|
| Description: |
The SBOM generated by the {{cyclonedx-maven-plugin}} only lists Maven dependencies. It misses:
* the npm packages bundled (e.g. by Vite) inside our webjars, which are invisible to Maven;
* the npm identity of third-party webjars, which only appear as {{pkg:maven/org.webjars/...}}, so vulnerability scanners don't match them against npm advisories (jQuery, Bootstrap...).
h2. Proposal
Add a new mojo in a Commons tool Maven plugin, run after {{makeBom}} in the {{release}} profile, that:
* folds the Embedded SBOMs found in {{META-INF/sbom/}} of the module and of its resolved dependency JARs into the module's SBOM, recording each bundled component as contained in its JAR;
* maps third-party webjars to their {{pkg:npm}} purl, using the webjar's own metadata plus a curated mapping table, and warns for unmapped webjars;
* gives every component a stable purl and a unique, deterministic {{bom-ref}} (containing JAR purl + npm purl), to be ready for VEX later.
* sets the SBOM {{metadata.supplier}} and {{metadata.manufacturer}} to the XWiki project, which the {{cyclonedx-maven-plugin}} cannot do (it only sets {{publisher}} from the POM {{<organization>}}), as expected by the CRA guidance (BSI TR-03183-2).
Whether the bundled components are nested under their JAR component or listed flat with a containment relationship is decided by a prototype checking how scanners (e.g. Grype, Dependency-Track) read each layout.
Design: https://design.xwiki.org/xwiki/bin/view/Proposal/SBOMPerRelease
Forum: https://forum.xwiki.org/t/publishing-an-sbom-with-every-xwiki-release/18996
|
|
