mcc0nnell commented on PR #597: URL: https://github.com/apache/maven-apache-parent/pull/597#issuecomment-5553415360
Thanks — I think the cleanest scope here is ATR integration rather than treating the current CycloneDX 1.6 aggregate as the final SBOM publication model. The branch is intentionally narrowed to push-to-atr: JSON only, one aggregate for the reactor, child-project opt-out, and explicit SBOM/checksum/signature upload for ATR. I agree that broader/default publication is a separate question and is better revisited with CycloneDX 1.7 / isExternal support and evidence from real ATR releases. One detail I do not want to overclaim: makeAggregateBom attaches the SBOM by default, so with release:perform -Ppush-to-atr it may still participate in the normal deploy lifecycle. We should make that boundary explicit before describing this as ATR-only publication. The intended scope is narrower: when a project opts into push-to-atr, preserve the generated SBOM as release evidence that ATR can ingest and evaluate. This PR does not need to claim that the current aggregate SBOM is a complete artifact-level dependency model or settle ASF-wide default publication. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
