CycloneDX / CycloneDX/cyclonedx-maven-plugin

Add option to omit all qualifiers from PackageURLs (--short-PURLs)

Open
#286 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

SBOMs generated with version 2.7.1 contain PackageURLs with classifier `type=jar`, which complicates the comparison with SBOMs generated by other tools.

Example:
```
"purl" : "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.12.6?type=jar"
```

It would be nice if the Maven Plugin offers a configuration option to omit classifiers altogether, similar to the [`--short-PURLs`](https://github.com/CycloneDX/cyclonedx-node-npm#usage) option of cyclonedx-npm.

Contributor guide

Open the contributing guide

Research direction

No source files or tests are named. Start by tracing how the Maven plugin generates PackageURLs and compare the requested behavior with cyclonedx-npm's --short-PURLs option. Done means a Maven configuration option can omit all qualifiers, including ?type=jar, from generated PackageURLs.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
tooling
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.