cdx2spdx

pkg:maven/org.spdx/cdx2spdx@0.1.5

Used in:

components

Overview
Overview

Versions
Versions

Dependents
Dependents

Dependencies
Dependencies

Overview

Description

Command line utility to convert CycloneDX SBOM files to SPDX Documents

<dependency>
    <groupId>org.spdx</groupId>
    <artifactId>cdx2spdx</artifactId>
    <version>0.1.5</version>
</dependency>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	
	<groupId>org.spdx</groupId>
	<artifactId>cdx2spdx</artifactId>
	<version>0.1.5</version>
	<packaging>jar</packaging>
	
	<name>cdx2spdx</name>
	<url>https://github.com/spdx/cdx2spdx</url>
	<licenses>
		<license>
			<name>The Apache Software License, Version 2.0</name>
			<url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
			<distribution>repo</distribution>
		</license>
	</licenses>
	<developers>
		<developer>
			<id>goneall</id>
			<name>Gary O'Neall</name>
			<email>gary@sourceauditor.com</email>
			<organization>SPDX</organization>
			<organizationUrl>http://spdx.org</organizationUrl>
		</developer>
	</developers>
	<organization>
		<name>SPDX</name>
		<url>http://spdx.org</url>
	</organization>
	<scm>
		<url>https://github.com/spdx/cdx2spdx</url>
		<connection>scm:git:git@github.com:spdx/cdx2spdx.git</connection>
		<developerConnection>scm:git:git@github.com:spdx/cdx2spdx.git</developerConnection>
		<tag>v0.1.5</tag>
	</scm>
	<issueManagement>
		<system>Github</system>
		<url>https://github.com/spdx/cdx2spdx/issues</url>
	</issueManagement>
	<description>Command line utility to convert CycloneDX SBOM files to SPDX Documents</description>
	<ciManagement>
		<system>Github Actions</system>
		<url>https://github.com/spdx/cdx2spdx/actions</url>
	</ciManagement>
    <distributionManagement>
      <repository>
        <id>ossrh</id>
        <name>spdx-spdx-tools</name>
        <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
      </repository>
	</distributionManagement>
    <properties>
      <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
	  <sonar.host.url>https://sonarcloud.io</sonar.host.url>
	  <sonar.organization>spdx</sonar.organization>
	  <sonar.projectKey>cdx2spdx</sonar.projectKey>
	  <dependency-check-maven.version>8.4.3</dependency-check-maven.version>
    </properties>
	<profiles>
		<profile>
			<id>doclint-java8-disable</id>
			<activation>
				<jdk>[1.8,)</jdk>
			</activation>
			<properties>
				<javadoc.opts>-Xdoclint:none</javadoc.opts>
			</properties>
		</profile>
		<profile>
			<id>release</id>
			<build>
				<plugins>
				   	<plugin>
				      <groupId>org.apache.maven.plugins</groupId>
				      <artifactId>maven-source-plugin</artifactId>
				      <version>3.2.1</version>
				      <executions>
				        <execution>
				          <id>attach-sources</id>
				          <phase>verify</phase>
				          <goals>
				            <goal>jar-no-fork</goal>
				          </goals>
				        </execution>
				      </executions>
				    </plugin>
					<plugin>
					    <groupId>org.codehaus.mojo</groupId>
					    <artifactId>exec-maven-plugin</artifactId>
					    <inherited>false</inherited> <!-- only execute these in the parent -->
					    <executions>
					        <execution>
					            <id>git submodule update</id>
					            <phase>initialize</phase>
					            <configuration>
					                <executable>git</executable>
					                <arguments>
					                    <argument>submodule</argument>
					                    <argument>update</argument>
					                    <argument>--init</argument>
					                    <argument>--recursive</argument>
					                </arguments>
					            </configuration>
					            <goals>
					                <goal>exec</goal>
					            </goals>
					        </execution>
					    </executions>
					</plugin>
					<plugin>
		      			<groupId>org.apache.maven.plugins</groupId>
		      			<artifactId>maven-gpg-plugin</artifactId>
		      			<version>1.6</version>
		      			<executions>
		        			<execution>
		          				<id>sign-artifacts</id>
		          				<phase>verify</phase>
		          				<goals>
		            				<goal>sign</goal>
		          				</goals>
		          				<configuration>
		              				<keyname>${gpg.keyname}</keyname>
		              				<passphraseServerId>${gpg.keyname}</passphraseServerId>
		            			</configuration>
		        			</execution>
		      			</executions>
	    			</plugin>
				</plugins>
			</build>
		</profile>
	</profiles>
  <dependencies>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>4.11</version>
      <scope>test</scope>
    </dependency>
    <dependency>
    	<groupId>org.spdx</groupId>
    	<artifactId>java-spdx-library</artifactId>
    	<version>1.1.10</version>
    </dependency>
    <dependency>
    <!-- Note: CycloneDX library fails with version 2.15.0-rc3 -->
    	<groupId>com.fasterxml.jackson.core</groupId>
    	<artifactId>jackson-databind</artifactId>
    	<version>2.14.0-rc1</version>
    </dependency>
    <dependency>
    	<groupId>org.cyclonedx</groupId>
    	<artifactId>cyclonedx-core-java</artifactId>
    	<version>7.3.2</version>
    </dependency>
    <dependency>
    	<groupId>org.spdx</groupId>
    	<artifactId>spdx-rdf-store</artifactId>
    	<version>1.1.9</version>
    </dependency>
    <dependency>
    	<groupId>org.spdx</groupId>
    	<artifactId>spdx-jackson-store</artifactId>
    	<version>1.1.9.1</version>
    </dependency>
    <dependency>
    	<groupId>org.spdx</groupId>
    	<artifactId>spdx-tagvalue-store</artifactId>
    	<version>1.1.7</version>
    </dependency>
    <dependency>
    	<groupId>org.spdx</groupId>
    	<artifactId>spdx-spreadsheet-store</artifactId>
    	<version>1.1.7</version>
    </dependency>
  </dependencies>
    <build>
  		<resources>
			<resource>
				<targetPath>resources</targetPath>
				<filtering>false</filtering>
				<directory>resources</directory>
				<includes>
					<include>**/*</include>
				</includes>
			</resource>
			<resource>
				<targetPath>META-INF</targetPath>
				<filtering>false</filtering>
				<directory>.</directory>
				<includes>
					<include>LICENSE</include>
				</includes>
			</resource>
			<resource>
				<directory>src/main</directory>
				<excludes>
					<exclude>**/*.java</exclude>
				</excludes>
			</resource>
		</resources>
		<testResources>
			<testResource>
				<directory>src/test</directory>
				<excludes>
					<exclude>**/*.java</exclude>
				</excludes>
			</testResource>
			<testResource>
				<directory>src/test/resources</directory>
			</testResource>
		</testResources>
		<plugins>
			<plugin>
   				<groupId>org.owasp</groupId>
   				<artifactId>dependency-check-maven</artifactId>
   				<version>${dependency-check-maven.version}</version>
   				<configuration>
   					<suppressionFiles>dependency-check-supress.xml</suppressionFiles>
   				</configuration>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-compiler-plugin</artifactId>
				<version>3.11.0</version>
				<configuration>
					<release>11</release>
					<encoding>${project.build.sourceEncoding}</encoding>
					<showDeprecation>true</showDeprecation>
					<showWarnings>true</showWarnings>
					<optimize>true</optimize>
				</configuration>
			</plugin>
			<plugin>
			  <artifactId>maven-assembly-plugin</artifactId>
			  <configuration>
			    <archive>
			      <manifest>
			        <mainClass>org.spdx.cdx2spdx.CycloneToSpdx</mainClass>
			      </manifest>
			    </archive>
			    <descriptorRefs>
			      <descriptorRef>jar-with-dependencies</descriptorRef>
			    </descriptorRefs>
			  </configuration>
			  <executions>
			    <execution>
			      <id>make-assembly</id>
			      <phase>package</phase>
			      <goals>
			        <goal>single</goal>
			      </goals>
			    </execution>
			  </executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-javadoc-plugin</artifactId>
				<version>2.9</version>
				<configuration>
					<quiet>true</quiet>
					<source>8</source>
					<javadocExecutable>${env.JAVA_HOME}/bin/javadoc</javadocExecutable>
					<additionalparam>-Xdoclint:none</additionalparam>
				</configuration>
				<executions>
					<execution>
						<id>attach-javadocs</id>
						<configuration>
							<additionalparam>${javadoc.opts}</additionalparam>
						</configuration>
						<goals>
							<goal>jar</goal>
						</goals>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.spdx</groupId>
					<artifactId>spdx-maven-plugin</artifactId>
					<version>0.6.4</version>
					<executions>
						<execution>
							<id>build-spdx</id>
							<phase>prepare-package</phase>
							<goals>
								<goal>createSPDX</goal>
							</goals>
						</execution>
					</executions>
					<configuration>
						<spdxDocumentNamespace>http://spdx.org/spdxdocs/cdx2spdx-${version}</spdxDocumentNamespace>					
						<defaultFileCopyright>Copyright (c) 2022 Source Auditor Inc.</defaultFileCopyright>
						<defaultFileContributors>
							<param>Gary O'Neall</param>
						</defaultFileContributors>
						<defaultLicenseInformationInFile>Apache-2.0</defaultLicenseInformationInFile>
						<defaultFileConcludedLicense>Apache-2.0</defaultFileConcludedLicense>
						<defaultFileNotice>Licensed under the Apache License, Version 2.0 (the "License");
		  you may not use this file except in compliance with the License.
		  You may obtain a copy of the License at
		
		      http://www.apache.org/licenses/LICENSE-2.0
		
		  Unless required by applicable law or agreed to in writing, software
		  distributed under the License is distributed on an "AS IS" BASIS,
		  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
		  See the License for the specific language governing permissions and
		  limitations under the License.</defaultFileNotice>
						<licenseDeclared>Apache-2.0</licenseDeclared>
						<licenseConcluded>Apache-2.0</licenseConcluded>
						<creators>
							<param>Person: Gary O'Neall</param>
						</creators>
						<originator>Organization: Source Auditor Inc.</originator>
					</configuration>
	          </plugin>
			  <plugin>
			    <groupId>org.apache.maven.plugins</groupId>
			    <artifactId>maven-release-plugin</artifactId>
			    <version>3.0.1</version>
			    <configuration>
			      <tagNameFormat>v@{project.version}</tagNameFormat>
			      <releaseProfiles>release</releaseProfiles>
			      <goals>deploy</goals>
			    </configuration>
			  </plugin>
		</plugins>
  	</build>
</project>