Applying Security Best Practices: SBOM plugin (#1360)

[ghost]

Adding the CycloneDX Maven Plugin to the project's POM file.

resolve: #1360

[laeubi]

Please provide example output and describe how this helps here as cyclone does not support Eclipse/Tycho build projects see:

• Cyclonedx sbom for tycho dependencies CycloneDX/cyclonedx-maven-plugin#137

[ghost]

Please provide example output and describe how this helps here as cyclone does not support Eclipse/Tycho build projects see:

• Cyclonedx sbom for tycho dependencies CycloneDX/cyclonedx-maven-plugin#137

Hi,

First at all, thanks for the feedback

Finally, please find attached a zip file with the output of local test related to the latest update,
bom.zip

Thanks,

[laeubi]

@fperezel I'll try to take a look into this, it would be good to explain who is using this information, e.g. is it expected to be included as a resource in the final jar? If yes we might need to increase versions for all modules to make the change effective.

[ghost]

@fperezel I'll try to take a look into this, it would be good to explain who is using this information, e.g. is it expected to be included as a resource in the final jar? If yes we might need to increase versions for all modules to make the change effective.

Hi, answering first question about "who is using this information". I may say any consumer of the software according all recommendation and regulations related to BOM files

Regarding if it should be included as resource in the final jar. From my point of view, I do recommend to include BOM files in each final jar in order to any consumer of any of jar can check it.

Finally, I have pushed a final pom version file where CycloneDX goal has been update makeBom after tested out this option. So that could the latest pom file version and it is ready for reviewing for a possible merge.

Cheers