CycloneDX / CycloneDX/cyclonedx-maven-plugin

exclude dependencies with other goals than makeAggregateBom

Open
#269 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

I'm having a hard time excluding specific dependencies.
In our project, we need to use the makeBom goal, because it is a multi-module project and we just want to build specific modules.
When we use makeAggregateBom, the whole Project build for every module included, thus we use makeBom as a goal.
Now we need to exclude specific dependencies. Sadly it seems like it does only work with the makeAggregateBom goal. I tried the excludeArtifactId option as a parameter when calling and as a configuration in the maven file.

I found a TODO [here](https://github.com/CycloneDX/cyclonedx-maven-plugin/blob/9689d39795800b025f9c17edc677ffd32d8a63ea/src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java#L283).

I also tried multiple versions btw. (2.6.x, 2.7.0 and 2.7.4)

Contributor guide

Open the contributing guide

Research direction

Start in src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java at the TODO around line 283, then compare how exclusions work for makeAggregateBom with makeBom. Use the Maven configuration and the reported excludeArtifactId behavior as the reproduction case; done means exclusions work when makeBom is used without changing aggregate generation.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, tooling
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.