) to keep it out of the package, and --no-sbom to skip it altogether.
+function handleSbom({ distDirectory, outputDirectory, packageTempDirectory, packageDirectory, baseName, packageData }) {
   const settings = packageData?.config?.tspci?.sbom || {};
   if (settings.enabled === false || process.argv.includes("--no-sbom")) {
     return "";
@@ -454,10 +457,11 @@ function handleSbom({ distDirectory, outputDirectory, packageTempDirectory, base
   fs.copyFileSync(source, path.join(outputDirectory, `${baseName}.${fileName}`));
   console.log(`created sbom: ${baseName}.${fileName}`);
 
-  const includeInPackage = process.argv.includes("--include-sbom") || settings.includeInPackage === true;
-  if (!includeInPackage) {
+  if (settings.includeInPackage === false || process.argv.includes("--no-include-sbom")) {
     return "";
   }
-  fs.copyFileSync(source, path.join(packageTempDirectory, fileName));
-  return fileName;
+  const target = packageDirectory ? path.join(packageTempDirectory, packageDirectory) : packageTempDirectory;
+  fs.mkdirSync(target, { recursive: true });
+  fs.copyFileSync(source, path.join(target, fileName));
+  return packageDirectory ? path.posix.join(packageDirectory, fileName) : fileName;
 }