ppkarwasz commented on PR #129: URL: https://github.com/apache/tomcat-jakartaee-migration/pull/129#issuecomment-6834030886
The CycloneDX Maven Plugin by default lists **all** the project dependencies and `org.apache.ant:ant` is among the listed `provided` dependencies. This is configurable through the [`<includeXScope>` options](https://cyclonedx.github.io/cyclonedx-maven-plugin/makeBom-mojo.html). The current version of the plugin will get you **an** SBOM (which is something not all projects have), but I would argue that it is not a very useful SBOM for vulnerability management. It lacks a crucial piece of information: are the dependencies **embedded** in the artifact or resolved by users? We have been discussing this problem with @hboutemy on and off for a couple of years and only CycloneDX 1.7 brought a solution: an `isExternal` property. Hervé created CycloneDX/cyclonedx-maven-plugin#696 based on it as a draft of a new plugin architecture. My current understanding of how SBOMs for **binary** artifacts in Maven should look like is: - One SBOM **per artifact** (currently one for the whole project), - Uses the same classifier + `-cyclonedx`. For the Jakarta conversion tool it would mean: - One `-cyclonedx.json` artifact for the normal JAR with all dependencies `isExternal = true`. - Two mostly identical SBOM for the artifacts that embed their dependencies `-bin-cyclonedx.json`, `-shaded-cyclonedx.json`. These would have `isExternal = false`, which is the default. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
