CycloneDX / CycloneDX/cyclonedx-maven-plugin

Running makeAggreagateBom on nested project fails due to empty bom file with schemaVersion 1.1

Open
#189 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
385
Forks
108
Avg merge
17h 31m
Merged PRs (30d)
7

Description

I tried updating the plugin from 2.5.3 to 2.6.2 using schema 1.1 and get the following
```shell
[WARNING] Unknown keyword additionalItems - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword
ERROR] Failed to execute goal org.cyclonedx:cyclonedx-maven-plugin:2.6.2:makeAggregateBom (default) on project dashboard-parent: The BOM does not conform to the CycloneDX BOM standard as defined by the XSD
```

As near as I can determine this is because I have a structure of maven modules where I have
root
- shared
- A
- B
- C
- services
- One
- Two

And the shared and services directories themselves have no code to build and as such no dependencies. Resulting in a two line bom
```xml

```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing makeAggregateBom on the nested Maven module structure described in the issue with schema 1.1, focusing on the shared and services aggregator modules. Check how the empty BOM is produced and validated; done means the aggregate goal no longer fails schema validation for these modules and produces a valid CycloneDX BOM.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.