Comments (6)
I'd be curious what exactly you're referring to here. Can you elaborate?
CycloneDX/cyclonedx-maven-plugin#116
from cyclonedx-core-java.
Any Maven plugin can be called without adding it to the pom using the syntax mvn plugin:goal -Dproperty=value
from cyclonedx-core-java.
Hello @stevespringett ,
Thanks for your reply,
Do we have a CLI for cyclonedx that i can use to generate bom for all languages?
Currently i see a different implementation of cyclonedx for each language.
Does the current cyclonedx CLI generated bom? i see it analyses but does it create
My use case :
I need to generate bom for each application in CICD pipeline specific to the language using cyclonedx.
Is there an option as such?
from cyclonedx-core-java.
Yes, a CycloneDX CLI exists, however, its more of a utility.
All-in-one tools simply do not work well. OWASP tried that back in 2012/2013 and the results were not good. Each build system has a slightly different lifecycle and dependency resolution mechanism. In order to get accurate inventory and dependency graphs, SBOM creation needs to be part of that lifecycle. With a standalone tool that supported all languages, you'd have to replicate the dependency resolution algorithms for every ecosystem but in many cases still would not be able to produce an accurate inventory. Even native tools such as mvn dependency:tree
provide inaccurate results by design.
For Java apps, I would highly recommend inclusion of CycloneDX Maven plugin in a corporate pom. If your org doesn't have one, now is the time to do it. A single change would provide automatic SBOM capabilities across all Java apps.
For all others, I would simply rely on build metadata to determine what language(s) are used and invoke the correct CycloneDX build plugin. Jenkins has the concept of libraries which are reusable blocks of code that you can inject into a pipeline. Libraries contain logic and that logic could branch to include the various CycloneDX implementations. Once the library is built up, its a simple matter of including it as a build step - simple. I think SAP has a Jenkins library for CycloneDX somewhere on GitHub you may want to look for. Other build servers have similar concepts. Try to find a way to reuse the logic in a way that will 1) produce accurate inventory, and 2) allow you to scale the creation of SBOMs across all your builds.
from cyclonedx-core-java.
Hello @stevespringett ,
Thanks a lot for this detailed explanation.
from cyclonedx-core-java.
Do we have a CLI for cyclonedx that i can use to generate bom for all languages?
FYI @bhuvi11, the ORT analyzer in combination with the reporter aims to do that, besides other things.
Each build system has a slightly different lifecycle and dependency resolution mechanism. In order to get accurate inventory and dependency graphs, SBOM creation needs to be part of that lifecycle. With a standalone tool that supported all languages, you'd have to replicate the dependency resolution algorithms for every ecosystem
FYI @stevespringett, luckily, you do not need to replicate the dependency resolution algorithms, and it's a strong design goal of ORT not to do so, both for correctness and to not reinvent the wheel. Instead, we programmatically call the dependency resolution of the respective build system (which might be quite challenging to do depending on the build system).
Even native tools such as
mvn dependency:tree
provide inaccurate results by design.
I'd be curious what exactly you're referring to here. Can you elaborate @stevespringett?
from cyclonedx-core-java.
Related Issues (20)
- XML deserialization fails for `metadata>component>properties`
- XML deserialization fails when multiple legacy `Tool`s are provided
- XML deserialization fails when empty `hashes` collection is provided
- Missing CHANGELOG entries
- ParseException with ancestors in the metadata section (XML SBOM)
- License text attachment uses content type "plain/text" should be "text/plain"
- Support version 1.6 of the specification HOT 2
- BomJsonGenerator.toJsonString() unexpectedly replaces all new lines in Strings with spaces HOT 4
- It seems like version output in v1.5 still uses deprecated features of the CycloneDX schema HOT 1
- Compatility issues with dependency-check - no release of cyclonedx-core-java since oct 23 HOT 2
- Version 9.0.0 serialized licenses in XML as separate `<licenses>` tags HOT 2
- Version 9.0.x creates XML files that fail validation HOT 15
- Implement "Roundtrip" Tests to Improve Integrity HOT 2
- BOM serialisation fails for both JSON and XML HOT 3
- toXmlString() of BomXmlGenerator throws "NoSuchMethodError" in new version 9.0.4 HOT 4
- ParseException with nested components in the metadata section (XML SBoM)
- `ObjectLocator` doesn't work when BOM doesn't have a `metadata.component` node
- Service does not include the trustZone attribute
- Enhancement: make Vulnerability objects comparable by fields
- Unable to resolve custom license HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cyclonedx-core-java.