CycloneDX / CycloneDX/cyclonedx-maven-plugin

How can I generate SBOM in sub-module and get an aggregated SBOM? Regression with makeAggregateBom since 2.7.4 - outputReactorProjects has no effect

Open
#403 7 comments 1 reaction 0 assignees View on GitHub
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

I have a multi module maven project which I'd like to create an SBOM on each module and get an Aggregated BOM on the root-folder with cyclonedx-maven-plugin.

When I execute the following command :

```
mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.2:makeAggregateBom -DoutputReactorProjects=true -DoutputFormat=xml -B
```

I have an Aggregated BOM on the root target folder and also BOM inside each module. That's the expected behavior. In some case, if it's needed, I put the property "outputReactorProjects" to false to only get the aggregated bom on the root target folder.

Since 2.7.4, the property "outputReactorProjects" has no effect and I never get the BOM inside the module if I use the "makeAggregateBom" goal. Just like if the property is set to false ( https://cyclonedx.github.io/cyclonedx-maven-plugin/makeAggregateBom-mojo.html#outputReactorProjects )

Following documenation we can still produced an Aggregated BOM and a BOM inside the sub-module : "makeAggregateBom: creates an aggregate BOM at build root (with dependencies from the whole multi-modules build), and eventually a BOM for each module"

Case reproduced with Maven 3.8.5 and Maven 3.9.0, Plugin version 2.7.4, 2.7.5 and 2.7.9.

I have tried these commands :

```
mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.2:makeAggregateBom -DoutputReactorProjects=true -DoutputFormat=xml -B
```

---> Root SBOM and Sub-Modules

```
mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.2:makeAggregateBom -DoutputReactorProjects=false -DoutputFormat=xml -B
```

---> Root SBOM only

```
mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.4:makeAggregateBom -DoutputReactorProjects=true -DoutputFormat=xml -B
```

---> Root SBOM only

```
mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.4:makeAggregateBom -DoutputReactorProjects=false -DoutputFormat=xml -B
```

---> Root SBOM only

```
mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.9:makeAggregateBom -DoutputReactorProjects=true -DoutputFormat=xml -B
```

---> Root SBOM only

```
mvn clean install org.cyclonedx:cyclonedx-maven-plugin:2.7.9:makeAggregateBom -DoutputReactorProjects=false -DoutputFormat=xml -B
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the multi-module build with the makeAggregateBom goal and compare plugin versions 2.7.2, 2.7.4, and 2.7.9 using outputReactorProjects=true and false. Trace how the goal handles that option. Done means true creates BOMs in the root and submodules, while false creates only the aggregated root BOM.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.