bodewig commented on code in PR #233:
URL: https://github.com/apache/ant/pull/233#discussion_r3369994273
##########
sboms/ant-1.10.18alpha-cyclonedx.json:
##########
@@ -0,0 +1,355 @@
+{
+ "bomFormat" : "CycloneDX",
+ "specVersion" : "1.6",
+ "serialNumber" : "urn:uuid:2b3c6004-1754-4985-bbf1-27f088f2b856",
+ "version" : 1,
+ "metadata" : {
+ "timestamp" : "2026-06-07T12:52:38Z",
+ "lifecycles" : [
+ {
+ "phase" : "build"
+ }
+ ],
+ "tools" : {
+ "components" : [
+ {
+ "type" : "library",
+ "supplier" : {
+ "name" : "Apache Ant Project Management Committee",
+ "url" : [
+ "https://ant.apache.org/";
+ ]
+ },
+ "manufacturer" : {
+ "name" : "Apache Ant Project Management Committee",
+ "url" : [
+ "https://ant.apache.org/";
+ ]
+ },
+ "publisher" : "The Apache Software Foundation",
+ "group" : "org.apache.ant",
+ "name" : "ant-cyclonedx",
+ "version" : "0.1",
+ "description" : "Apache CycloneDX Antlib",
+ "licenses" : [
+ {
+ "license" : {
+ "id" : "Apache-2.0",
+ "url" : "https://www.apache.org/licenses/LICENSE-2.0.txt";
+ }
+ }
+ ],
+ "purl" : "pkg:maven/org.apache.ant/[email protected]?type=jar",
+ "externalReferences" : [
+ {
+ "type" : "vcs",
+ "url" :
"https://gitbox.apache.org/repos/asf/ant-antlibs-cyclonedx.git";
+ },
+ {
+ "type" : "license",
+ "url" : "https://www.apache.org/licenses/LICENSE-2.0.txt";
+ },
+ {
+ "type" : "build-system",
+ "url" :
"https://ci-builds.apache.org/job/Ant/job/CycloneDX%20Antlib/";
+ },
+ {
+ "type" : "mailing-list",
+ "url" : "https://ant.apache.org/mail.html";
+ },
+ {
+ "type" : "issue-tracker",
+ "url" :
"https://bz.apache.org/bugzilla/buglist.cgi?component=CycloneDX%20Antlib&product=Ant";
+ },
+ {
+ "type" : "website",
+ "url" : "https://ant.apache.org/antlibs/cyclonedx/";
+ },
+ {
+ "type" : "distribution",
+ "url" : "https://ant.apache.org/antlibs/bindownload.cgi";
+ },
+ {
+ "type" : "source-distribution",
+ "url" : "https://ant.apache.org/antlibs/srcdownload.cgi";
+ },
+ {
+ "type" : "security-contact",
+ "url" : "https://www.apache.org/security/";
+ }
+ ]
+ }
+ ]
+ },
+ "component" : {
+ "type" : "library",
+ "bom-ref" : "pkg:maven/org.apache.ant/[email protected]?type=jar",
+ "supplier" : {
+ "name" : "Apache Ant Project Management Committee",
+ "url" : [
+ "https://ant.apache.org/";
+ ]
+ },
+ "manufacturer" : {
+ "name" : "Apache Ant Project Management Committee",
+ "url" : [
+ "https://ant.apache.org/";
+ ]
+ },
+ "publisher" : "The Apache Software Foundation",
+ "group" : "org.apache.ant",
+ "name" : "ant",
+ "version" : "1.10.18-SNAPSHOT",
+ "description" : "Apache Ant Core",
+ "hashes" : [
+ {
+ "alg" : "MD5",
+ "content" : "5dd4aa18b6dc9a769fddf456d23525be"
+ },
+ {
+ "alg" : "SHA-1",
+ "content" : "abb46ac6ada0b6f0ecc7d2f8e10e0d1cd2011bac"
+ },
+ {
+ "alg" : "SHA-256",
+ "content" :
"db0d4a594c65a4cb170d851b4cd3fe36a82e3dee8f2a3738393349606a503621"
+ },
+ {
+ "alg" : "SHA-512",
+ "content" :
"ff48bfeb661736779287a6eb68b527793868e64f1da75e80649b3a6f7e0c29389f44bd17217fc0e0684761804388008f9b7c2e1d1112b79e8129b5fa5d0f1b91"
+ },
+ {
+ "alg" : "SHA3-256",
+ "content" :
"20057d1b6fdd74af1a33a71f0494b88405931025d622979dcbccf4542565de9e"
+ },
+ {
+ "alg" : "SHA3-512",
+ "content" :
"f9f4aceb500d8d4b15e6f0eec0c08c1d512682dc3edb2d51f5b6b9419e88d570e38e472328a2a0a0e685106d5266349878cea41dfdc4373911bd12f3b606c1d0"
+ },
+ {
+ "alg" : "SHA-384",
+ "content" :
"79442c31e2b1a325105079aa9d1491deef6433e831fabdbf3e2f48a8835b4dca8cb975a8342accfddc18ca343a9d50da"
+ },
+ {
+ "alg" : "SHA3-384",
+ "content" :
"49cb7a152090ba86cff13b76eeeee08a33986695e9e14f16ebca4bb4672d62e3e476381875fc9587fd57b2f802260154"
+ }
+ ],
+ "licenses" : [
+ {
+ "license" : {
+ "id" : "Apache-2.0",
+ "url" : "https://www.apache.org/licenses/LICENSE-2.0.txt";
+ }
+ }
+ ],
+ "purl" : "pkg:maven/org.apache.ant/[email protected]?type=jar",
+ "externalReferences" : [
+ {
+ "type" : "vcs",
+ "url" : "https://gitbox.apache.org/repos/asf/ant.git";
+ },
+ {
+ "type" : "issue-tracker",
+ "url" : "https://bz.apache.org/bugzilla/buglist.cgi?product=Ant";
+ },
+ {
+ "type" : "website",
+ "url" : "https://ant.apache.org/";
+ },
+ {
+ "type" : "advisories",
+ "url" :
"https://ant.apache.org/security.html#Apache%20Ant%20Security%20Vulnerabilities";
+ },
+ {
+ "type" : "mailing-list",
+ "url" : "https://ant.apache.org/mail.html";
+ },
+ {
+ "type" : "documentation",
+ "url" : "https://ant.apache.org/manual/";
+ },
+ {
+ "type" : "source-distribution",
+ "url" : "https://ant.apache.org/srcdownload.cgi";
+ },
+ {
+ "type" : "distribution",
+ "url" : "https://ant.apache.org/bindownload.cgi";
+ },
+ {
+ "type" : "license",
+ "url" : "https://www.apache.org/licenses/LICENSE-2.0.txt";
+ },
+ {
+ "type" : "build-system",
+ "url" : "https://ci-builds.apache.org/job/Ant/";
+ },
+ {
+ "type" : "release-notes",
+ "url" : "https://github.com/apache/ant/blob/master/WHATSNEW";
+ },
+ {
+ "type" : "security-contact",
+ "url" : "https://www.apache.org/security/";
+ },
+ {
+ "type" : "rfc-9116",
+ "url" : "https://ant.apache.org/.well-known/security.txt";
Review Comment:
actually the "type" is an enum defined by the spec:
https://cyclonedx.org/docs/1.7/json/#metadata_tools_oneOf_i0_components_items_externalReferences_items_type
- the types may be more restricted based on the context they appear in as they
may apply to the SBOM itself or a component mentioned therein.
I vaguely recalled the RFC as I do have security.txt files for my own
websites as well, but had forgotten it was an actual RFC.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
