maven multi module transitive dependencies

[chakravarthi2u]

Hi Prabhu,

is this command cdxgen -t java -o bom.json generates sbom list resolved transitive dependencies or just transitive dependencies?

Please let me know How to get resolved transitive dependencies for a multi module maven project?

Also, how to generate dependencies from war or jar file?

Thanks,
Chakravarthi

[prabhu]

@chakravarthi2u Do you have any example repo for resolved transitive dependencies? The tool invokes the CycloneDX maven plugin and returns to manually parsing if nothing works.
To generate SBoM for a war file, pass the war file as the last argument. It is not possible to generate SBoM for a single jar file yet.

[chakravarthi2u]

I don't have example repo. I just created multi module java maven project. When i ran cdxgen -t java -o bom.json, i observed that bom.json created list of dependencies for every jar. I think those transitive dependencies are not resolved dependencies. If we run mvn dependency:list command, i observed that output is different than those available in bom.json.

Is there any way to get consolidated Software Bill of Materials for multi module project.

[prabhu]

Could you share the output after setting the env variable SCAN_DEBUG_MODE=debug