Access to machine for SBOM generation

[marco-ippolito]

Under suggestion of nodejs/security-wg#1115 (comment) I'm asking if it possible to have access to a machine with at least 32/64gb of RAM to test SBOM generation as initiative of security working group nodejs/security-wg#1115
Documentation states for large project to start with 32gb up to 128gb https://github.com/CycloneDX/cdxgen/blob/master/ADVANCED.md#use-atom-in-java-mode

[mhdawson]

+1 from me. I think this would be access to one of the benchmarking machines.

[mhdawson]

@nodejs/build

[richardlau]

+1

[sxa]

+1 from me. I think this would be access to one of the benchmarking machines.

Or one of the Altras from equinix (could be a docker container created specifically for this). That RAM requirement sounds completely crazy but if it's needed then I'm +1 on granting access to something. The concern with using a benchmarking machine is, of course, that if someone's doing SBOM work while a performance run is happening it will influence the results so we'd need to manage that carefully.

[mhdawson]

@sxa are the Altras x86? @marco-ippolito would using an ARM machine be ok too?

[marco-ippolito]

@sxa are the Altras x86? @marco-ippolito would using an ARM machine be ok too?

It shouldnt be a problem

[sxa]

@sxa are the Altras x86? @marco-ippolito would using an ARM machine be ok too?

Yeah aarch64

It shouldnt be a problem

Agreed - I believe all of the CycloneDX tooling that you're looking to run is java-based so shouldn't be an issue there.

[mhdawson]

@sxa does it matter which Altra?

[marco-ippolito]

Closing as we found a way to skip the generation of heavy dependencies so there is not longer need for beefy machine