[
https://issues.apache.org/jira/browse/LOG4J2-3676?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Piotr Karwasz deleted LOG4J2-3676:
----------------------------------
> Adding new files to old published releases
> ------------------------------------------
>
> Key: LOG4J2-3676
> URL: https://issues.apache.org/jira/browse/LOG4J2-3676
> Project: Log4j 2
> Issue Type: Wish
> Reporter: Piotr Karwasz
> Priority: Minor
>
> We are working on adding CycloneDX SBOMs to our new releases. This is a
> metadata format that would allow us, among other things, to point the user to
> an URL with all known vulnerabilities of our artifacts.
> This works perfectly and generates {{*.cyclonedx.xml}} and
> {{*.cyclonedx.json}} files in our snapshot Nexus repository:
> [https://repository.apache.org/content/groups/snapshots/org/apache/logging/log4j/log4j-core/2.22.0-SNAPSHOT/]
> Would it be possible to add these files (their hashes and signatures) to all
> our previous releases? I know that Maven Central does not allow to delete or
> modify files already published, but maybe it allows to add new files. The old
> releases don't have {{*.cyclonedx.xml}} and {{*.cyclonedx.json}} files:
> [https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.0-alpha1/]
> Could you explore this possibility?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
