This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro.git
The following commit(s) were added to refs/heads/main by this push:
new bd3ecdd2d chore: Generate SBOM files with CycloneDX and SPDX maven
plugins (#2893)
bd3ecdd2d is described below
commit bd3ecdd2daa9dedaf82f956379c95e28c36152b3
Author: Lenny Primak <[email protected]>
AuthorDate: Sat Sep 19 13:46:41 2026 -0500
chore: Generate SBOM files with CycloneDX and SPDX maven plugins (#2893)
---
pom.xml | 54 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 53 insertions(+), 1 deletion(-)
diff --git a/pom.xml b/pom.xml
index 8f77fdd22..9d3774a1f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -531,6 +531,16 @@
</dependency>
</dependencies>
</plugin>
+ <plugin>
+ <groupId>org.cyclonedx</groupId>
+ <artifactId>cyclonedx-maven-plugin</artifactId>
+ <version>2.9.3</version>
+ </plugin>
+ <plugin>
+ <groupId>org.spdx</groupId>
+ <artifactId>spdx-maven-plugin</artifactId>
+ <version>1.0.4</version>
+ </plugin>
</plugins>
</pluginManagement>
<plugins>
@@ -744,7 +754,7 @@
<preparationGoals>validate</preparationGoals>
<preparationProfiles>skip-checkstyle</preparationProfiles>
<goals>deploy</goals>
-
<releaseProfiles>docs,apache-release,${nexus-staging-profile}</releaseProfiles>
+
<releaseProfiles>docs,apache-release,generate-sbom,${nexus-staging-profile}</releaseProfiles>
<mavenExecutorId>forked-path</mavenExecutorId>
</configuration>
</plugin>
@@ -1681,6 +1691,48 @@
</plugins>
</build>
</profile>
+ <profile>
+ <id>generate-sbom</id>
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.cyclonedx</groupId>
+ <artifactId>cyclonedx-maven-plugin</artifactId>
+ <executions>
+ <execution>
+ <phase>package</phase>
+ <goals>
+ <goal>makeAggregateBom</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
+ <plugin>
+ <groupId>org.spdx</groupId>
+ <artifactId>spdx-maven-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>build-spdx-v2</id>
+ <phase>package</phase>
+ <goals>
+ <goal>createSPDX</goal>
+ </goals>
+ </execution>
+ <execution>
+ <id>build-spdx-v3</id>
+ <phase>package</phase>
+ <goals>
+ <goal>createSPDX</goal>
+ </goals>
+ <configuration>
+ <outputFormat>JSON-LD</outputFormat>
+ </configuration>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+ </profile>
<profile>
<id>nexus-staging</id>
<build>
