Hi Eric, On 29.10.2026 11:40, Eric Pugh wrote: > Piotr, why does the file have two names? > It appears to be <foo>.cdx.json if it's not in solr and <foo>.bom inside of > Solr?
There's no deep reason behind it. I just followed the file name patterns that CycloneDX recognizes [1]: tools are expected to detect an SBOM if it is named `bom.json` or `*.cdx.json`. Whatever names we pick, they should stay within that convention. ## Detached SBOM For the SBOM published next to the release artifacts, Apache Trusted Releases already has a convention: append `.cdx.json` to the artifact's file name. Under that convention, the SBOM for `solr-10.1.0.tgz` is `solr-10.1.0.tgz.cdx.json`. We can discuss whether that's the best choice. Dropping the archive extension (`solr-10.1.0.cdx.json`) would also make sense, since a single SBOM could then cover the same release in several archive formats: - solr-10.1.0.tgz - solr-10.1.0.zip - solr-10.1.0.tar.xz ## Embedded SBOM For the SBOM inside the archive, I'm not aware of any general convention, but there are some precedents: - PEP 770 puts SBOMs under `.dist-info/sboms/`. - Spring Boot puts them under `META-INF/sbom/<name>.cdx.json`. Following those, `sbom/solr-10.1.0.cdx.json` (or something under `sboms/`) might be a better choice than the current name. I also looked at how Ant handles this, but Ant's SBOM has one entry per file in the archive, which makes it *huge*: about as large as the archive itself. Needless to say, Ant doesn't embed it in the archive. Piotr [1] https://cyclonedx.org/specification/overview/#recognized-file-patterns --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
