From b85f35c6724d050bb6a6cd122fda469e2ce40c90 Mon Sep 17 00:00:00 2001
From: David Waltermire <david.waltermire@nist.gov>
Date: Thu, 10 Feb 2022 11:10:55 -0500
Subject: [PATCH] Fixes to CycloneDX BOM building to ensure BOM files are
 signed for deployment.

---
 pom.xml | 30 +++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/pom.xml b/pom.xml
index 0a56470d..5fb716da 100644
--- a/pom.xml
+++ b/pom.xml
@@ -221,6 +221,7 @@
 					</configuration>
 				</plugin>
 				<plugin>
+					<groupId>org.apache.maven.plugins</groupId>
 					<artifactId>maven-checkstyle-plugin</artifactId>
 					<configuration>
 						<sourceDirectories>
@@ -254,9 +255,9 @@
 						<schemaVersion>${cyclonedx.schema.version}</schemaVersion>
 						<includeBomSerialNumber>true</includeBomSerialNumber>
 						<includeCompileScope>true</includeCompileScope>
-						<includeProvidedScope>true</includeProvidedScope>
-						<includeRuntimeScope>true</includeRuntimeScope>
-						<includeSystemScope>true</includeSystemScope>
+						<includeProvidedScope>false</includeProvidedScope>
+						<includeRuntimeScope>false</includeRuntimeScope>
+						<includeSystemScope>false</includeSystemScope>
 						<includeTestScope>false</includeTestScope>
 						<includeLicenseText>false</includeLicenseText>
 						<outputFormat>all</outputFormat>
@@ -264,10 +265,10 @@
 					</configuration>
 					<executions>
 						<execution>
+							<phase>package</phase>
 							<goals>
-								<goal>makeBom</goal>
+								<goal>makeAggregateBom</goal>
 							</goals>
-							<phase>verify</phase>
 						</execution>
 					</executions>
 				</plugin>
@@ -426,6 +427,25 @@
 							</sources>
 						</configuration>
 					</execution>
+<!--
+					<execution>
+						<id>attach-artifacts</id>
+						<phase>package</phase>
+						<goals>
+							<goal>attach-artifact</goal>
+						</goals>
+						<configuration>
+							<artifacts>
+								<artifact>
+									<file>${project.build.directory}/</file>
+									<type>xml</type>
+									<classifier>optional</classifier>
+								</artifact>
+								...
+							</artifacts>
+						</configuration>
+					</execution>
+-->
 				</executions>
 			</plugin>
 			<plugin>