Hi all I've figured out one way to find the artifacts, probably not the best one.
In my branch I've added the SBOM file with manual component configuration and one created with the Ivy resolution code. "manual" really means by reading the component's SBOM files when available, The diff can be seen at https://github.com/apache/ant-antlibs-cyclonedx/blob/support-ivy-as-component-source/example/ant-cyclonedx-0.2alpha.cdx.diff Some differences are easy to explain and I'm fine with them: * jackson-core's SBOM lists a dependency on fastdoubleparser that is actually shaded away by Maven and not visible in the POM (and thus not visible to Ivy) * Ivy's own SBOM contains all optional dependencies - since ant-antlibs-cyclondedx doesn't depend on the optional dependencies they don't appear in the "new" SBOM. * the Maven generated SBOMs contain publisher fields and external references that are (currently not available) from Ivy files. * licenses uses names instead of SPDX ids But there are differences I'm not happy with and which must be related to the way I identify dependencies. In the Ivy generated SBOM ivy doesn't seem to depend on Ant and commons-collections doesn't seem to depend on commons-codec anymore. I believe this is because the Antlib directly depends on them. If anybody can point out the (obvious, I guess) mistake I've made, I'd be grateful. Stefan --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
