Failure to run CycloneDX maven plugin in a Tycho RCP build

[StephFo]

Hi,
I added to my RCP app root pom.xml

<plugin>
	<groupId>org.cyclonedx</groupId>
	<artifactId>cyclonedx-maven-plugin</artifactId>
	<version>2.9.0</version>
				
	<dependencies>
		<dependency>
			<groupId>org.eclipse.tycho</groupId>
			<artifactId>tycho-sbom</artifactId>
			<version>${tycho-version}</version>
		</dependency>
	</dependencies>
	<executions>
		<execution>
			<phase>package</phase>
				<goals>
					<goal>makeAggregateBom</goal>
				</goals>
		</execution>
	</executions>
</plugin>

When running mvn clean verify command, I've got some errors and warnings:

[ERROR] 'tycho.sbom.url' property not set.
What does it mean ? Does it url path of the generated sbom ?

[WARNING] Unknown p2 repository for artifact: org.eclipse.core.runtime
Many warnings for every org.eclipse target platform bundles. Nevetheless RCP app is compiling fine.
I'm referring to Eclipse p2 repo.

Finally, build failed with: org.cyclonedx:cyclonedx-maven-plugin:2.9.0:makeAggregateBom failed: Project org.x.y.acme:org.x.y.acme.common:eclipse-plugin:3.0.0-SNAPSHOT does not have an expanded version

I do suspect some properties are not correctly setup to make it run.

I looked at Tycho samples but I've not found any demo project using CycloneDx maven plugin.

Does anyone know a good example to look at please ?

Help would be very appreciated.

Stephane

[ptziegler]

[ERROR] 'tycho.sbom.url' property not set.
What does it mean ? Does it url path of the generated sbom ?

There is a little bit of a chicken-and-egg problem. The proposed specification requires that the PURL for each artifact contains the repository it is contained by, as it might be consumed from multiple repositories and is therefore not unique.
In short: It's the repository the artifacts of the reactor are deployed to.

[WARNING] Unknown p2 repository for artifact: org.eclipse.core.runtime
Many warnings for every org.eclipse target platform bundles. Nevetheless RCP app is compiling fine.
I'm referring to Eclipse p2 repo.

That seems to indicate that the target locations are not visible to the model convert...

Finally, build failed with: org.cyclonedx:cyclonedx-maven-plugin:2.9.0:makeAggregateBom failed: Project org.x.y.acme:org.x.y.acme.common:eclipse-plugin:3.0.0-SNAPSHOT does not have an expanded version

That's the second chicken-and-egg problem. Tycho needs resolve the timestamp the qualifier will be replaced by. Do you want to provide an integration test? Otherwise one can only speculate what's going on here...

Does anyone know a good example to look at please ?

There's the project usd for the integration test
And it's also used for the WindowBuilder project

[StephFo]

Hi,
One year later, I'm working again on this topic.

Thanks to your examples I figured out my issue.
Moving my module defining the target platform (.target) as the last one versus, bundles , features, product, update-sites, makes the trick to solve the error org.cyclonedx:cyclonedx-maven-plugin:2.9.0:makeAggregateBom failed: Project org.x.y.acme:org.x.y.acme.common:eclipse-plugin:3.0.0-SNAPSHOT does not have an expanded version.

I d'ont know if it is normal or not but now it runs ok, sbom files are generated.

By the way, Windows Builder pom.xml is a very good example about man features: signing, API baseline check, etc...

Thank you again to have provided these valuable links.

Stéphane.