CycloneDX / CycloneDX/cyclonedx-maven-plugin

Can/should (maven) plugins be added to the SBOM?

Open
#486 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

In short: Since maven plugins are able to add code (code generation) and potentially have other impact on the software that is delivered. Shouldn't the maven plugins that are used in a project be added to the SBOM? And if so, can it this functionality be added to the Cyclone DX maven plugin?

Some more context: We build a framework and tools that are used within our company to quickly build applications. We (mis)use the Cyclone DX maven plugin to report on the maven dependencies being used. However, we also provide maven plugins for various purposes. For our use case we'd also like to measure their usage. But since plugins can also be used to alter/create software, we thought this would be a good fit for addition to the Cyclone DX maven plugin. Reading the description of 'component' it seems that a maven plugin would fit very well in there too. Hence this question/feature request.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing how the CycloneDX Maven plugin currently reports Maven dependencies and how its component definition applies to Maven plugins. Determine whether used Maven plugins should be included in the SBOM and define the expected behavior for this feature.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.