Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

How to configure the plugin to only create one SBOM for all submodules?

See original GitHub issue

I have a multi modul maven project which I’d like to create an SBOM for with cyclonedx-maven-plugin 2.6.1. The parent pom looks like this:

...
<modules>
		<module>d</module>
		<module>c</module>
		<module>b</module>
		<module>a</module>
		<module>z</module>
		<module>y</module>
		<module>x</module>
</modules>
<dependencyManagement>
		<dependencies>
			<dependency>
				...
                        </dependency>
	       </dependencies>
</dependencyManagement>
<build>
	<pluginManagement>
		<plugins>
                      ...
		</plugins>
	</pluginManagement>
       <plugins>
              ...
       </plugins>
</build>
<profiles>
           <profile>
		<id>cyclonedx-maven</id>
		<build>
			<plugins>
				<plugin>
					<groupId>org.cyclonedx</groupId>
					<artifactId>cyclonedx-maven-plugin</artifactId>
					<inherited>false</inherited>
					<version>2.6.1</version>
					<executions>
						<execution>
						<phase>install</phase>
						<goals>
							<goal>makeAggregateBom</goal>
						</goals>
						</execution>
					</executions>
					<configuration>
						<projectType>application</projectType>
						<schemaVersion>1.4</schemaVersion>
						<includeBomSerialNumber>true</includeBomSerialNumber>
						<includeCompileScope>true</includeCompileScope>
						<includeProvidedScope>true</includeProvidedScope>
						<includeRuntimeScope>true</includeRuntimeScope>
						<includeSystemScope>true</includeSystemScope>
						<includeTestScope>false</includeTestScope>
						<includeLicenseText>true</includeLicenseText>
						<outputFormat>json</outputFormat>
						<outputName>sbom-report</outputName>
					</configuration>
				</plugin>
			</plugins>
		</build>
	</profile>
     ...
    <reporting>
        ...
    </reporting>
</profiles>

The submodules looks like this:

<project>
...
	<parent>
                  ...
	</parent>
	<dependencies>
		<dependency>
                       ....
		</dependency>
	</dependencies>
</project>

When I run mvn -U -B -e install -Pjenkins -DskipTests=true -Pcyclonedx-maven the following log will appear:

[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO] 
[INFO] ...                                                           [pom]
[INFO] ...                                                           [pom]
[INFO] ...                                                           [pom]
[INFO] ...                                                           [jar]
[INFO] ...                                                           [jar]
[INFO] ...                                                           [pom]
[INFO] ...                                                           [jar]
[INFO] ...                                                           [pom]
...
[INFO] 
[INFO] -----------------------< groupid/... >------------------------
[INFO] Building                                    [1/180]
[INFO] --------------------------------[ pom ]---------------------------------
[INFO] 
[INFO] --- maven-enforcer-plugin:3.0.0-M3:enforce (enforce-maven) @ ---
[INFO] 
[INFO] --- properties-maven-plugin:1.0.0:set-system-properties (default) @ ---
[INFO] Set 1 system property
[INFO] 
[INFO] --- maven-install-plugin:3.0.0-M1:install (default-install) @ ---
[INFO] Installing path/pom.xml to /.m2/repository/.../SNAPSHOT.pom
[WARNING] The following dependencies could not be resolved at this point of the build but seem to be part of the reactor:
[WARNING] depnameSNAPSHOT (test)
[WARNING] depnameSNAPSHOT (test)
...
[WARNING] Try running the build up to the lifecycle phase "package"
[INFO] 
[INFO] --- cyclonedx-maven-plugin:2.6.1:makeAggregateBom (default) @ ---
[INFO] CycloneDX: Creating BOM
[INFO] CycloneDX: Writing BOM (JSON): path
[INFO] CycloneDX: Validating BOM (JSON): path
[WARNING] Unknown keyword additionalItems - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword
[INFO] CycloneDX: Creating BOM
[INFO] CycloneDX: Writing BOM (JSON): path
[INFO] CycloneDX: Validating BOM (JSON): path
[INFO] CycloneDX: Creating BOM
[INFO] CycloneDX: Writing BOM (JSON): path
[INFO] CycloneDX: Validating BOM (JSON): path

How do I need to configure the plugin in order to only produce one BOM which still uses the aggregate goal to cover all submodules as well? I’ve tried to follow issue#13, but the solution did not work for me. Cyclone still creates reports for every submodule.