Piotr Karwasz created LOG4J2-3676:
-------------------------------------
Summary: Adding new files to old published releases
Key: LOG4J2-3676
URL: https://issues.apache.org/jira/browse/LOG4J2-3676
Project: Log4j 2
Issue Type: Wish
Reporter: Piotr Karwasz
We are working on adding CycloneDX SBOMs to our new releases. This is a
metadata format that would allow us, among other things, to point the user to
an URL with all known vulnerabilities of our artifacts.
This works perfectly and generates {{*.cyclonedx.xml}} and {{*.cyclonedx.json}}
files in our snapshot Nexus repository:
[https://repository.apache.org/content/groups/snapshots/org/apache/logging/log4j/log4j-core/2.22.0-SNAPSHOT/]
Would it be possible to add these files (their hashes and signatures) to all
our previous releases? I know that Maven Central does not allow to delete or
modify files already published, but maybe it allows to add new files. The old
releases don't have {{*.cyclonedx.xml}} and {{*.cyclonedx.json}} files:
[https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.0-alpha1/]
Could you explore this possibility?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
