CycloneDX / CycloneDX/cyclonedx-maven-plugin
Can/should (maven) plugins be added to the SBOM?
- Dominant language
- Java
- Stars
- 385
- Forks
- 107
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
In short: Since maven plugins are able to add code (code generation) and potentially have other impact on the software that is delivered. Shouldn't the maven plugins that are used in a project be added to the SBOM? And if so, can it this functionality be added to the Cyclone DX maven plugin?
Some more context: We build a framework and tools that are used within our company to quickly build applications. We (mis)use the Cyclone DX maven plugin to report on the maven dependencies being used. However, we also provide maven plugins for various purposes. For our use case we'd also like to measure their usage. But since plugins can also be used to alter/create software, we thought this would be a good fit for addition to the Cyclone DX maven plugin. Reading the description of 'component' it seems that a maven plugin would fit very well in there too. Hence this question/feature request.
Contributor guide
Research direction
Start by reviewing how the CycloneDX Maven plugin currently reports Maven dependencies and how its component definition applies to Maven plugins. Determine whether used Maven plugins should be included in the SBOM and define the expected behavior for this feature.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100