Support uploads of mvn generated SBOMs

[dave2wave]

ATR processes and checks SBOMs. Maven can generate SBOMs. Let's make sure that this is naturally handled by this plugin.

[slawekjaranowski]

Generated BOMS are simple file which can be generated by external plugins, like:
https://cyclonedx.github.io/cyclonedx-maven-plugin/index.html

For Maven project we already generate https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/
there are files: cyclonedx.json , cyclonedx.xml

There is also issue to add configuration to generating it by default for ASF Maven projects

• [MPOM-401] publish SBOM on ASF releases maven-apache-parent#360

[slawekjaranowski]

We don't publish it at ASF distributions https://archive.apache.org/dist/maven/maven-3/3.9.16/

[slawekjaranowski]

question which format should be uploaded xml, json?

[dave2wave]

json is preferred.

[dave2wave]

We don't publish it at ASF distributions https://archive.apache.org/dist/maven/maven-3/3.9.16/

ATR will

[slawekjaranowski]

Which format of boms is prefered: cyclonedx or spdx?

example commons project publish in two format: cyclonedx and spdx
https://repo.maven.apache.org/maven2/org/apache/commons/commons-lang3/3.20.0/

[slawekjaranowski]

I think we have dedicated goal which check if project create a boms by atrifact classifier and artifact extension, and if found publish such file.

[dave2wave]

CycloneDX 1.7

[slawekjaranowski]

Plugin for Maven project https://cyclonedx.github.io/cyclonedx-maven-plugin/index.html
support only CycloneDX v1.6
@hboutemy @dave2wave should we create an issue for plugin?

@dave2wave will it works with 1.6?

[hboutemy]

atr:upload uploads whatever the project wants: once the release will be done, it can be used with Maven-generated SBOMs (and in the future with njord bundle too, as the plan we defined in February for Nexus 2 to Nexus 3 migration)

please help me get a release out: this release is in the critical path for a long time

[slawekjaranowski]

in this case atr:upload will be not enough, generated sbom is in file: target/bom.json so we need to rename it somehow
eg for Maven plugins we have distributions in one directory https://archive.apache.org/dist/maven/plugins/
so we need unique file names for all deployed files

[slawekjaranowski]

Maybe we can add an artifacts list to atr:upload and we have correct file name from artifacs

[hboutemy]

yes, there are many solutions, no worries: cyclonedx-maven-plugin default filename is fixed for some reasons, we can configure it at project level if this is not our own desire

we can test this in the current Git project
and like everything else, later make it default in ASF parent POM, for project that just use ASF parent POM

what is currently blocking us: we don't have a release of atr:upload to use

[slawekjaranowski]

file name of sbom changed in:

• Updated CycloneDX and ATR plugin configurations #52