dongjoon-hyun opened a new pull request, #4953: URL: https://github.com/apache/hbase/pull/4953
This PR aims to publish SBOM artifacts along with the other Apache projects. - https://cwiki.apache.org/confluence/display/COMDEV/SBOM Here is an article to give some context. - https://www.activestate.com/blog/why-the-us-government-is-mandating-software-bill-of-materials-sbom/ Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: [CycloneDX](https://cyclonedx.org/), [Software Identification (SWID) tag](https://csrc.nist.gov/projects/Software-Identification-SWID), [Software Package Data Exchange® (SPDX)](https://spdx.dev/). We can use one of the Maven plugin, [CycloneDX maven plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin), a lightweight software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis. https://maven.apache.org/plugins/index.html#misc **The expected results** ``` $ mvn install -DskipTests ... $ ls -al ~/.m2/repository/org/apache/hbase/hbase-common/3.0.0-alpha-4-SNAPSHOT total 5064 drwxr-xr-x 11 dongjoon staff 352 Jan 9 18:28 . drwxr-xr-x 4 dongjoon staff 128 Jan 9 18:28 .. -rw-r--r-- 1 dongjoon staff 482 Jan 9 18:28 _remote.repositories -rw-r--r-- 1 dongjoon staff 159174 Jan 9 18:28 hbase-common-3.0.0-alpha-4-SNAPSHOT-cyclonedx.json -rw-r--r-- 1 dongjoon staff 139170 Jan 9 18:28 hbase-common-3.0.0-alpha-4-SNAPSHOT-cyclonedx.xml -rw-r--r-- 1 dongjoon staff 684842 Jan 9 18:28 hbase-common-3.0.0-alpha-4-SNAPSHOT-sources.jar -rw-r--r-- 1 dongjoon staff 267751 Jan 9 18:28 hbase-common-3.0.0-alpha-4-SNAPSHOT-test-sources.jar -rw-r--r-- 1 dongjoon staff 443154 Jan 9 18:28 hbase-common-3.0.0-alpha-4-SNAPSHOT-tests.jar -rw-r--r-- 1 dongjoon staff 871542 Jan 9 18:28 hbase-common-3.0.0-alpha-4-SNAPSHOT.jar -rw-r--r-- 1 dongjoon staff 6620 Jan 9 18:27 hbase-common-3.0.0-alpha-4-SNAPSHOT.pom -rw-r--r-- 1 dongjoon staff 1811 Jan 9 18:28 maven-metadata-local.xml ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
