-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add
serialNumber
and VEX references to generate SBOMs (#56)
* Add `serialNumber` and VEX references to generate SBOMs The `cyclonedx-maven-plugin` has still some limitations that prevent it from publishing a reproducible `serialNumber` (CycloneDX/cyclonedx-maven-plugin#420) and adding a reference to a VEX document (CycloneDX/cyclonedx-maven-plugin#419 and CycloneDX/cyclonedx-maven-plugin#421). This PR provides a temporary workaround that will allow us to produce an CycloneDX (only the XML version), enhanced with these two elements. --------- Co-authored-by: Volkan Yazıcı <[email protected]>
- Loading branch information
Showing
3 changed files
with
162 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
<?xml version="1.0" encoding="UTF-8"?> | ||
<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | ||
xmlns="http://logging.apache.org/log4j/changelog" | ||
xsi:schemaLocation="http://logging.apache.org/log4j/changelog https://logging.apache.org/log4j/changelog-0.1.2.xsd" | ||
type="added"> | ||
<description format="asciidoc"> | ||
Add XSLT transformation step to add a deterministic `serialNumber` and VDR links to the SBOM | ||
</description> | ||
</entry> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters