Skip to content

Commit c0d75fd

Browse files
chadlwilsonchadlwilson
committed
WIP experiment with cyclonedx
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
1 parent 8618f3a commit c0d75fd

5 files changed

Lines changed: 66 additions & 25 deletions

File tree

‎ant/pom.xml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,18 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved.
193193
</archive>
194194
</configuration>
195195
</plugin>
196+
<plugin>
197+
<groupId>org.cyclonedx</groupId>
198+
<artifactId>cyclonedx-maven-plugin</artifactId>
199+
<executions>
200+
<execution>
201+
<phase>package</phase>
202+
<goals>
203+
<goal>makeBom</goal>
204+
</goals>
205+
</execution>
206+
</executions>
207+
</plugin>
196208
<plugin>
197209
<groupId>org.apache.maven.plugins</groupId>
198210
<artifactId>maven-assembly-plugin</artifactId>

‎ant/src/main/assembly/release.xml‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<assembly
3-
xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.2"
4-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5-
xsi:schemaLocation="
6-
http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.2
7-
http://maven.apache.org/xsd/assembly-1.1.2.xsd
8-
"
9-
>
2+
<assembly xmlns="http://maven.apache.org/ASSEMBLY/2.2.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/ASSEMBLY/2.2.0 https://maven.apache.org/xsd/assembly-2.2.0.xsd">
104
<id>release</id>
115
<formats>
126
<format>zip</format>
@@ -18,6 +12,10 @@
1812
<outputDirectory>dependency-check-ant</outputDirectory>
1913
<destName>dependency-check-ant.jar</destName>
2014
</file>
15+
<file>
16+
<source>${project.build.directory}/sbom.json</source>
17+
<outputDirectory>dependency-check-ant</outputDirectory>
18+
</file>
2119
</files>
2220
<dependencySets>
2321
<dependencySet>

‎cli/pom.xml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,18 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved.
8282
</archive>
8383
</configuration>
8484
</plugin>
85+
<plugin>
86+
<groupId>org.cyclonedx</groupId>
87+
<artifactId>cyclonedx-maven-plugin</artifactId>
88+
<executions>
89+
<execution>
90+
<phase>generate-resources</phase>
91+
<goals>
92+
<goal>makeBom</goal>
93+
</goals>
94+
</execution>
95+
</executions>
96+
</plugin>
8597
<plugin>
8698
<groupId>org.codehaus.mojo</groupId>
8799
<artifactId>appassembler-maven-plugin</artifactId>
@@ -104,7 +116,6 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved.
104116
</binFileExtensions>
105117
<repositoryLayout>flat</repositoryLayout>
106118
<repositoryName>lib</repositoryName>
107-
<unixScriptTemplate>${project.basedir}/src/main/conf/unixBinTemplate.sh</unixScriptTemplate>
108119
<windowsScriptTemplate>${project.basedir}/src/main/conf/windowsBinTemplate.bat</windowsScriptTemplate>
109120
<extraJvmArguments>${runtime.extra.jvm.args}</extraJvmArguments>
110121
</configuration>

‎cli/src/main/assembly/release.xml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<assembly
3-
xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.2"
4-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5-
xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.2
6-
http://maven.apache.org/xsd/assembly-1.1.2.xsd">
2+
<assembly xmlns="http://maven.apache.org/ASSEMBLY/2.2.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/ASSEMBLY/2.2.0 https://maven.apache.org/xsd/assembly-2.2.0.xsd">
74
<id>release</id>
85
<formats>
96
<format>zip</format>
@@ -52,5 +49,12 @@
5249
<include>NOTICE.txt</include>
5350
</includes>
5451
</fileSet>
52+
<fileSet>
53+
<outputDirectory>dependency-check</outputDirectory>
54+
<directory>${project.build.directory}</directory>
55+
<includes>
56+
<include>sbom.json</include>
57+
</includes>
58+
</fileSet>
5559
</fileSets>
5660
</assembly>

‎pom.xml‎

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,17 @@ Copyright (c) 2012 - Jeremy Long
342342
<ignoredVersions>.*-(alpha|beta|M|rc)[-0-9]+</ignoredVersions>
343343
</configuration>
344344
</plugin>
345+
<plugin>
346+
<groupId>org.cyclonedx</groupId>
347+
<artifactId>cyclonedx-maven-plugin</artifactId>
348+
<version>2.9.1</version>
349+
<configuration>
350+
<includeProvidedScope>false</includeProvidedScope>
351+
<skipNotDeployed>false</skipNotDeployed>
352+
<outputName>sbom</outputName>
353+
<outputFormat>json</outputFormat>
354+
</configuration>
355+
</plugin>
345356
</plugins>
346357
</pluginManagement>
347358
<plugins>
@@ -1040,12 +1051,6 @@ Copyright (c) 2012 - Jeremy Long
10401051
<artifactId>semver4j</artifactId>
10411052
<version>5.8.0</version>
10421053
</dependency>
1043-
<dependency>
1044-
<groupId>org.jspecify</groupId>
1045-
<artifactId>jspecify</artifactId>
1046-
<version>1.0.0</version>
1047-
<optional>true</optional>
1048-
</dependency>
10491054
<dependency>
10501055
<groupId>com.h2database</groupId>
10511056
<artifactId>h2</artifactId>
@@ -1254,6 +1259,20 @@ Copyright (c) 2012 - Jeremy Long
12541259
</exclusion>
12551260
</exclusions>
12561261
</dependency>
1262+
<dependency>
1263+
<groupId>org.jspecify</groupId>
1264+
<artifactId>jspecify</artifactId>
1265+
<version>1.0.0</version>
1266+
<!-- Use provided scope to ensure not used at runtime, even from transitive dependencies -->
1267+
<scope>provided</scope>
1268+
</dependency>
1269+
<dependency>
1270+
<groupId>com.github.spotbugs</groupId>
1271+
<artifactId>spotbugs-annotations</artifactId>
1272+
<version>4.9.8</version>
1273+
<!-- Use provided scope to ensure not used at runtime, even from transitive dependencies -->
1274+
<scope>provided</scope>
1275+
</dependency>
12571276
</dependencies>
12581277
</dependencyManagement>
12591278
<dependencies>
@@ -1293,15 +1312,12 @@ Copyright (c) 2012 - Jeremy Long
12931312
<dependency>
12941313
<groupId>org.jspecify</groupId>
12951314
<artifactId>jspecify</artifactId>
1296-
<scope>compile</scope>
1297-
<optional>true</optional>
1315+
<scope>provided</scope>
12981316
</dependency>
12991317
<dependency>
13001318
<groupId>com.github.spotbugs</groupId>
13011319
<artifactId>spotbugs-annotations</artifactId>
1302-
<version>4.9.8</version>
1303-
<scope>compile</scope>
1304-
<optional>true</optional>
1320+
<scope>provided</scope>
13051321
</dependency>
13061322
<!-- endregion -->
13071323
</dependencies>

0 commit comments

Comments
 (0)