SBOM support

[pjfanning]

The EU's CRA and equivalent measures in the US and elsewhere will make SBOMs very important.

https://www.cybeats.com/blog/why-sboms-are-critical-to-complying-with-the-eu-cyber-resilience-act

The only sbt support that I have seen is https://github.com/siculo/sbt-bom but this is quite incomplete.

Is there any interest in creating a community SBOM solution for sbt users?

[mdedetrich]

There is https://github.com/lightbend/sbt-bill-of-materials which is what used in pekko

[pjfanning]

when I say SBOM, I mean not Maven BOM but formats like https://cyclonedx.org/ and https://github.com/opensbom-generator/spdx-sbom-generator

https://scribesecurity.com/blog/spdx-vs-cyclonedx-sbom-formats-compared/

CycloneDX format is the one that I see ASF teams more often.

[pjfanning]

CycloneDX SBOMs include the checksums of the dependencies used in a build. This can be useful in checking if the build infrastructure has some invalid copies of the dependencies (in its cache).

[eed3si9n]

Are we talking about creating (S)BOM or consuming it as part of resolution?

[pjfanning]

I think the ability to create them would be a useful start.

[stevespringett]

https://github.com/siculo/sbt-bom is also the only implementation I've seen as well.

If the sbt community has questions on CycloneDX, please reach out. Our Slack is quite active should anyone want to dive in.

https://cyclonedx.org/slack/invite
https://cyclonedx.org/slack