CycloneDX / CycloneDX/cyclonedx-maven-plugin

Make `cyclonedx-maven-plugin` work together with `frontend-maven-plugin`

Open
#452 6 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

I use `cyclonedx-maven-plugin` to generate SBOM for my multi-module maven project.

Some of my maven module contains a jetty server + a frontend managed with npm, the frontend-build process is execute during the maven build thanks to [`frontend-maven-plugin`](https://github.com/eirslett/frontend-maven-plugin).

The frontend build also generate sbom thanks to [cyclonedx-node-npm](https://github.com/CycloneDX/cyclonedx-node-npm). I'm able to generate this frontend SBOM in corresponding maven`${project.build.directory}`.

So now ideally, I would like that this bom can be taking into account by `cyclonedx-maven-plugin`.
Maybe by aggregate it to sbom of the corresponding maven module ?

1) Do you think this could be in the scope of this project ?
2) Do you think this make sense to aggregate the frontend SBOM with the maven SBOM when using `makeBom` goal ? or should it be 2 seperated BOM ?
3) Do you think this make sense to aggregate the SBOM with `makeAggregateBom` goal ?
4) Or do you see better way to make this works together ?

I think this is related to : https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/395

If you want to include this in `cyclonedx-maven-plugin` I can help. Let me know :pray:

Contributor guide

Open the contributing guide

Research direction

Start with issue #395 and the existing makeBom and makeAggregateBom entry points, then review how frontend-maven-plugin and cyclonedx-node-npm produce SBOMs in the Maven build directory. Define the intended aggregation behavior and acceptance criteria for both goals before identifying implementation and test locations.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.