This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch support-ivy-as-component-source
in repository https://gitbox.apache.org/repos/asf/ant-antlibs-cyclonedx.git
The following commit(s) were added to
refs/heads/support-ivy-as-component-source by this push:
new eaa90bb document the parts of ivyModule I've already written tests for
eaa90bb is described below
commit eaa90bb2e346f69e02ec02fc2e8f8f5415c178b1
Author: Stefan Bodewig <[email protected]>
AuthorDate: Sat Aug 15 13:23:41 2026 +0200
document the parts of ivyModule I've already written tests for
---
changes.xml | 7 ++
docs/component.html | 96 ++++++++++++++++++++++
src/main/org/apache/ant/cyclonedx/Component.java | 2 +-
.../ant/cyclonedx/IvyModuleComponentResolver.java | 2 +-
src/tests/antunit/component-ivymodule-test.xml | 10 +--
5 files changed, 110 insertions(+), 7 deletions(-)
diff --git a/changes.xml b/changes.xml
index 832c0c1..2003159 100644
--- a/changes.xml
+++ b/changes.xml
@@ -98,6 +98,13 @@
The default SBOM version now is 1.7 and the isExternal attribute
of component now also sets the attribute in the generated SBOM.
</action>
+ <action type="add">
+ The component type now supports a new nested element "ivymodule"
+ which uses Apache Ivy to fill in the details of a component and
+ its dependencies.
+ This adds Ivy as a new dependency which is only required if you
+ want to use this feature.
+ </action>
</release>
<release version="0.1" date="2026-06-03" description="initial release">
diff --git a/docs/component.html b/docs/component.html
index 3a77bd8..83105e9 100644
--- a/docs/component.html
+++ b/docs/component.html
@@ -204,6 +204,10 @@ <h4 id="sbomLink">sbomLink</h4>
<p>The <a hre="https://github.com/CycloneDX/cyclonedx-core-java";>CycloneDX
Core (Java) library</a> is used to read the linked SBOM.</p>
+ <p>The <code>sbomLink</code> and <code>ivyModule</code> elements
+ can not both be used as nested elements of the same
+ component.</p>
+
<h5>Attributes</h5>
<table class="attr">
@@ -221,6 +225,98 @@ <h5>Attributes</h5>
</tr>
</table>
+ <h4 id="ivyModule">ivyModule</h4>
+
+ <p><em>since CycloneDX Antlib 0.2</em>. The optional Ivy
+ dependency is required when using an <code>ivyModule</code>
+ element.</p>
+
+ <p>Using a nesed <code>ivyModule</code> you can use Apache Ivy to
+ fill in fields from an <code>ivy.xml</code> file and have Ivy
+ provide all (transitive) dependencies of this module to the
+ SBOM.</p>
+
+ <p>The <code>ivyModule</code> element is similar to
+ a <a
href="https://ant.apache.org/ivy/history/2.6.0/use/postresolvetask.html";>post
+ resolve task</a> and expects the Ivy module used for the current
+ component to be "resolved" already.</p>
+
+ <p>When present the Ivy module wll be used and</p>
+
+ <ul>
+ <li><code>name</code>, <code>group</code>, <code>version</code>,
+ <code>decription</code> are directly taken from the Ivy module
+ unless the compoment already specifies it explicitly.</li>
+ <li><code>license</code> and
+ "website"-type <code>externalReference</code> are taken from
+ the module's license and homePage if and only if there is no
+ corresponding element in this component element.</li>
+ <li>Dependencies of the given module that are included because
+ of the configurations given by the <code>conf</code> attribute
+ are added to the SBOM by the compomentbom task with data taken
+ from their module descriptors. This includes transitive
+ dependencies. The components will have hashes if an Ivy
+ retrieve operation has retrieved them and local files are
+ available prior to running the componentbom task.<br/>
+ Components specified explicitly in the SBOM take precedence
+ over those found by parsing the module. If there already
+ exists a component as part of the SBOM with the same name and
+ group as one read from the module, the dependencies will be
+ ignored. Here the version is ignored, it is assumed the
+ component explicitly specified is the result of a process that
+ resolved conflicts in dependency versions and is unknown to
+ Ivy. Currently this only applies to Components
+ with <code>pkg:maven/</code> Package-URLs as bom-ref.
+ </li>
+ </ul>
+
+ <p>Not all parts of an SBOM component you may want to provide are
+ part of an Ivy module definition and you may want to provide
+ them explicitly, supplier and manufacturer information, more
+ external references or the publisher for example.</p>
+
+ <p>The <code>sbomLink</code> and <code>ivyModule</code> elements
+ can not both be used as nested elements of the same
+ component.</p>
+
+ <h5>Attributes</h5>
+
+ <table class="attr">
+ <tr>
+ <th scope="col">Attribute</th>
+ <th scope="col">Description</th>
+ <th scope="col">Required</th>
+ </tr>
+ <tr>
+ <td>conf</td>
+ <td>comma-separated list of configurations that will be
+ consulted for dependencies of this component.</td>
+ <td>No, defaults to <code>*</code></td>
+ </tr>
+ <tr>
+ <td>optionalconf</td>
+ <td>comma-separated list of configurations. Any dependency
+ that is only included because of configurations specified in
+ this list will be marked with <code>scope</code>
+ optional.</td>
+ <td>No, by default no dependency is marked as optional.</td>
+ </tr>
+ <tr>
+ <td>externalconf</td>
+ <td>comma-separated list of configurations. Any dependency
+ that is only included because of configurations specified in
+ this list will have their <code>isExternal</code> flag set
+ to true.</td>
+ <td>No, by default no dependency is marked as external.</td>
+ </tr>
+ <tr>
+ <td>resolveId</td>
+ <td>The id which was used for a previous resolve.</td>
+ <td>No, defaults to <code>[org]-[module]</code> of the last
+ <code>ivy:resolve</code> task.</td>
+ </tr>
+ </table>
+
<h4 id="manufacturer">manufacturer</h4>
<p>At most one nested <a href="organization.html">organization</a>
diff --git a/src/main/org/apache/ant/cyclonedx/Component.java
b/src/main/org/apache/ant/cyclonedx/Component.java
index 4422009..afa748c 100644
--- a/src/main/org/apache/ant/cyclonedx/Component.java
+++ b/src/main/org/apache/ant/cyclonedx/Component.java
@@ -1213,7 +1213,7 @@ public class Component extends DataType {
}
/**
- * The retrieve pattern usde for retrieving the dependnecy artifacts.
+ * The retrieve pattern used for retrieving the dependency artifacts.
*
* <p>Defaults to {@code ${ivy.retrieve.pattern}}.</p>
*/
diff --git a/src/main/org/apache/ant/cyclonedx/IvyModuleComponentResolver.java
b/src/main/org/apache/ant/cyclonedx/IvyModuleComponentResolver.java
index d31b297..65fa1e8 100644
--- a/src/main/org/apache/ant/cyclonedx/IvyModuleComponentResolver.java
+++ b/src/main/org/apache/ant/cyclonedx/IvyModuleComponentResolver.java
@@ -146,7 +146,7 @@ class IvyModuleComponentResolver {
}
String module = settings.getVariable("ivy.module");
- if (organisation == null) {
+ if (module == null) {
throw new BuildException("no module provided, you need to call to
<resolve/> before using this task");
}
diff --git a/src/tests/antunit/component-ivymodule-test.xml
b/src/tests/antunit/component-ivymodule-test.xml
index 67f315f..3cfe765 100644
--- a/src/tests/antunit/component-ivymodule-test.xml
+++ b/src/tests/antunit/component-ivymodule-test.xml
@@ -252,7 +252,7 @@
value="https://example.org/"/>
</target>
- <target name="XtestComponentDataFromDependencyCanBeOverwrittenOrMerged">
+ <target name="testComponentDataFromDependencyIsReplacedByExplicitComponent">
<ivy:resolve file="resources/foo-bar.ivy.xml"
xmlns:ivy="antlib:org.apache.ivy.ant"/>
<cdx:componentbom outputdirectory="${output}" format="xml"
@@ -309,13 +309,13 @@
xmlns:au="antlib:org.apache.ant.antunit"
name="bom.dependencies.dependency(ref)"
value="pkg:maven/foo/[email protected]?type=jar,pkg:maven/org.apache.ant/[email protected]?type=jar,pkg:maven/org.apache.ant/[email protected]?type=jar"/>
+ <!-- additionalComponent hasn't got any dependencies -->
<au:assertPropertyEquals
xmlns:au="antlib:org.apache.ant.antunit"
name="bom.dependencies.dependency.dependency(ref)"
-
value="pkg:maven/org.apache.ant/[email protected]?type=jar,pkg:maven/org.apache.ant/[email protected]?type=jar"/>
- <!-- SHA1 of ant.jar, see
-
https://repo1.maven.org/maven2/org/apache/ant/ant/1.10.17/ant-1.10.17.jar.sha1
-->
- <au:assertResourceContains
+ value="pkg:maven/org.apache.ant/[email protected]?type=jar"/>
+ <!-- additionalComponent hasn't got any artifact resource -->
+ <au:assertResourceDoesntContain
xmlns:au="antlib:org.apache.ant.antunit"
resource="${output}/bom.xml"
value='<hash
alg="SHA-1">fa8a13422ac460563171d10a37c3f28340a953f6</hash>'/>
