Comments (1)
In the cyclonedx-maven-plugin
configuration we can set the outputDirectory
for the generated SBOM.
If we set this to
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<version>2.7.7</version>
<executions>
<execution>
<phase>prepare-package</phase>
<goals>
<goal>makeAggregateBom</goal>
</goals>
</execution>
</executions>
<configuration>
...
<outputFormat>json</outputFormat>
<outputName>bom</outputName>
<outputDirectory>${project.build.directory}/generated-resources/bom</outputDirectory>
...
</configuration>
</plugin>
then the generated SBOM json file will be included in the target/generated-resource/bom
directory.
After, using the maven-resources-plugin
we can copy this SBOM file to the project's output directory like this
<plugin>
<artifactId>maven-resources-plugin</artifactId>
<version>3.2.0</version>
<executions>
<execution>
<id>copy-bom</id>
<phase>prepare-package</phase>
<goals>
<goal>copy-resources</goal>
</goals>
<configuration>
<outputDirectory>${project.build.outputDirectory}/resources</outputDirectory>
<resources>
<resource>
<directory>${project.build.directory}/generated-resources/bom</directory>
<filtering>false</filtering>
</resource>
</resources>
</configuration>
</execution>
</executions>
</plugin>
This will include the SBOM file during the prepare-package
phase into the packed project under the resources
directory. This plugin should be placed after the cyclonedx-maven-plugin
because the SBOM generation will also happen in the prepare-package
phase.
With this solution we could get the SBOM resource during runtime.
I created an example for this solution (3bda98, cdb796) in the cyclonedx-sbom branch.
In the example I used the cyclonedx-core-java
dependency to parse the SBOM file and to use the predefined data models.
<dependency>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-core-java</artifactId>
<version>7.3.2</version>
</dependency>
I added the BOMServiceInitListener
where the SBOM parsing happens and added the BOMService
to store the SBOM model. Also added a grid
component to the DemoUI
just to represent the usage of this dependency.
from appsec-kit.
Related Issues (20)
- Getting NPE when having a Client Side Vulnerability in my App HOT 2
- Unsecure the AppSec kit view
- Scanner attached on every view/refresh
- Make the AppSecKit view more responsive
- Can't run the Application.java directly
- Avoid the need of adding cyclonedx-maven-plugin HOT 1
- Add option to provide a custom analysis.json file
- Provide full dependency tree of a vulnerability
- Unregister scan event listeners in AppSecDevToolsPlugin
- support of offline import of OSV Vulnerabilities HOT 1
- NoSuchMethodError: void com.sun.jna.Memory.close() error when running license check in Vaadin 14 apps HOT 2
- SocketTimeoutException when reading the batch response from OSV API HOT 1
- NoSuchMethodError when opening AppSec Kit UI in Vaadin 23 apps HOT 1
- AppSecException unchecked exception is swallowed by Stream.map() when thrown HOT 5
- Use lazy data binding when loading dependencies and vulnerabilities
- Handle the @Push annotation correctly HOT 2
- Ship JS instead of TS HOT 3
- Improve Copilot plugin styling HOT 2
- Add support for Copilot
- Documentation for V14 and V23 + updates for V7/8/24 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from appsec-kit.