SBOM Generation "Unknown p2 repository for artifact"

[nxglhez]

Hello,

I am trying to integrate SBOM into my project however Tycho fails to resolve artifacts P2 repository:

[INFO] --- cyclonedx:2.9.1:makeAggregateBom (default) @ com.neoxam.adleclipse.plugins.commons ---
[INFO] CycloneDX: Resolving Dependencies
[WARNING] Unknown p2 repository for artifact: org.eclipse.equinox.common
[WARNING] Unknown p2 repository for artifact: org.eclipse.core.resources
[WARNING] Unknown p2 repository for artifact: org.eclipse.core.runtime
... (a long list) ...
[WARNING] Unknown p2 repository for artifact: org.ini4j
[WARNING] Unknown p2 repository for artifact: com.sun.jna
[WARNING] Unable to create Maven project for p2.eclipse.plugin:org.eclipse.equinox.common:eclipse-plugin:3.20.300.v20251111-0312 from repository.
[WARNING] Unknown p2 repository for artifact: org.eclipse.core.resources

I configured tycho.sbom.url to point to where my plugins will be uploaded.

The other plugin, in the list above, all comes from P2 repositories attached to the build:

    <ECLIPSE_RELEASE_NAME>2026-03</ECLIPSE_RELEASE_NAME>
    <ECLIPSE_RELEASE_VERSION>4.39</ECLIPSE_RELEASE_VERSION>
    
    <eclipse.releases.updateSite>https://download.eclipse.org/releases/${ECLIPSE_RELEASE_NAME}</eclipse.releases.updateSite>
    <eclipse.updates.updateSite>https://download.eclipse.org/eclipse/updates/${ECLIPSE_RELEASE_VERSION}</eclipse.updates.updateSite>
    <eclipse.orbit.updateSite>https://download.eclipse.org/tools/orbit/simrel/orbit-aggregation/${ECLIPSE_RELEASE_NAME}</eclipse.orbit.updateSite>
    <eclipse.cbi.updateSite>https://download.eclipse.org/cbi/updates/tpd/release</eclipse.cbi.updateSite>
    <pydev.updateSite>https://www.pydev.org/updates</pydev.updateSite>

However, I have configured mirrors in settings.xml (one for pydev, one for eclipse.org): without them, I still got the same result.

The CycloneDX is configured like this for my Tycho project (the goal is makeAggregateBom because it is inherited from an external global maven parent):

        <plugin>
          <groupId>org.cyclonedx</groupId>
          <artifactId>cyclonedx-maven-plugin</artifactId>
          <dependencies>
            <dependency>
              <groupId>org.eclipse.tycho</groupId>
              <artifactId>tycho-sbom</artifactId>
              <version>${tycho-version}</version>
            </dependency>
          </dependencies>
        </plugin>

        <!-- does not seem to be real maven plugin -->
        <plugin>
          <groupId>org.eclipse.tycho</groupId>
          <artifactId>tycho-sbom</artifactId>
          <version>${tycho-version}</version>
          <configuration>
            <includes>
              <include>eclipse-plugin</include>
              <include>eclipse-feature</include>
              <include>eclipse-repository</include>
            </includes>
          </configuration>
        </plugin>

I understood from this discussion that the warning was due to how CycloneDX requires the artifact URLs but I don't understand why Tycho is unable to resolve those URL especially when it could find them?

Did I miss something ?