-
-
Notifications
You must be signed in to change notification settings - Fork 95
Generated boms are always of type "library" allthough <projectType>application</projectType> is configured #632
Description
I noticed that some of my tracked projects are all of a sudden listed as "Library" in my Dependency-Track Instance instead of "Application".
I double checked by editing these projects back to "Application" and then rerun CycloneDX + the Dependency Track Plugin to push a new bom to the Tracker.
Results are that after that action the tracked projects are of type "library" again.
So I digged into the generated boms and noticed that the types of all the components in there are on its default "library" ingoring / overwriting my configuration which is set to "application".
I can't tell for sure since when this behavior occurs, might be since the Update to v2.9.1
The relevant configuration part of my CycloneDX Plugin configuration in my pom.xml:
<configuration>
<projectType>application</projectType>
<schemaVersion>1.6</schemaVersion>
<includeBomSerialNumber>true</includeBomSerialNumber>
<includeCompileScope>true</includeCompileScope>
<includeProvidedScope>true</includeProvidedScope>
<includeRuntimeScope>true</includeRuntimeScope>
<includeSystemScope>true</includeSystemScope>
<includeTestScope>false</includeTestScope>
<includeLicenseText>false</includeLicenseText>
<outputReactorProjects>true</outputReactorProjects>
<outputFormat>all</outputFormat>
<outputName>bom</outputName>
<outputDirectory>${project.build.directory}</outputDirectory>
<verbose>true</verbose>
</configuration>
The plugin configuration takes place in the "pluginManagement" Section of my pom.xml.
The generated bom contains this description for the actual project / module / component:
"component" : {
"type" : "library",
[...]
},
"properties" : [
{
"name" : "maven.goal",
"value" : "makeAggregateBom"
},
{
"name" : "maven.scopes",
"value" : "compile,provided,runtime,system"
}
]
}
So it looks like the actual projectType in the configuration is ignored?
Expected behavior:
- The Project Type stays at the configured type "Application" in the Dependency-Tracker