question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Documentation for makeBom and makeAggregateBom

See original GitHub issue

I ran into a problem using the goal makeAggregateBom and think that I have now solved it, giving the details below. If I got things right then perhaps this might help improve documentation. If I got things wrong, then I need to know that too!

I used the makeAggregateBom goal as detailed in the documentation and the result was that the goal was executed for every single module in the project. I did notice this, and realized that all my multiple generated BOM files were essentially the same thing (albeit with component ordering seeming to be different every time). This did not cause too big a problem in small projects (and I had no problem grabbing the “parent BOM” in Dependency-Track Plugin config).

However, the configuration fell over when applied to large projects because things took too long to run (the following console output shows absolute timestamps):

12:44:36 [INFO] --- cyclonedx-maven-plugin:1.3.1:makeAggregateBom (cyclonedx-aggregate) @ MyProject ---
12:45:46 [INFO] CycloneDX: Creating BOM

12:45:56 [INFO] --- cyclonedx-maven-plugin:1.3.1:makeAggregateBom (cyclonedx-aggregate) @ MyProjectModule1 ---
12:47:08 [INFO] CycloneDX: Creating BOM

12:47:15 [INFO] --- cyclonedx-maven-plugin:1.3.1:makeAggregateBom (cyclonedx-aggregate) @ MyProjectModule2 ---
12:48:23 [INFO] CycloneDX: Creating BOM

12:48:26 [INFO] --- cyclonedx-maven-plugin:1.3.1:makeAggregateBom (cyclonedx-aggregate) @ MyProjectModule3 ---
12:49:35 [INFO] CycloneDX: Creating BOM

12:49:43 [INFO] --- cyclonedx-maven-plugin:1.3.1:makeAggregateBom (cyclonedx-aggregate) @ MyProjectModule4 ---
12:50:53 [INFO] CycloneDX: Creating BOM

12:50:56 [INFO] --- cyclonedx-maven-plugin:1.3.1:makeAggregateBom (cyclonedx-aggregate) @ MyProjectModule5 ---
12:51:57 [INFO] CycloneDX: Creating BOM

12:52:00 [INFO] --- cyclonedx-maven-plugin:1.3.1:makeAggregateBom (cyclonedx-aggregate) @ MyProjectModule6 ---
12:52:51 [INFO] CycloneDX: Creating BOM

For a project with 46 modules this was increasing the total job run time by an hour!

My solution was to use the <inherited> tag thus:

<pluginManagement>
    <plugins>
        <plugin>
            <groupId>org.cyclonedx</groupId>
            <artifactId>cyclonedx-maven-plugin</artifactId>
            <version>1.3.1</version>
            <executions>
                <execution>
                    <id>cyclonedx-aggregate</id>
                    <phase>verify</phase>
                    <goals>
                        <goal>makeAggregateBom</goal>
                    </goals>
                </execution>
            </executions>
            <configuration>
                <includeCompileScope>true</includeCompileScope>
                <includeProvidedScope>true</includeProvidedScope>
                <includeRuntimeScope>true</includeRuntimeScope>
                <includeSystemScope>true</includeSystemScope>
                <includeTestScope>false</includeTestScope>
             </configuration>
         </plugin>
    </plugins>
</pluginManagement>
 
<plugins>
    <plugin>
        <groupId>org.cyclonedx</groupId>
        <artifactId>cyclonedx-maven-plugin</artifactId>
        <inherited>false</inherited>
     </plugin>
</plugins>

Now, this configuration worked for the project to which it was added… the goal ran once and once only and the resulting BOM was correct.

Additionally, this project parents many other projects. Thus, to those projects, all I had to do was use:

<plugin>
    <groupId>org.cyclonedx</groupId>
    <artifactId>cyclonedx-maven-plugin</artifactId>
    <inherited>false</inherited>
</plugin>

ie, “reset” things so that CycloneDX runs makeAggregateBom with inheritance turned off “at the right level” (does that make sense?).

One extra thing that I think would be useful to have in documentation is an explanation of makeBom and makeAggregateBom with a use case or two. Just to get people thinking of possibilities…

Issue Analytics

  • State:open
  • Created 4 years ago
  • Reactions:10
  • Comments:6

github_iconTop GitHub Comments

1reaction
mbuchnercommented, Jul 29, 2022

And another question - what is the exact difference between makeBom and makeAggregateBom - could you provide some details in the Readme please …

0reactions
faisal6621commented, Oct 12, 2022

And another question - what is the exact difference between makeBom and makeAggregateBom - could you provide some details in the Readme please …

@mbuchner going by the naming convention used in jacoco maven plugin I could understand that makeBom would be for a single module maven project while makeAggregateBom should be for the multi-module maven project. This is my thought only and author’s intention may differ.

Also going by the documentation here: https://cyclonedx.github.io/cyclonedx-maven-plugin/makeBom-mojo.html and https://cyclonedx.github.io/cyclonedx-maven-plugin/makeAggregateBom-mojo.html there only one addition in makeAggregateBom is:

  • Requires a Maven project to be executed.
  • Executes as an aggregator plugin. <— this one
  • Requires dependency resolution of artifacts in scope: test.
  • The goal is not marked as thread-safe and thus does not support parallel builds.
  • Binds by default to the lifecycle phase: package.
  • Requires that Maven runs in online mode.
Read more comments on GitHub >

github_iconTop Results From Across the Web

Re: what are the difference between mvn makeBom and ...
If your project has inheritance or aggregation, then you should use the makeAggregateBom goal. If your project is standalone, then you should ...
Read more >
Use Cases - CycloneDX
Use Cases. The following examples provide guidance as to the minimal fields required to achieve specific use cases. Ideally, all optional fields would...
Read more >
Generate software bill of material(SBOM) on Maven projects
The CycloneDX Maven plugin generates CycloneDX Software Bill of Materials (SBOM) containing the aggregate of all direct and transitive dependencies of Maven ...
Read more >
Guide to the Plugin Documentation Standard - Apache Maven
Why do we need a documentation standard? The standard is not a set of rules but a guide to help plugin developers document...
Read more >
github software bill of materials - Raipur public school
makeBom and makeAggregateBom can optionally be skipped completely by setting ... Add command examples to release documentation (, Upgrade ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found