Erlang & Elixir Package Manager Plugins #11319

maennchen · 2026-01-15T19:47:16Z

See individual commits.

Dockerfile


+#------------------------------------------------------------------------
+# Elixir (Mix SBoM)
+FROM base AS mix_sbom_build


Dockerfile

+
+#------------------------------------------------------------------------
+# Erlang (Rebar3 SBoM wrapped in Bombom)
+FROM base AS rebar3_sbom_build


model/src/main/kotlin/utils/PurlExtensions.kt

+ * It converts a [PurlType] enum value to the corresponding ORT
+ * type string format.
+ */
+fun PurlType.toOrtType(): String =


model/src/main/kotlin/utils/PurlUtils.kt

codecov · 2026-01-15T20:34:25Z

Codecov Report

❌ Patch coverage is 71.08434% with 24 lines in your changes missing coverage. Please review.
✅ Project coverage is 57.86%. Comparing base (7bfdcbf) to head (4fc12f4).

Files with missing lines	Patch %	Lines
model/src/main/kotlin/utils/PurlExtensions.kt	0.00%	21 Missing ⚠️
model/src/main/kotlin/utils/PurlUtils.kt	95.00%	1 Missing and 2 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #11319      +/-   ##
============================================
+ Coverage     57.78%   57.86%   +0.08%     
  Complexity     1711     1711              
============================================
  Files           347      347              
  Lines         12904    12987      +83     
  Branches       1238     1257      +19     
============================================
+ Hits           7456     7515      +59     
- Misses         5000     5022      +22     
- Partials        448      450       +2

Flag	Coverage Δ
funTest-external-tools	`13.99% <0.00%> (-0.15%)`	⬇️
test-ubuntu-24.04	`42.77% <71.08%> (+0.26%)`	⬆️
test-windows-2025	`42.75% <71.08%> (+0.26%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

sschuberth · 2026-01-19T10:40:15Z

As I was just reading this article about workspace support in package managers, something to double-check during the review is whether "Mix (Elixir) [...] umbrella projects" are handled properly.

maennchen · 2026-01-19T10:59:37Z

@sschuberth The way Mix does this is called “Umbrella” applications. I have added a test specifically for that.

plugins/package-managers/mix/src/main/kotlin/Mix.kt

plugins/package-managers/rebar3/src/main/kotlin/Rebar3.kt

utils/cyclonedx/src/main/kotlin/BomObjectLocator.kt

utils/cyclonedx/src/main/kotlin/CycloneDxDependencyHandler.kt

utils/cyclonedx/src/main/kotlin/CycloneDxPackageManager.kt

utils/cyclonedx/src/test/kotlin/CycloneDxPackageManagerTest.kt

maennchen · 2026-01-20T10:55:16Z

Rebased on latest main (detekt update fixes)

sschuberth · 2026-02-09T12:42:33Z

scripts/docker_build.sh

    --build-context "base=docker-image://${DOCKER_IMAGE_ROOT}/ort/base:latest" \
    "$@"

+# Bombom (Erlang/Rebar3)


Nit: Looks like there is a blank line between footer lines in the commit message, which should not be.

Similar in other commits.

I removed the line, but now the commit linter is complaining.

sschuberth · 2026-02-09T12:45:08Z

Dockerfile

+
+ENV MIX_SBOM_HOME=/opt/mix_sbom
+
+# Download cosign binary, verify mix_sbom binary signature, then clean up


Just wondering: If we had gh available, would there be a way to simplify this via gh release download / gh release verify(-asset) commands?

Yes, that would take slightly less options in the command.
If you’d like, I can do a follow up PR and also change that for gleam.

Yes, let's keep that in mind for a follow-up PR, this one has already grown big enough. Esp. if there are also other places in the Dockerfile that would benefit from this simplification.

I'll have a look as a follow up 👍

utils/cyclonedx/src/main/kotlin/BomObjectLocator.kt

utils/cyclonedx/src/main/kotlin/ComponentExtensions.kt

plugins/package-managers/mix/src/main/kotlin/Mix.kt

plugins/package-managers/mix/src/main/kotlin/MixSbomCommand.kt

plugins/package-managers/rebar3/src/funTest/kotlin/Rebar3FunTest.kt

plugins/package-managers/rebar3/src/main/kotlin/Rebar3.kt

Install mix_sbom binary with sigstore signature verification using cosign. Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

Install rebar3_sbom binary using the bombom wrapper with sigstore signature verification using cosign, Co-authored-by: Jonatan Männchen<jonatan@maennchen.ch> Signed-off-by: GwendalLaurent <gwendal.laurent@stritzinger.com>

Add a new utils/cyclonedx module that provides reusable functionality for analyzing CycloneDX SBOMs. This enables multiple package managers to analyze CycloneDX SBOMs by extending the shared CycloneDxPackageManager class. The new module includes: - CycloneDxPackageManager abstract base class for SBOM analysis - CycloneDxSbom for parsing CycloneDX JSON files - CycloneDxDependencyHandler for dependency translation - CycloneDxDependency for dependency representation - Comprehensive test coverage for CycloneDX utilities Relates to oss-review-toolkit#9878. Co-authored-by: Barbara Chassoul <barbara.chassoul@stritzinger.com> Co-authored-by: Jonatan Männchen<jonatan@maennchen.ch> Signed-off-by: IciaC <iciacarrobarallobre@gmail.com>

Signed-off-by: Barbara Chassoul <barbara.chassoul@stritzinger.com>

Add support for analyzing Elixir projects using mix_sbom for CycloneDX SBOM generation. Supports single projects and umbrella workspaces with proper handling of Hex packages. Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

Add support for analyzing Erlang projects using bombom for CycloneDX SBOM generation. Supports single projects with proper handling of Hex packages. Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

Add Mix and Rebar3 to the list of known package managers in the analyzer configuration and JSON schema. Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

Add Mix & Rebar3 to the analyzer documentation listing supported package managers. Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

model/src/main/kotlin/utils/PurlUtils.kt

+    /**
+     * Get the type as a [PurlType] enum, or null if the type is unknown.
+     */
+    fun getPurlType(): PurlType? = runCatching { PurlType.fromString(type.lowercase()) }.getOrNull()


maennchen requested a review from a team as a code owner January 15, 2026 19:47

github-advanced-security bot found potential problems Jan 15, 2026

View reviewed changes

maennchen force-pushed the sosef/m7 branch 2 times, most recently from bf91d9a to 0bb4a3d Compare January 15, 2026 20:10

maennchen requested a review from a team as a code owner January 15, 2026 21:48

This was referenced Jan 16, 2026

Add Software Bill of Materials guide to the Documentation elixir-lang/elixir#15067

Draft

Use ORT to generate SBoM instead of REUSE erlef/mix_sbom#75

Draft

maennchen force-pushed the sosef/m7 branch 4 times, most recently from 84e8b2c to e1a06b7 Compare January 19, 2026 00:41

This was referenced Jan 19, 2026

M7: Build an ORT Analyzer Plugin which ingests SBoM Information generated by Milestone 5 & 6 and maps to ORT internal data structures stritzinger/sosef#7

Open

M7 Master PR stritzinger/ort#4

Closed

maennchen force-pushed the sosef/m7 branch from e1a06b7 to aefc1e1 Compare January 20, 2026 10:04

github-advanced-security bot found potential problems Jan 20, 2026

View reviewed changes

maennchen force-pushed the sosef/m7 branch from aefc1e1 to fc50b2d Compare January 20, 2026 10:54

maennchen force-pushed the sosef/m7 branch from fc50b2d to 45f39a3 Compare January 20, 2026 10:56

IciaCarroBarallobre mentioned this pull request Jan 20, 2026

Include the sbom plugin as recommended tsloughter/rebar3.org#139

Open

3 tasks

maennchen force-pushed the sosef/m7 branch 2 times, most recently from 6a17bd0 to df42b18 Compare January 21, 2026 23:04

maennchen mentioned this pull request Jan 26, 2026

Optimize Docker Images #11368

Merged

maennchen force-pushed the sosef/m7 branch from df42b18 to 48ca8a8 Compare January 26, 2026 13:02

This was referenced Jan 26, 2026

Tool name: mix_sbom aboutcode-org/workshop#80

Open

Tool name: rebar3_sbom aboutcode-org/workshop#81

Open

maennchen force-pushed the sosef/m7 branch from 48ca8a8 to f7cdd50 Compare January 26, 2026 16:55

maennchen force-pushed the sosef/m7 branch from f7cdd50 to bada8c3 Compare February 7, 2026 14:29

sschuberth self-assigned this Feb 8, 2026

sschuberth requested changes Feb 9, 2026

View reviewed changes

maennchen and others added 2 commits February 10, 2026 17:55

feat(docker): Add mix_sbom for Elixir SBOM generation

b9be915

Install mix_sbom binary with sigstore signature verification using cosign. Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

feat(docker): Add rebar3_sbom for Erlang SBOM generation

c0a10bc

Install rebar3_sbom binary using the bombom wrapper with sigstore signature verification using cosign, Co-authored-by: Jonatan Männchen<jonatan@maennchen.ch> Signed-off-by: GwendalLaurent <gwendal.laurent@stritzinger.com>

maennchen force-pushed the sosef/m7 branch from bada8c3 to 42f781c Compare February 10, 2026 16:56

IciaCarroBarallobre and others added 7 commits February 10, 2026 18:01

feat(utils): Map purlType to the corresponding ORT identifier

1a4af56

Signed-off-by: Barbara Chassoul <barbara.chassoul@stritzinger.com>

feat(utils): Parse a Package URL string into its components

6690d02

Signed-off-by: Barbara Chassoul <barbara.chassoul@stritzinger.com>

feat(analyzer): Add Rebar3 package manager plugin for Erlang

f13d4d7

Add support for analyzing Erlang projects using bombom for CycloneDX SBOM generation. Supports single projects with proper handling of Hex packages. Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

chore(analyzer): Register Mix & Rebar3 package manager plugins

3b391d3

Add Mix and Rebar3 to the list of known package managers in the analyzer configuration and JSON schema. Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

docs: Add Mix & Rebar3 to supported package managers list

4fc12f4

Add Mix & Rebar3 to the analyzer documentation listing supported package managers. Signed-off-by: Jonatan Männchen <jonatan@maennchen.ch>

maennchen force-pushed the sosef/m7 branch from 42f781c to 4fc12f4 Compare February 10, 2026 17:02

github-advanced-security bot found potential problems Feb 10, 2026

View reviewed changes


		ENV MIX_SBOM_HOME=/opt/mix_sbom

		# Download cosign binary, verify mix_sbom binary signature, then clean up

Erlang & Elixir Package Manager Plugins #11319

Are you sure you want to change the base?

Erlang & Elixir Package Manager Plugins #11319

Conversation

maennchen commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Check warning

Check warning

Check warning

Uh oh!

codecov bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sschuberth commented Jan 19, 2026

Uh oh!

maennchen commented Jan 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

maennchen commented Jan 20, 2026

Uh oh!

sschuberth Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

sschuberth Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

maennchen Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

sschuberth Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

maennchen Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

sschuberth Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

maennchen Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

maennchen commented Jan 15, 2026 •

edited

Loading

codecov bot commented Jan 15, 2026 •

edited

Loading