{"id":13727914,"url":"https://github.com/CycloneDX/cyclonedx-maven-plugin","last_synced_at":"2025-05-08T00:30:56.634Z","repository":{"id":37458191,"uuid":"93290292","full_name":"CycloneDX/cyclonedx-maven-plugin","owner":"CycloneDX","description":"Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects","archived":false,"fork":false,"pushed_at":"2024-11-11T19:58:17.000Z","size":2223,"stargazers_count":298,"open_issues_count":78,"forks_count":85,"subscribers_count":13,"default_branch":"master","last_synced_at":"2024-11-11T20:32:26.088Z","etag":null,"topics":["bill-of-materials","bom","cyclonedx","maven","maven-plugin","mbom","obom","owasp","package-url","purl","saasbom","sbom","sbom-generator","software-bill-of-materials","spdx","vex"],"latest_commit_sha":null,"homepage":"https://cyclonedx.org/","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CycloneDX.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"custom":["https://owasp.org/donate/?reponame=www-project-cyclonedx\u0026title=OWASP+CycloneDX"]}},"created_at":"2017-06-04T04:33:47.000Z","updated_at":"2024-11-11T19:56:19.000Z","dependencies_parsed_at":"2023-02-13T22:46:10.801Z","dependency_job_id":"7767d1a1-def6-4656-ac91-ad7b908c0e3d","html_url":"https://github.com/CycloneDX/cyclonedx-maven-plugin","commit_stats":null,"previous_names":[],"tags_count":55,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-maven-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-maven-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-maven-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-maven-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CycloneDX","download_url":"https://codeload.github.com/CycloneDX/cyclonedx-maven-plugin/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":224202880,"owners_count":17272807,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bill-of-materials","bom","cyclonedx","maven","maven-plugin","mbom","obom","owasp","package-url","purl","saasbom","sbom","sbom-generator","software-bill-of-materials","spdx","vex"],"created_at":"2024-08-03T02:00:34.972Z","updated_at":"2024-11-14T19:30:29.001Z","avatar_url":"https://github.com/CycloneDX.png","language":"Java","funding_links":["https://owasp.org/donate/?reponame=www-project-cyclonedx\u0026title=OWASP+CycloneDX"],"categories":["Official projects"],"sub_categories":["Repositories"],"readme":"[![Build Status](https://github.com/CycloneDX/cyclonedx-maven-plugin/workflows/Maven%20CI/badge.svg)](https://github.com/CycloneDX/cyclonedx-maven-plugin/actions?workflow=Maven+CI)\n[![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.cyclonedx/cyclonedx-maven-plugin/badge.svg)](https://maven-badges.herokuapp.com/maven-central/org.cyclonedx/cyclonedx-maven-plugin)\n[![License](https://img.shields.io/badge/license-Apache%202.0-brightgreen.svg)][License]\n[![Website](https://img.shields.io/badge/https://-cyclonedx.org-blue.svg)](https://cyclonedx.org/)\n[![Slack Invite](https://img.shields.io/badge/Slack-Join-blue?logo=slack\u0026labelColor=393939)](https://cyclonedx.org/slack/invite)\n[![Group Discussion](https://img.shields.io/badge/discussion-groups.io-blue.svg)](https://groups.io/g/CycloneDX)\n[![Twitter](https://img.shields.io/twitter/url/http/shields.io.svg?style=social\u0026label=Follow)](https://twitter.com/CycloneDX_Spec)\n\n\nCycloneDX Maven Plugin\n=========\n\nThe CycloneDX Maven plugin generates CycloneDX Software Bill of Materials (SBOM) containing the aggregate of all direct \nand transitive dependencies of a project. CycloneDX is a full-stack SBOM standard designed for use in application security\ncontexts and supply chain component analysis.\n\nMaven Usage\n-------------------\n\n```xml\n\u003c!-- uses default configuration --\u003e\n\u003cplugins\u003e\n    \u003cplugin\u003e\n        \u003cgroupId\u003eorg.cyclonedx\u003c/groupId\u003e\n        \u003cartifactId\u003ecyclonedx-maven-plugin\u003c/artifactId\u003e\n        \u003cexecutions\u003e\n            \u003cexecution\u003e\n                \u003cphase\u003epackage\u003c/phase\u003e\n                \u003cgoals\u003e\n                    \u003cgoal\u003emakeAggregateBom\u003c/goal\u003e\n                \u003c/goals\u003e\n            \u003c/execution\u003e\n        \u003c/executions\u003e\n    \u003c/plugin\u003e\n\u003c/plugins\u003e\n```\n\n\nDefault Values\n-------------------\n```xml\n\u003cplugins\u003e\n    \u003cplugin\u003e\n        \u003cgroupId\u003eorg.cyclonedx\u003c/groupId\u003e\n        \u003cartifactId\u003ecyclonedx-maven-plugin\u003c/artifactId\u003e\n        \u003cconfiguration\u003e\n            \u003cprojectType\u003elibrary\u003c/projectType\u003e\n            \u003cschemaVersion\u003e1.6\u003c/schemaVersion\u003e\n            \u003cincludeBomSerialNumber\u003etrue\u003c/includeBomSerialNumber\u003e\n            \u003cincludeCompileScope\u003etrue\u003c/includeCompileScope\u003e\n            \u003cincludeProvidedScope\u003etrue\u003c/includeProvidedScope\u003e\n            \u003cincludeRuntimeScope\u003etrue\u003c/includeRuntimeScope\u003e\n            \u003cincludeSystemScope\u003etrue\u003c/includeSystemScope\u003e\n            \u003cincludeTestScope\u003efalse\u003c/includeTestScope\u003e\n            \u003cincludeLicenseText\u003efalse\u003c/includeLicenseText\u003e\n            \u003coutputReactorProjects\u003etrue\u003c/outputReactorProjects\u003e\n            \u003coutputFormat\u003eall\u003c/outputFormat\u003e\n            \u003coutputName\u003ebom\u003c/outputName\u003e\n            \u003coutputDirectory\u003e${project.build.directory}\u003c/outputDirectory\u003e\u003c!-- usually target, if not redefined in pom.xml --\u003e\n            \u003cverbose\u003efalse\u003c/verbose\u003e\u003c!-- = ${cyclonedx.verbose} --\u003e\n        \u003c/configuration\u003e\n    \u003c/plugin\u003e\n\u003c/plugins\u003e\n```\n\n`\u003cprojectType\u003e` default value is `library` but there are [more choices defined in the CycloneDX specification](https://cyclonedx.org/docs/1.6/json/#metadata_component_type).\n\nSee also [External References](https://cyclonedx.github.io/cyclonedx-maven-plugin/external-references.html) documentation for details on this topic.\n\nExcluding Projects\n-------------------\nWith `makeAggregateBom` goal, it is possible to exclude certain Maven reactor projects (aka modules) from getting included in the aggregate BOM:\n\n* Pass `-DexcludeTestProject` to exclude any Maven module with artifactId containing the word \"test\"\n* Pass `-DexcludeArtifactId=comma separated id` to exclude based on artifactId\n* Pass `-DexcludeGroupId=comma separated id` to exclude based on groupId\n\nGoals\n-------------------\nThe CycloneDX Maven plugin contains the following three goals:\n* `makeBom`: creates a BOM for each Maven module with its dependencies,\n* `makeAggregateBom`: creates an aggregate BOM at build root (with dependencies from the whole multi-modules build), and eventually a BOM for each module,\n* `makePackageBom`: creates a BOM for each Maven module with `war` or `ear` packaging.\n\nBy default, the BOM(s) will be attached as an additional artifacts with `cyclonedx` classifier (can be customized by setting `cyclonedx.classifier`) and `xml` or `json` extension during a Maven `install` or `deploy`:\n\n* `${project.artifactId}-${project.version}-cyclonedx.xml`\n* `${project.artifactId}-${project.version}-cyclonedx.json`\n\nThis may be switched off by setting `cyclonedx.skipAttach` to `true`.\n\nEvery goal can optionally be skipped completely by setting `cyclonedx.skip` to `true`.\n\n## CycloneDX Schema Support\n\nThe following table provides information on the version of this Maven plugin, the CycloneDX schema version supported, \nas well as the output format options. Use the latest possible version of this plugin that is compatible with \nthe CycloneDX version supported by the target system.\n\n| Version | Schema Version | Format(s) |\n|---------|----------------| --------- |\n| 2.9.x   | CycloneDX v1.6 | XML/JSON |\n| 2.8.x   | CycloneDX v1.5 | XML/JSON |\n| 2.6.x   | CycloneDX v1.4 | XML/JSON |\n| 2.5.x   | CycloneDX v1.3 | XML/JSON |\n| 2.0.x   | CycloneDX v1.2 | XML/JSON |\n| 1.4.x   | CycloneDX v1.1 | XML |\n| 1.0x    | CycloneDX v1.0 | XML |\n\n## Maven Plugin Documentation\n\nThe Maven plugin documentation can be viewed online at [https://cyclonedx.github.io/cyclonedx-maven-plugin/](https://cyclonedx.github.io/cyclonedx-maven-plugin/).\n\nCopyright \u0026 License\n-------------------\n\nCycloneDX Maven Plugin is Copyright (c) OWASP Foundation. All Rights Reserved.\n\nPermission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE] file for the full license.\n\n[License]: https://github.com/CycloneDX/cyclonedx-maven-plugin/blob/master/LICENSE\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCycloneDX%2Fcyclonedx-maven-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FCycloneDX%2Fcyclonedx-maven-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FCycloneDX%2Fcyclonedx-maven-plugin/lists"}