CycloneDX / CycloneDX/cyclonedx-maven-plugin

Generate BOM based on spring boot fat jar

Open
#628 2 comments 0 reactions 0 assignees View on GitHub
wontfix
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

Hi,

I'm wondering whether I can generate org.cyclonedx.model.Bom with a spring boot fat jar.
(Say I dont have a maven project in hand, but only a spring boot fat jar)

Is there any chance that I can get a similar BOM file by analysis the spring boot fat jar without run maven plugin?

It seems to populate the "components" is sort of easy (1:1 mapping to the jars in fat jar)
But to populate the "dependencies" part still need maven resolving.

Any suggestions?

Thanks a lot!

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by reviewing how the plugin currently creates org.cyclonedx.model.Bom and resolves components and dependencies, then clarify the expected analysis of a Spring Boot fat JAR without a Maven project or Maven plugin before defining what a completed solution must produce.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring-boot
Domain
security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.