openrewrite / openrewrite/rewrite
Recipe to create SBOM for Maven and Gradle
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 3.7k
- Forks
- 570
- Avg merge
- 13h 12m
- Merged PRs (30d)
- 261
Description
What problem are you trying to solve?
Folks might want to produce an SBOM for their projects for compliance or other reasons.
We already have a Maven Mojo to produce a CycloneDx file, but this is limited to Maven and the Maven plugin. That Mojo uses an existing utility class to print the CycloneDxBom given a Maven document.
Describe the situation after applying the recipe
An SBOM produced, either as a diff (in the output folder?), or as a datatable entry for aggregation across projects,
for all of Maven and Gradle, possibly Bazel.
Have you considered any alternatives or workarounds?
We could add a Gradle task, Bazel action and who knows what next, but that would have some duplication and does not allow the production of SBOMs through the CLI or platform.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked CycloneDxBomMojo.java and PrintMavenAsCycloneDxBom.java utility to understand the existing Maven SBOM path. Then trace how recipes expose output through the CLI or platform. Done means the issue defines and supports SBOM production for Maven and Gradle, with the chosen diff or datatable output documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100