CycloneDX / CycloneDX/cyclonedx-gradle-plugin
One SBOM file for all dependencies in a multi-module Android project
- Dominant language
- Java
- Stars
- 240
- Forks
- 103
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 11
Description
Is it possible to generate with this plugin one big SBOM file that would include all dependencies from a multi-module project?
We have a common setup where there is `app` module which includes other modules via `implementation project('module1')`. In the generated SBOM file there the dependencies listed are only for non-project dependencies, i.e. `implementation 'com.squareup.retrofit2:retrofit:2.9.0'`, but not for project dependencies.
Because of that we don't get all dependencies listed for `app` module and would need to resort to somehow gather all SBOMs per module and merge them together.
Contributor guide
Research direction
Start by tracing how the Gradle plugin generates an SBOM for the app module and handles project dependencies in a multi-module build. Verify the result against a project containing app, module1, and external dependencies; done means one generated SBOM includes dependencies from the full project rather than only non-project dependencies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100