openrewrite / openrewrite/rewrite

Recipe to create SBOM for Maven and Gradle

Open
#3,746 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

recipe
Dominant language
Java
Stars
3.7k
Forks
570
Avg merge
13h 12m
Merged PRs (30d)
261

Description

What problem are you trying to solve?

Folks might want to produce an SBOM for their projects for compliance or other reasons.
We already have a Maven Mojo to produce a CycloneDx file, but this is limited to Maven and the Maven plugin. That Mojo uses an existing utility class to print the CycloneDxBom given a Maven document.

Describe the situation after applying the recipe

An SBOM produced, either as a diff (in the output folder?), or as a datatable entry for aggregation across projects,
for all of Maven and Gradle, possibly Bazel.

Have you considered any alternatives or workarounds?

We could add a Gradle task, Bazel action and who knows what next, but that would have some duplication and does not allow the production of SBOMs through the CLI or platform.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked CycloneDxBomMojo.java and PrintMavenAsCycloneDxBom.java utility to understand the existing Maven SBOM path. Then trace how recipes expose output through the CLI or platform. Done means the issue defines and supports SBOM production for Maven and Gradle, with the chosen diff or datatable output documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.