CycloneDX / CycloneDX/cyclonedx-gradle-plugin

One SBOM file for all dependencies in a multi-module Android project

Open
#288 5 comments 8 reactions 0 assignees View on GitHub
android
Dominant language
Java
Stars
240
Forks
103
Avg merge
1d 9h
Merged PRs (30d)
11

Description

Is it possible to generate with this plugin one big SBOM file that would include all dependencies from a multi-module project?

We have a common setup where there is `app` module which includes other modules via `implementation project('module1')`. In the generated SBOM file there the dependencies listed are only for non-project dependencies, i.e. `implementation 'com.squareup.retrofit2:retrofit:2.9.0'`, but not for project dependencies.
Because of that we don't get all dependencies listed for `app` module and would need to resort to somehow gather all SBOMs per module and merge them together.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how the Gradle plugin generates an SBOM for the app module and handles project dependencies in a multi-module build. Verify the result against a project containing app, module1, and external dependencies; done means one generated SBOM includes dependencies from the full project rather than only non-project dependencies.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.