Conversation
Also update plugin versions in pluginManagement secion
parent/pom.xml
Outdated
| </pluginManagement> | ||
|
|
||
| <plugins> | ||
| <plugin> |
There was a problem hiding this comment.
Not sure about the change. The plugin will run in every module using this as parent, and for example in OpenMQ I see this:
[INFO] --- cyclonedx-maven-plugin:2.7.9:makeAggregateBom (default) @ mq ---
[INFO] CycloneDX: Resolving Dependencies
[INFO] CycloneDX: Creating BOM version 1.4 with 1 component(s)
[INFO] CycloneDX: Writing and validating BOM (XML): .../mq/main/target/bom.xml
[INFO] attaching as mq-6.5.0-SNAPSHOT-cyclonedx.xml
[INFO] CycloneDX: Writing and validating BOM (JSON): .../mq/main/target/bom.json
[WARNING] Unknown keyword additionalItems - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword
[INFO] attaching as mq-6.5.0-SNAPSHOT-cyclonedx.json
There was a problem hiding this comment.
Yes, it will spit out some warnings if there is metadata that is needed for the SBOM generation that is missing, or wrongly configured.
Thanks for testing it out btw. I plan to run it on a couple of specs and implementations as well during next week to see that it doesn't break anything
There was a problem hiding this comment.
Is this some EF requirement? I don't understand why every child project is going to need this.
There was a problem hiding this comment.
Not at the moment, but there will eventually be a requirement to produce SBOMs coming up in the near future. This work is to be upfront with that. That said, if it generates a lot of problems for the projects, we can add it in a profile that can be disabled for those projects experiencing problems until it is fixed.
There was a problem hiding this comment.
The absence of SBOM for all components will very likely be seen by IT decision makers as a big drawback. Our mission for EE is to create a product that appeals to IT decision makers.
edburns
left a comment
There was a problem hiding this comment.
Wouldn't you also need to increment the version of the POM itself, in line 27?
That is automatically managed by the release plugin. It is only updated when there is an actual release, not on every commit. |
|
I tried this on the cdi project and saw no ill effects |
Thanks, Scott! |
Also update plugin versions in pluginManagement secion