sbt bom.xml exporter
The aim of this project is to:
- extract a valid CycloneDx bom file from sbt projects
- ensure that the bom file is processable with Software Composition Analysis tools (like Dependency Track)
Current version of the plugin is 0.3.0, published to the Central Repository.
Snapshot version are published to the Sonatype Repository.
Add the plugin dependency to the file project/plugins.sbt using addSbtPlugin :
addSbtPlugin("io.github.siculo" %% "sbt-bom" % "0.3.0")
To create the bom for the default configuration use makeBom command:
> sbt makeBom
This create the BOM file inside the target directory. The name of the file created depends on the name and version property of the current project. For example, if name and version are myArtifact and 1.0, the file name is myArtifact-1.0.bom.xml.
It is possible to create the BOM for different scopes, so that all dependencies of the scopes are included in the generated BOM files. The default scope is Compile. For now the other supported scopes are Test and IntegrationTest. To generate the BOM for a certain scope, add the scope as a prefix to the makeBom command:
> sbt Test / makeBom
> sbt IntegrationTest / makeBom
The listBom command can be used to generate the contents of the BOM without writing it to a file. The BOM is returned as command output. To display the BOM content use:
> sbt show listBom
| Setting | Type | Description |
|---|---|---|
| bomFileName | String | bom file name |
Sample configuration:
lazy val root = (project in file("."))
.settings(
bomFileName := "bom.xml",
Test / bomFileName := "test.bom.xml",
IntegrationTest / bomFileName := "integrationTest.bom.xml",
)Actually, only version 1.0 of the CycloneDX specification is supported. Support for later versions of the specification, such as for creating BOMs in json format, is expected later.
There are two types of test: unit test done with scalatest and scripted test
Unit tests are written using scalatest syntax. Only pure logic classes are tested using these tests.
To run unit tests use the test command to run all tests, or testOnly ... command specifying the list of test to be
executed.
Scripted is a tool that allow you to test sbt plugins. For each test it is necessary to create a specially crafted project. These projects are inside src/sbt-test directory.
Scripted tests are run using scripted comand.
- The BOM is generated so that it takes into account the Scope (Compile, Test...) and its dependencies
- targetBomFile setting replaced by bomFileName
- default BOM file name is ${artifactId}-${version}.bom.xml
- GroupId has been changed to io.github.siculo
- Generated BOM is a valid 1.0 BOM file (removed unespected properties like BOM serial number and license URL)
- The cyclonedx-core-java library has been integrated and is used to generate the BOM
- Removed all old model classes used so far
- First release