CycloneDX / CycloneDX/cyclonedx-maven-plugin
Make `cyclonedx-maven-plugin` work together with `frontend-maven-plugin`
- Dominant language
- Java
- Stars
- 385
- Forks
- 107
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
I use `cyclonedx-maven-plugin` to generate SBOM for my multi-module maven project.
Some of my maven module contains a jetty server + a frontend managed with npm, the frontend-build process is execute during the maven build thanks to [`frontend-maven-plugin`](https://github.com/eirslett/frontend-maven-plugin).
The frontend build also generate sbom thanks to [cyclonedx-node-npm](https://github.com/CycloneDX/cyclonedx-node-npm). I'm able to generate this frontend SBOM in corresponding maven`${project.build.directory}`.
So now ideally, I would like that this bom can be taking into account by `cyclonedx-maven-plugin`.
Maybe by aggregate it to sbom of the corresponding maven module ?
1) Do you think this could be in the scope of this project ?
2) Do you think this make sense to aggregate the frontend SBOM with the maven SBOM when using `makeBom` goal ? or should it be 2 seperated BOM ?
3) Do you think this make sense to aggregate the SBOM with `makeAggregateBom` goal ?
4) Or do you see better way to make this works together ?
I think this is related to : https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/395
If you want to include this in `cyclonedx-maven-plugin` I can help. Let me know :pray:
Contributor guide
Research direction
Start with issue #395 and the existing makeBom and makeAggregateBom entry points, then review how frontend-maven-plugin and cyclonedx-node-npm produce SBOMs in the Maven build directory. Define the intended aggregation behavior and acceptance criteria for both goals before identifying implementation and test locations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100