[jira] [Closed] (RAT-579) Add CycloneDX SBOM generation to the build

[Philipp Ottlinger (Jira)]

     [ 
https://issues.apache.org/jira/browse/RAT-579?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Philipp Ottlinger closed RAT-579.
---------------------------------
    Resolution: Fixed

Closed as SBOM is generated during the build, no direct integration into mvn 
site at the moment

> Add CycloneDX SBOM generation to the build
> ------------------------------------------
>
>                 Key: RAT-579
>                 URL: https://issues.apache.org/jira/browse/RAT-579
>             Project: Apache RAT
>          Issue Type: Task
>          Components: build
>    Affects Versions: 0.18
>            Reporter: Philipp Ottlinger
>            Assignee: Philipp Ottlinger
>            Priority: Major
>             Fix For: 1.0.0
>
>
> In order to use ATR in the long run, generate SBOMs in RAT.
> h1.  Build integration
> Generate BOMs upon each build.
> h1. Site integration
> * Maven plugin does not provide site integration yet - 
> https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/710
> * we could link to JSON/XML directly, no real value at the moment
> * you could generate stuff in pre-site and link to it directly, such as:
> generate in pre-site phase:
> {{<build>
>     <plugins>
>         <plugin>
>             <groupId>org.cyclonedx</groupId>
>             <artifactId>cyclonedx-maven-plugin</artifactId>
>             <version>2.9.3</version>
>             <executions>
>                 <execution>
>                     <id>generate-sbom-for-site</id>
>                     <phase>pre-site</phase>
>                     <goals>
>                         <goal>makeBom</goal>
>                     </goals>
>                     <configuration>
>                         <outputFormat>all</outputFormat>
>                         <outputName>bom</outputName>
>                         <outputDirectory>
>                             ${project.reporting.outputDirectory}/sbom
>                         </outputDirectory>
>                     </configuration>
>                 </execution>
>             </executions>
>         </plugin>
>     </plugins>
> </build>}}
> and src/site/site.xml:
> {{
> <project name="My Project">
>     <body>
>         <menu name="Project">
>             <item name="SBOM (JSON)" href="sbom/bom.json"/>
>             <item name="SBOM (XML)" href="sbom/bom.xml"/>
>         </menu>
>     </body>
> </project>}}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)