CycloneDX API

[theofidry]

Re: #164 (comment)

The problem with the CycloneDX:make-sbom is:

• Why is it a Composer plugin if it doesn't need to leverage the Composer plugin API? If it is to have a console command, this could be a regular console app (in which case having a IO/Console less dependency would also be more re-usable).
• The current API does allow to specify composer-file, the problem is in the context of Box, the composer file may not be there (as removed). I can work around it, but it feels it would be easier if I could provide the Composer manifest (.lock, .installed) content directly rather than the physical file.

[jkowalleck]

Why is it a Composer plugin if it doesn't need to leverage the Composer plugin API?

how comes this idea?

[theofidry]

Why is it a Composer plugin if it doesn't need to leverage the Composer plugin API?
how comes this idea?

Maybe I'm misunderstanding, but it only looks like you are using the console part of the Composer API, i.e. you are indeed using the Composer API but just because you are adding a command to Composer, not because the core of the library requires it.

To expand further on why I think it's a "problem", in the context of Box or the separate BoxManifest project, what you are working with is the composer manifests contents (because the files may be removed; in the case of Box itself, I can still work around to find the original one though). And my understanding is that those manifest are enough to generate the SBOM manifest. Currently though, you require:

• The physical composer.json file (which is not the right manifest right? what you need is the .lock)
• Finding the Composer executable and launching a process to execute that command (which is another overhead)

As opposed to having something like:

SbomManifestFactory::fromComposerLock(string $composerLockContents): string

Which would require no physical composer.json/composer.lock file and would also avoid having to launch a separate process for getting the manifest.

[jkowalleck]

it only looks like you are using the console part of the Composer API

look further and tell again, please.

not because the core of the library requires it.

is this so?

cyclonedx-php-composer/src/MakeBom/Builder.php

Lines 26 to 33 in e5bcce8

	use Composer\Composer;
	use Composer\Package\CompletePackageInterface;
	use Composer\Package\PackageInterface;
	use Composer\Package\RootPackage;
	use Composer\Package\RootPackageInterface;
	use Composer\Repository\InstalledRepositoryInterface;
	use Composer\Repository\LockArrayRepository;
	use Composer\Semver\Constraint\MatchAllConstraint;

---

please do NOT hijack this post again by mixing topics.
if you want to talk about the box context, you might utilize an additional thread. okay?

[theofidry]

please do NOT hijack this post again by mixing topics.

The topic is the CycloneDX API though in general though? But your answer shows that I was wrong about the usage of the Composer API indeed, my mistake.

Well now you opened (edit: looks like I went to fast when creating this discussion – it appeared empty to me, and didn't see that you created this other one a while ago) #103 so I guess it better captures the goal of the discussion left.

[jkowalleck]

The current API does allow to specify composer-file, the problem is in the context of Box, the composer file may not be there (as removed). I can work around it, but it feels it would be easier if I could provide the Composer manifest (.lock, .installed) content directly rather than the physical file.

This tool's scope is composer projects (, not just any composerizes something).
If you cannot provide the bare minimum information of a composer project, then this tool is just not for you.

[theofidry]

This tool's scope is composer projects (, not just any composerizes something).
If you cannot provide the bare minimum information of a composer project, then this tool is just not for you.

I hope my previous answer clarifies what I wish for. Whether this should be done here in this specific project or another is fine by me. As long as (I hope) there is a suitable tool for that need 😄

[jkowalleck]

hope my previous answer clarifies [...]

I do not know. i stopped reading your previous answer at the point where it switched topics.
if you want to discuss multiple topics, PLEASE keep topics separated, so we can discuss each of your ideas and conceptions separately. :-)