CycloneDX / CycloneDX/cyclonedx-maven-plugin
Running makeAggreagateBom on nested project fails due to empty bom file with schemaVersion 1.1
- Dominant language
- Java
- Stars
- 385
- Forks
- 108
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
I tried updating the plugin from 2.5.3 to 2.6.2 using schema 1.1 and get the following
```shell
[WARNING] Unknown keyword additionalItems - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword
ERROR] Failed to execute goal org.cyclonedx:cyclonedx-maven-plugin:2.6.2:makeAggregateBom (default) on project dashboard-parent: The BOM does not conform to the CycloneDX BOM standard as defined by the XSD
```
As near as I can determine this is because I have a structure of maven modules where I have
root
- shared
- A
- B
- C
- services
- One
- Two
And the shared and services directories themselves have no code to build and as such no dependencies. Resulting in a two line bom
```xml
```
Contributor guide
Research direction
Start by reproducing makeAggregateBom on the nested Maven module structure described in the issue with schema 1.1, focusing on the shared and services aggregator modules. Check how the empty BOM is produced and validated; done means the aggregate goal no longer fails schema validation for these modules and produces a valid CycloneDX BOM.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100