Some vcs (and website) urls are invalid as a component name is appended

[apupier]

When generating sbom for Apache Camel project, there are several vcs url which are giving a 404.
One pattern that I noticed is:
https://github.com/org/project/sub-project
for instance https://github.com/apache/pulsar/pulsar-client-api

https://github.com/apache/pulsar/pulsar-client-api is giving a 404

I think we should either stay on https://github.com/apache/pulsar
or use the tag https://github.com/apache/pulsar/tree/v4.2.1/pulsar-client-api

the website url is also impacted (but I think it is less important)

see also:

• The Camel sbom: https://github.com/apache/camel/tree/camel-4.20.0/camel-sbom
• The parent bom declaring the project.scm.url https://repo1.maven.org/maven2/org/apache/pulsar/pulsar/4.2.1/pulsar-4.2.1.pom
• from which it should be extracted https://cyclonedx.github.io/cyclonedx-maven-plugin/external-references.html
• Camel issue https://issues.apache.org/jira/browse/CAMEL-23604

[apupier]

another pattern for org.apache.shiro/shiro-jakarta-ee (2.1.0);

https://github.com/apache/shiro/tree/shiro-root-2.1.0/shiro-support/shiro-jakarta-ee

although it should be https://github.com/apache/shiro/tree/shiro-root-2.1.0/support/jakarta-ee

[apupier]

sounds like it is a behavior from Maven Scm.getUrl:

    /**
     * Get the URL to the project's browsable SCM repository, such
     * as ViewVC or Fisheye.
     *             <br><b>Default value is</b>: parent value [+
     * path adjustment] + (artifactId or project.directory
     * property), or just parent value if
     *             scm's
     * <code>child.scm.url.inherit.append.path="false"</code>
     * 
     * @return String
     */

EDIT: example of configuration:

apache/maven@db462ae#diff-0335baa201a96fbce834e8e1368befede4554e64a218054b5131e2ccb171c7e7R40-R47

[apupier]

if i understand well, it is up to all project to specify the mentioned property if they are using Git https://issues.apache.org/jira/browse/MNG-6059

@hboutemy Do you confirm?

[hboutemy]

yes, here is the reference documentation https://maven.apache.org/ref/3.9.16/maven-model-builder/#inheritance-assembly

CycloneDX Maven Plugin uses content from the effective POM = mvn help:effective-pom -Dverbose
You're discovering that your effective POM content is not what you expected

[hboutemy]

notice: you're not the first one to discover that "effective POM" aspect when generating SBOMs with the current plugin
like #394

any idea on where to document that fact for people to understand would be welcome: I know you won't be the last discovering it...