@effected/sbom 0.3.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/package.json +4 -4
package/README.md
CHANGED
|
@@ -8,7 +8,7 @@
|
|
|
8
8
|
Supply-chain artifacts for [Effect](https://effect.website) v4: a CycloneDX 1.6 SBOM, an NTIA minimum-elements report, in-toto statements, SLSA provenance, and Sigstore DSSE signing. `Sbom.generate` and `Sbom.toJson` are total, plain functions — assembling and serializing a document cannot fail, so the package's only error channel belongs to `Sbom.write`, the one member that touches a filesystem. Signing is a separate, deliberately walled-off capability: a consumer that only ever emits an SBOM never reaches `@sigstore/*` or its Fulcio/Rekor network calls.
|
|
9
9
|
|
|
10
10
|
> **Pre-release.** This package is part of the `@effected/*` kit, in pre-`1.0.0`
|
|
11
|
-
> development against a single pinned Effect v4
|
|
11
|
+
> development against a single pinned Effect v4 prerelease. Packages graduate to
|
|
12
12
|
> `1.0.0` once Effect `4.0.0` ships. To hold your own `effect` versions at
|
|
13
13
|
> exactly the ones the kit is built and tested against, install
|
|
14
14
|
> [`@effected/pnpm-plugin-effect`](https://www.npmjs.com/package/@effected/pnpm-plugin-effect).
|
|
@@ -53,7 +53,7 @@ declare const pkg: Package;
|
|
|
53
53
|
const root = SbomMetadataSource.rootComponent(pkg);
|
|
54
54
|
const metadata = SbomMetadataSource.fromPackage(pkg, { timestamp: new Date().toISOString() });
|
|
55
55
|
const components = [
|
|
56
|
-
SbomMetadataSource.componentFor({ name: "effect", version: "4.0.0-
|
|
56
|
+
SbomMetadataSource.componentFor({ name: "effect", version: "4.0.0-rc.109", license: "MIT" }),
|
|
57
57
|
];
|
|
58
58
|
|
|
59
59
|
const document = Sbom.generate({ root, components, metadata });
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@effected/sbom",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"private": false,
|
|
5
5
|
"description": "CycloneDX 1.6 SBOM construction, SLSA provenance, NTIA validation and Sigstore signing as typed services.",
|
|
6
6
|
"keywords": [
|
|
@@ -39,13 +39,13 @@
|
|
|
39
39
|
"./package.json": "./package.json"
|
|
40
40
|
},
|
|
41
41
|
"dependencies": {
|
|
42
|
-
"@effected/package-json": "^0.
|
|
43
|
-
"@effected/spdx": "^0.
|
|
42
|
+
"@effected/package-json": "^0.10.0",
|
|
43
|
+
"@effected/spdx": "^0.3.0",
|
|
44
44
|
"@sigstore/bundle": "^5.0.0",
|
|
45
45
|
"@sigstore/sign": "^5.0.0"
|
|
46
46
|
},
|
|
47
47
|
"peerDependencies": {
|
|
48
|
-
"effect": "4.0.0-
|
|
48
|
+
"effect": "4.0.0-rc.109"
|
|
49
49
|
},
|
|
50
50
|
"engines": {
|
|
51
51
|
"node": ">=24.11.0"
|