SBOMs not generated for some plug-ins

[pcdavid]

Hi,

I've enabled SBOM generation for EMF Validation here. It seemed to work: the build is OK, and I get bom.json files as a result.
But not for all my plug-ins, and I don't understand why.

After a successful build, I get the following bom.json files:

bundles/org.eclipse.emf.validation.ui/target/bom.json
bundles/org.eclipse.emf.validation.ui.ide/target/bom.json
examples/org.eclipse.emf.validation.examples.adapter/target/bom.json
examples/org.eclipse.emf.validation.examples.general/target/bom.json
examples/org.eclipse.emf.validation.examples.ocl/target/bom.json
features/org.eclipse.emf.validation-feature/target/bom.json
features/org.eclipse.emf.validation.doc-feature/target/bom.json
features/org.eclipse.emf.validation.examples-feature/target/bom.json
features/org.eclipse.emf.validation.master-feature/target/bom.json
features/org.eclipse.emf.validation.ocl-feature/target/bom.json
features/org.eclipse.emf.validation.sdk-feature/target/bom.json
features/org.eclipse.emf.validation.tests-feature/target/bom.json
releng/org.eclipse.emf.validation.releng/target/bom.json
releng/org.eclipse.emf.validation.repository/target/bom.json
releng/org.eclipse.emf.validation.target/target/bom.json

But no BOM is produced for the "main" plug-in org.eclipse.emf.validation (POM), while one is produced for
org.eclipse.emf.validation.ui (POM).

In the build logs for org.eclipse.emf.validation.ui (working case), the build ends with:

[INFO] --- tycho-p2-plugin:4.0.11:p2-metadata (attach-p2-metadata) @ org.eclipse.emf.validation.ui ---
[INFO] 
[INFO] --- cyclonedx:2.9.1:makeBom (default) @ org.eclipse.emf.validation.ui ---
[INFO] CycloneDX: Resolving Dependencies
[INFO] CycloneDX: Creating BOM version 1.6 with 88 component(s)
[INFO] CycloneDX: Writing and validating BOM (XML): /home/pcdavid/work/emf-services/git/emf-validation/bundles/org.eclipse.emf.validation.ui/target/bom.xml
[INFO]            attaching as org.eclipse.emf.validation.ui-1.8.0-SNAPSHOT-cyclonedx.xml
[INFO] CycloneDX: Writing and validating BOM (JSON): /home/pcdavid/work/emf-services/git/emf-validation/bundles/org.eclipse.emf.validation.ui/target/bom.json
[INFO]            attaching as org.eclipse.emf.validation.ui-1.8.0-SNAPSHOT-cyclonedx.json

so cyclone is invoked last, after tycho-p2-plugin:4.0.11:p2-metadata

In the (non-working) case of org.eclipse.emf.validation, the build ends with:

[INFO] --- tycho-p2-plugin:4.0.11:p2-metadata (attach-p2-metadata) @ org.eclipse.emf.validation ---

with no message at all from --- cyclonedx:2.9.1:makeBom.

Any idea what I'm missing?

Full build logs can be seen here (until GitHub flushes them).

[laeubi]

with no message at all from --- cyclonedx:2.9.1:makeBom.

Then for some reason you don't have enabled that for this plugin and you should check the effective pom

[pcdavid]

Thanks, this revealed that the plug-ins where the SBOMs is not generated have one particular thing in common: they contain a file (about.mappings) which trigger the activation of a conditional profile:

    <profile>
      <id>about-mappings</id>
      <activation>
        <file>
          <exists>about.mappings</exists>
        </file>
      </activation>
      <build>
        <resources>
          <resource>
            <directory>.</directory>
            <filtering>true</filtering>
            <includes>
              <include>about.mappings</include>
            </includes>
          </resource>
        </resources>
      </build>
    </profile>

Commenting this whole profile definition fixes the issue (the missing bom.json are now generated). What I don't understand yet is that even with an empty <build/> section, just having the profile activated triggers the issue and makes CycloneDX ignore the modules where the profile is activated:

    <profile>
      <id>about-mappings</id>
      <activation>
        <file>
          <exists>about.mappings</exists>
        </file>
      </activation>
      <build>
      </build>
    </profile>

I'll have to check on a plain Maven (non-Tycho, non-Eclipse) module if I can reproduce there.

[pcdavid]

So it's not a bug, it's me not understanding how profiles work in Maven:

This profile will automatically be active for all builds unless another profile in the same POM is activated using one of the previously described methods. All profiles that are active by default are automatically deactivated when a profile in the POM is activated on the command line or through its activation config.

I have SBOM generation configured inside:

    <profile>
      <id>sbom</id>
      <activation>
        <activeByDefault>true</activeByDefault>
      </activation>
      <!-- ... -->
    </profile>

And:

    <profile>
      <id>about-mappings</id>
      <activation>
        <file>
          <exists>about.mappings</exists>
        </file>
      </activation>
      <build>
      </build>
    </profile>

My intuitive understanding of activeByDefault was "will be active unless explictly disabled on then command-line", but that's not how it works. As soon as another profile, e.g. about-mappings gets activated, sbom is no longer active unless explicitly enabled.

Leaving everything as before but building with an explicit -Psbom works.

Sorry for the noise.

[laeubi]

No problem its actually interesting to see the feature it used and it works. Profiles in maven are tricky :-)