sbp commented on issue #1332: URL: https://github.com/apache/tooling-trusted-releases/issues/1332#issuecomment-4753433273
We use `.cdx.json` and `.cdx.xml` to classify CycloneDX files, I believe after finding that these are the most common extensions in practice. The CycloneDX specification overview recommends: > Recognized file patterns > > The following file names are conventionally used for storing CycloneDX BOM files: > > - bom.json for JSON encoded CycloneDX BOM files. > - bom.xml for XML encoded CycloneDX BOM files. > > Alternatively, files that match the glob pattern below are also recognized: > > - *.cdx.json for JSON encoded CycloneDX BOM files. > - *.cdx.xml for XML encoded CycloneDX BOM files. I understand that the Maven plugin produces `-cyclonedx.json`. Would you think about making it consistent with the recommendations from CycloneDX? Or would you like us to add compatibility for `-cyclonedx.json`? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
