hboutemy commented on PR #597: URL: https://github.com/apache/maven-apache-parent/pull/597#issuecomment-5511493753
FYI, we did it in Maven for a few years to test and learn: https://github.com/apache/maven-parent/blame/master/pom.xml#L1406 result is that aggregate SBOM makes people happy "because we have a SBOM" (in Maven Central), but the result is not really usable for anything useful I won't explain in details why it's not useful, but focus on the solution: with the release of CycloneDX 1.7 ( few months ago) and its `isExternal` field, we start having the info that will make such SBOMs with CycloneDX Maven Plugin really useful = https://github.com/CycloneDX/cyclonedx-maven-plugin/pull/696 once this CycloneDX 1.7 will be out, I'll be full interested into publishing these SBOMs everywhere with current CycloneDX 1.6 plugin 2.9.x, we're taking the wrong route to me, adding generated files to the sizze of Maven Central without real benefit -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
