ZOOKEEPER-4657: Publish SBOM artifacts #1969
Conversation
| <plugin> | ||
| <groupId>org.cyclonedx</groupId> | ||
| <artifactId>cyclonedx-maven-plugin</artifactId> | ||
| <version>2.7.3</version> |
There was a problem hiding this comment.
| <version>2.7.3</version> | |
| <version>2.7.4</version> |
There was a problem hiding this comment.
The cyclonedx-maven-plugin-2.7.4 was released last week, more information - https://github.com/CycloneDX/cyclonedx-maven-plugin/releases/tag/cyclonedx-maven-plugin-2.7.4
There was a problem hiding this comment.
Actually, I found it doesn't work in some cases, @VinodAnandan . While helping other projects, I tried and reverted to back 2.7.3.
Could you try that in a separate PR after this PR?
There was a problem hiding this comment.
@dongjoon-hyun sure, I will try 2.7.4 update in a separate PR after this PR.
There was a problem hiding this comment.
Thank you so much, @VinodAnandan !
There was a problem hiding this comment.
Actually, I found it doesn't work in some cases
I'm working on improving the plugin, can you point me where 2.7.3 works but not 2.7.4? I was not supposed to introduce any regression :)
@VinodAnandan if you worked on this, I'm interested to help
There was a problem hiding this comment.
+1, pending CI.
- Applied patch locally.
- Ran
mvn -B -T 8 clean install -Pfull-build. - Verified presence of cyclonedx.json and cyclonedx.xml files under ~/.m2/repository.
@dongjoon-hyun , thanks for driving this across multiple projects! I will wait until tomorrow to commit in case anyone else wants to comment. I see they just released a new version of the plugin last week, so let me know if you intend to upgrade to 2.7.4 before I commit.
|
Hi, @cnauroth . I want to keep this PR AS-IS with 2.7.3 because it's the verified version in various environments and cases. BTW, the CI failure looks irrelevant to this PR. |
|
Thank you for review, @VinodAnandan and @cnauroth ! |
Reviewed-by: Vinod Anandan <vinod@owasp.org> Signed-off-by: Chris Nauroth <cnauroth@apache.org> (cherry picked from commit aa8790c)
|
I have committed this to master, branch-3.8 and branch-3.7. @dongjoon-hyun , thank you for the patch. @VinodAnandan , thank you for code reviewing. |
|
Thank you so much! |
This PR aims to publish SBOM artifacts along with the other Apache projects.
Here is an article to give some context.
Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: CycloneDX, Software Identification (SWID) tag, Software Package Data Exchange® (SPDX).
We can use one of the Maven plugin, CycloneDX maven plugin, a lightweight software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.
https://maven.apache.org/plugins/index.html#misc
The expected results