(ant-antlibs-cyclonedx) 01/02: with ivyModule there is a good reason to resolve the main compoment

[bodewig]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch support-ivy-as-component-source
in repository https://gitbox.apache.org/repos/asf/ant-antlibs-cyclonedx.git

commit ec97eeba7774d414bf2290aa9e1b6bef1bae86d4
Author: Stefan Bodewig <bode...@apache.org>
AuthorDate: Sat Aug 15 20:28:43 2026 +0200

    with ivyModule there is a good reason to resolve the main compoment
---
 src/main/org/apache/ant/cyclonedx/ComponentBomTask.java | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java 
b/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
index a773073..be11c98 100644
--- a/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
+++ b/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
@@ -282,8 +282,6 @@ public class ComponentBomTask extends Task {
     private Bom createBom() throws IOException {
         Bom bom = new Bom();
         Date currentTime = DateUtils.getBuildDate(getProject());
-        bom.setSerialNumber(getSerialNumber(currentTime,
-                                            
System.getenv(DateUtils.ENV_SOURCE_DATE_EPOCH) != null));
 
         Metadata meta = createMetadata(currentTime);
 
@@ -301,6 +299,8 @@ public class ComponentBomTask extends Task {
                 }
             });
         
meta.setComponent(component.toMainCycloneDxComponent(specVersion.getVersion()));
+        // reproducible serial number uses metadata component's coordinates 
which may need to be resolved
+        bom.setSerialNumber(getSerialNumber(currentTime));
 
         if (useComponentSupplier) {
             OrganizationalEntity componentSupplier = 
meta.getComponent().getSupplier();
@@ -350,10 +350,11 @@ public class ComponentBomTask extends Task {
         return bom;
     }
 
-    private String getSerialNumber(Date timestamp, boolean reproducibleBuild) {
+    private String getSerialNumber(Date timestamp) {
         if (serialNumber != null) {
             return serialNumber;
         } else {
+            boolean reproducibleBuild = 
System.getenv(DateUtils.ENV_SOURCE_DATE_EPOCH) != null;
             UUID uuid = reproducibleBuild ? getReproducibleUuid(timestamp) : 
UUID.randomUUID();
             return "urn:uuid:" + uuid;
         }