The CycloneDX Gradle plugin creates an aggregate of all direct and transitive dependencies of a project and creates a valid CycloneDX SBOM. CycloneDX is a lightweight software bill of materials (SBOM) specification designed for use in application security contexts and supply chain component analysis.
Execution:
gradle cyclonedxBomOutput CycloneDX Generation Info:
gradle cyclonedxBom -infoExclude BOM Serial Number:
gradle cyclonedxBom -Pcyclonedx.includeBomSerialNumber=falsebuild.gradle (excerpt)
plugins {
id 'org.cyclonedx.bom'
}
apply plugin: 'java'
apply plugin: 'maven'
repositories {
mavenCentral()
}settings.gradle (excerpt)
pluginManagement {
resolutionStrategy {
eachPlugin {
if (requested.id.toString() == 'org.cyclonedx.bom') {
useModule('org.cyclonedx:cyclonedx-gradle-plugin:1.5.1')
}
}
}
repositories {
mavenCentral()
}
}Once a BOM is generated, it will reside at ./build/reports/bom.xml and ./build/reports/bom.json
Configuration: You can control the configurations included in the BOM:
cyclonedxBom {
// includeConfigs is the list of configuration names to include when generating the BOM (leave empty to include every configuration)
includeConfigs += ["runtimeClasspath"]
// skipConfigs is a list of configuration names to exclude when generating the BOM
skipConfigs += ["compileClasspath", "testCompileClasspath"]
// Specified the type of project being built. Defaults to 'library'
projectType = "application"
// Specified the version of the CycloneDX specification to use. Defaults to 1.2.
schemaVersion = "1.2"
}Run gradle with info logging (-i option) to see which configurations add to the BOM.
The following table provides information on the version of this node module, the CycloneDX schema version supported, as well as the output format options. Use the latest possible version of this node module that is the compatible with the CycloneDX version supported by the target system.
| Version | Schema Version | Format(s) |
|---|---|---|
| 1.4.x | CycloneDX v1.3 | XML/JSON |
| 1.2.x | CycloneDX v1.2 | XML/JSON |
| 1.1.x | CycloneDX v1.1 | XML |
| 1.0x | CycloneDX v1.0 | XML |
CycloneDX Gradle Plugin is Copyright (c) OWASP Foundation. All Rights Reserved.
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.