CycloneDX / CycloneDX/cyclonedx-maven-plugin
Add option to omit all qualifiers from PackageURLs (--short-PURLs)
- Dominant language
- Java
- Stars
- 385
- Forks
- 107
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
SBOMs generated with version 2.7.1 contain PackageURLs with classifier `type=jar`, which complicates the comparison with SBOMs generated by other tools.
Example:
```
"purl" : "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.12.6?type=jar"
```
It would be nice if the Maven Plugin offers a configuration option to omit classifiers altogether, similar to the [`--short-PURLs`](https://github.com/CycloneDX/cyclonedx-node-npm#usage) option of cyclonedx-npm.
Contributor guide
Research direction
No source files or tests are named. Start by tracing how the Maven plugin generates PackageURLs and compare the requested behavior with cyclonedx-npm's --short-PURLs option. Done means a Maven configuration option can omit all qualifiers, including ?type=jar, from generated PackageURLs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- tooling
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100