How to create SBOMs in Java with Maven and Gradle

• cyclonedx-maven-plugin

  10 273 8.3 Java

  Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

  

There is a CylconeDX plugin available on Maven central and Github that appears to be well-maintained and commonly used.

• spdx-maven-plugin

  1 38 8.0 Java

  Plugin for supporting SPDX in a Maven build.

  

For SPDX, there is a Maven plugin as well. However, this is still marked as a prototype. In the example below, I used the latest version (at the time of writing) with a similar configuration as mentioned in the GitHub README. Additionally, I bound the SPDX creation task to the package phase, similar to the CycloneDX example.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• spdx-sbom-generator

  1 371 6.8 Go

  Support CI generation of SBOMs via golang tooling.

  

Alternatively, there is command line tool available called spdx-sbom-generator. This CLI tool can generate SPDX SBOMs for many package managers, including Maven for Java applications. Gradle is currently not supported.

• cyclonedx-gradle-plugin

  6 139 8.3 Java

  Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects

  

There is a CyconeDX plugin available for Gradle. Just like the Maven plugin we discussed earlier, the Gradle plugin is released by the CycloneDX organization on Github with some of the same maintainers as the Maven plugin.

Suggest a related project