SBOM generated by Maven project - Paths Check Errors and so on

[slawekjaranowski]

Hi,

Next release with SBOM generate by Maven project

Release https://releases.apache.org/vote/tooling-atr-maven-plugin/1.0.0-beta-1

I see for release artifact atr-maven-plugin-1.0.0-beta-1-source-release.zip

Could not locate a matching SBOM

I heve uploaded atr-maven-plugin-1.0.0-beta-1-cyclonedx.json and for it I see

atr-maven-plugin-1.0.0-beta-1-cyclonedx.json: Metadata file exists but no corresponding artifact with base 'atr-maven-plugin-1.0.0-beta-1' was found

For SBOM https://releases.apache.org/sbom/quality/tooling-atr-maven-plugin/1.0.0-beta-1/atr-maven-plugin-1.0.0-beta-1-cyclonedx.json

I see:

Conformance report
Errors

Kind Property	Count

MISSING_COMPONENT_PROPERTY SUPPLIER	36
MISSING_PROPERTY METADATA_AUTHOR_OR_MANUFACTURER	1
MISSING_PROPERTY METADATA_SUPPLIER	1
MISSING_PROPERTY METADATA_TIMESTAMP	1

SBOM was generate by https://github.com/CycloneDX/cyclonedx-maven-plugin

[dave2wave]

Let's discuss expectations because we missed with the last similar change. I have to ask:

When you release the following to ASF distribution atr-maven-plugin-1.0.0-beta-1-source-release.zip, atr-maven-plugin-1.0.0-beta-1-binary-release.zip, and atr-maven-plugin-1.0.0-beta-1-binary-release-with-deps.zip will they all have atr-maven-plugin-1.0.0-beta-1-cyclonedx.json as their SBOM? If so then we can make a rule, but if not then we have to discuss the SBON filenames that match each artifact.

[slawekjaranowski]

Exectlly for Maven project we will have for artifact:

<project-name>-<version>-<clasifier>.<type-extension>

so for project atr-maven-plugin in version 1.0.0-beta-1 we have deployed artifacts with clasifier: source-release and cyclonedx

[alitheg]

I think we just got the fix slightly wrong - I missed that it replaces the other classifiers. I can do a fix for that unless you've any misgivings @dave2wave?

[dave2wave]

I think we just got the fix slightly wrong - I missed that it replaces the other classifiers. I can do a fix for that unless you've any misgivings @dave2wave?

No misgivings. The only concern is that a SBOM might match multiple other artifacts. We can handle that case as people work to perfect SBOM generation in Maven.

[slawekjaranowski]

@alitheg it is better, but I still see:

Next my test:

SBOM Check - Consider creating an SBOM.

https://releases.apache.org/compose/tooling-atr-maven-plugin/1.0.0-beta-2-SNAPSHOT

Could not locate a matching SBOM

https://releases.apache.org/report/tooling-atr-maven-plugin/1.0.0-beta-2-SNAPSHOT/atr-maven-plugin-1.0.0-beta-2-SNAPSHOT-source-release.zip

should we reopen it or report new issue?

[slawekjaranowski]

FYI We plan to add to ASF parent a SBOM generation

• [#360] Publish SBOM on ASF releases maven-apache-parent#597

[alitheg]

Apologies @slawekjaranowski - I really thought that would fix it. Looking back into it now.

[slawekjaranowski]

@alitheg thanks, I confirm now is ok for simple project with only one source-release

I will check in a few days more complicated release like we have for Maven core
we have files:

binaries/apache-maven-4.0.0-rc-6-bin.tar.gz
binaries/apache-maven-4.0.0-rc-6-bin.zip
source/apache-maven-4.0.0-rc-6-src.tar.gz
source/apache-maven-4.0.0-rc-6-src.zip

and we will have one SBOM in root of deployment

apache-maven-4.0.0-rc-6-cyclonedx.json

We have one Maven core poroject and generate artifacts with source code, binary with multiple format - tar.gz and zip
so as is one project it will have one SBOM.