init `cdx:maven` taxonomy with existing properties #69

hboutemy · 2023-07-31T20:46:35Z

fixes #68 with existing properties added in cyclonedx-maven-plugin 2.7.7 and 2.7.9
once this is done, we'll add new properties later

cdx/maven.md

hboutemy · 2023-08-02T06:30:44Z

thanks for the feedback: I improved the taxonomy

I have one question: I named the taxonomy cdx:maven:package to mimic other taxonomies in this repository, but wouldn't it be better named cdx:maven:metadata to match CycloneDX schema element?

jkowalleck · 2023-08-02T11:24:40Z

re #69 (comment)

The xxx:package:yyy were chosen as the properties describe a package or component.
Looking into the details of your taxonomy description, I get the idea that your properties describe build processes or formulation, others describe the BOM generation process itself.
You probably want to rename the properties, so it is clear in which domain they shall be used and what they describe.

I am not familiar with maven dependency management, you should gather feedback from your peers :D
Here are my 2 cents

cdx:maven:package:goal -- this is not maven specific but implementation specific for cyclonedx-maven-plugin, i do not have any idea which category this might belong
cdx:maven:package:reproducible -- is not maven specific. this could be a general cdx:bom:reproducible property. CC @stevespringett @CycloneDX/core-team

I am not familiar with maven dependency management, you should gather feedback from your peers :D

hboutemy · 2023-08-03T11:44:43Z

The xxx:package:yyy were chosen as the properties describe a package or component.

this way of describing hides if the "package or component" is the output of the build or if it's a dependency (or even a tool)

Looking into the details of your taxonomy description, I get the idea that your properties describe build processes or formulation, others describe the BOM generation process itself.

everything for the moment describes the BOM generation process itself, then it's natural that all go into one single namespace: FYI, here is the current cyclonedx-maven-plugin output gefore mugrating to the official taxonomy that this PR is trying to create https://gist.github.com/hboutemy/e9bed6b890e10450a8410f317e8d6e07

does it describe the package or something else, then how should it be named is my question: I did not try to execute other tools in other technologies to see where they used their xxx:package:yyy taxonomy

cdx:maven:package:reproducible -- is not maven specific. this could be a general cdx:bom:reproducible property.

AFAIK, CycloneDX is inheritently against Reproducible Builds (because it expects the build timestamp to be stored): the feature is currently Maven specific, as it drops the usual timestamp (that has no real meaning in that case)

For now, I prefer keeping that Maven specific: we'll see later if moving to a more common taxonomy makes sense

stevespringett · 2023-08-06T21:26:13Z

AFAIK, CycloneDX is inheritently against Reproducible Builds (because it expects the build timestamp to be stored)

Timestamp is required per NTIA Minimum Elements. The team is not against reproducible builds, although they do very little to increase assurance, especially with Maven and similar ecosystems. This is being demoed at BlackHat this week. We should likely keep reproducible out of Maven specifically and have it somewhere else thats common.

We should likely change the following:

{
  "name" : "maven.scopes",
  "value" : "compile,provided,runtime,system"
}

to

{
  "name" : "cdx:maven:package:scope",
  "value" : "compile"
}
{
  "name" : "cdx:maven:package:scope",
  "value" : "provided"
}
{
  "name" : "cdx:maven:package:scope",
  "value" : "runtime"
}
{
  "name" : "cdx:maven:package:scope",
  "value" : "system"
}

This would automatically form an array for many parsers and implementations would not have to parse value to separate out the scopes.

jkowalleck · 2023-08-07T10:50:36Z

We should likely keep reproducible out of Maven specifically and have it somewhere else thats common.

let's have a boolean property cdx:reproducible in https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/main/cdx.md

--

some other implementations that can generate “reproducible” BOMs, by omitting time- and random-based values, ordering elements, and so on already exist. they just dont add a property to the BOM, yet.

i wonder where this property should be applied, then.
I find bom.metadata.properties a good spot, because it exists since CDX1.3

hboutemy · 2023-08-12T20:10:06Z

yes, bom.metadata.properties is where I store the fact that the BOM is expected to be reproducible

once the cdx:reproducible property will have been registered, I'll update this PR to drop the Maven-specific one

jkowalleck · 2023-08-13T07:51:19Z

yes, bom.metadata.properties is where I store the fact that the BOM is expected to be reproducible

once the cdx:reproducible property will have been registered, I'll update this PR to drop the Maven-specific one

just opened #70
to request a cdx:reproducible

jkowalleck · 2023-08-20T07:09:58Z

cdx/maven.md

+
+| Property | Description |
+| -------- | ----------- |
+| `cdx:maven:package:goal` | The goal used to generate the SBOM: `makeBom`, `makeAggregateBom` or `makePackageBom`. May appear once. |


Please help me understand: Would other tools that generate SBOMs from maven use these values, too?

are these values well-known to maven?

Is there maybe an online documentation for these values, so people know what they mean?

this notion of goal is specific to Maven, and well known for any Maven user
the list of goals is in plugins' documentation https://github.com/CycloneDX/cyclonedx-maven-plugin#goals
I'm not convinced adding a link gives great value, but I can add it to the "goal" term in the sentence

I'm not convinced adding a link gives great value, but I can add it to the "goal" term in the sentence

it does. A SecOps person might not know any maven nor java, but they know SBOM and they would want to know what this value means and where to read about it, so they can judge the value of an SBOM.

[...] well known for any Maven user

for ANY user? Or maybe only for users of cyclonedx-maven-plugin, since these goals are only available when this plugin is used?
I was unable to find anything regarding these goals/values, outside the context of cyclonedx-maven-plugin. I am not convinced that this property is global/broad enough. I still think it is specific for cyclonedx-maven-plugin`, and other SBOM tools would not use it nor recognize it at all. Could you help me understand why I am wrong?

you're right, I over-focused on SBOM producer, who is a Maven user, knowing Maven concepts and how to look for this plugin specific details that match usual Maven concepts
but SBOM is much about consumers, and here, the diversity in culture is really wide
Notice that without waiting, I already added the documentation on goals while doing the suggested link to Maven scopes in c9aac68: it's easy to do and maintain, then it's worth the tiny effort :)

regarding SBOM generators: is this property specific to cyclonedx-maven-plugin?
In reverse: would other SBOM generators, something that is not a maven plugin - like trivy or cdxgen, also be able to use this property?

If this property is only relevant for users of cyclonedx-maven-plugin,
then you should document the property in the readme of cyclonedx-maven-plugin, not here.

given other pipenv and poetry existing taxonomies, I'm surprised: AFAIK, they share the same ecosystem, isn't it?

Most python-based ecosystem have https://pypi.org/ as a package source.
Pipenv and poetry have completely own wordings, definitions, workflows.

for npm, composer and maven, it's not clear if it's ecosystem names or build tool names

NPM: names are directly derived from npm(the CLI tool)-internals

Composer: names are directly derived from composer(the CLI tool)-internals

Pipenv and poetry have completely own wordings, definitions, workflows.

same for Maven vs Gradle vs sbt vs ... build tools that use the Maven ecosystem (package sources)

the only difference is that "Maven" term is both an ecosystem and a specific build tool

But I don't see how Pipenv and Poetry have "properties documented [] meant to be implementation-independent, ecosystem-oriented."

For npm, it's not clear if it's "npm the ecosystem", that is for example npmjs.com, or npm the build tool only, ignoring how yarn, pnpm, or other build tools that use the same package do their SBOMs

On Composer, I don't know if there are build tools that are built on top of the ecosystem that the original Composer build tool created

I'm really confused: I don't know if I'm loosing my time trying to create this Maven taxonomy or not
What is clear is that all properties that I'm requiring are specific to Maven the build tool, because other tools use the ecosystem in a different way from a dependency management strategy = what the SBOM is much about

just remove cdx:maven:package:goal and this PR is done.
additional properties can be added later.

PS: i will not react to all your points, so you are not loosing any time reading them.

I don't know if I'm loosing my time trying to create this Maven taxonomy or not.

If you have a question related to other taxonomies, feel free to create a ticket for them.

just remove cdx:maven:package:goal and this PR is done.

cdx:maven:package:optional-unused is very very cyclonedx-maven-plugin specific: then this is the first to be removed also

cdx:maven:package:scope is Maven build tool specific: perhaps it's the only one that may make sense in this PR IIUC

then lets keep the general usable property for now.
if any of the others appear to have a common ground, then they can be added back.
How does this sound?

cdx/maven.md

fixes CycloneDX#68 Signed-off-by: Hervé Boutemy <hboutemy@apache.org>

Signed-off-by: Hervé Boutemy <hboutemy@apache.org>

jkowalleck · 2023-11-02T15:26:11Z

@hboutemy sorry for my very late reply.
what is the status of this PR? should it be merged as is? or do you want to add/change something?

hboutemy · 2023-11-04T16:50:03Z

time passed, re-reading the discussions
it seems the remaining properties from the proposed taxonomy are completely Apache Maven build tool specific, then don't really make any interest to get them shared outside of cyclonedx-maven-plugin
i think this PR can be closed now: we extracted the most useful part = cdx:reproducible

hboutemy requested a review from a team as a code owner July 31, 2023 20:46

jkowalleck requested changes Jul 31, 2023

View reviewed changes

cdx/maven.md Outdated Show resolved Hide resolved

cdx/maven.md Outdated Show resolved Hide resolved

hboutemy force-pushed the maven branch from 02e3cdb to 7435570 Compare August 2, 2023 06:31

jkowalleck requested review from stevespringett and a team August 2, 2023 11:25

jkowalleck mentioned this pull request Aug 13, 2023

add property cdx:reproducible #70

Merged

jkowalleck added the enhancement New feature or request label Aug 13, 2023

jkowalleck self-requested a review August 13, 2023 21:17

jkowalleck reviewed Aug 20, 2023

View reviewed changes

hboutemy added 4 commits August 22, 2023 08:35

init maven taxonomy with existing properties

7b80e70

fixes CycloneDX#68 Signed-off-by: Hervé Boutemy <hboutemy@apache.org>

improve multi-value and boolean descriptions

8ac1c45

Signed-off-by: Hervé Boutemy <hboutemy@apache.org>

drop Maven-specific reproducible, use CycloneDX#70

689638e

Signed-off-by: Hervé Boutemy <hboutemy@apache.org>

add links to reference documentation

4735465

Signed-off-by: Hervé Boutemy <hboutemy@apache.org>

hboutemy force-pushed the maven branch from c9aac68 to 4735465 Compare August 22, 2023 06:35

hboutemy closed this Nov 4, 2023

jkowalleck mentioned this pull request Apr 18, 2024

Proposal to implement Maven CycloneDX Property Taxonomy #68

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

init `cdx:maven` taxonomy with existing properties #69

init `cdx:maven` taxonomy with existing properties #69

hboutemy commented Jul 31, 2023

hboutemy commented Aug 2, 2023

jkowalleck commented Aug 2, 2023 •

edited

Loading

hboutemy commented Aug 3, 2023 •

edited

Loading

stevespringett commented Aug 6, 2023

jkowalleck commented Aug 7, 2023 •

edited

Loading

hboutemy commented Aug 12, 2023

jkowalleck commented Aug 13, 2023 •

edited

Loading

jkowalleck Aug 20, 2023

hboutemy Aug 21, 2023

jkowalleck Aug 22, 2023

hboutemy Aug 22, 2023 •

edited

Loading

jkowalleck Aug 22, 2023 •

edited

Loading

jkowalleck Aug 24, 2023

hboutemy Aug 24, 2023

jkowalleck Aug 24, 2023 •

edited

Loading

hboutemy Aug 24, 2023

jkowalleck Aug 26, 2023

jkowalleck commented Nov 2, 2023

hboutemy commented Nov 4, 2023

init cdx:maven taxonomy with existing properties #69

init cdx:maven taxonomy with existing properties #69

Conversation

hboutemy commented Jul 31, 2023

hboutemy commented Aug 2, 2023

jkowalleck commented Aug 2, 2023 • edited Loading

hboutemy commented Aug 3, 2023 • edited Loading

stevespringett commented Aug 6, 2023

jkowalleck commented Aug 7, 2023 • edited Loading

hboutemy commented Aug 12, 2023

jkowalleck commented Aug 13, 2023 • edited Loading

jkowalleck Aug 20, 2023

Choose a reason for hiding this comment

hboutemy Aug 21, 2023

Choose a reason for hiding this comment

jkowalleck Aug 22, 2023

Choose a reason for hiding this comment

hboutemy Aug 22, 2023 • edited Loading

Choose a reason for hiding this comment

jkowalleck Aug 22, 2023 • edited Loading

Choose a reason for hiding this comment

jkowalleck Aug 24, 2023

Choose a reason for hiding this comment

hboutemy Aug 24, 2023

Choose a reason for hiding this comment

jkowalleck Aug 24, 2023 • edited Loading

Choose a reason for hiding this comment

hboutemy Aug 24, 2023

Choose a reason for hiding this comment

jkowalleck Aug 26, 2023

Choose a reason for hiding this comment

jkowalleck commented Nov 2, 2023

hboutemy commented Nov 4, 2023

init `cdx:maven` taxonomy with existing properties #69

init `cdx:maven` taxonomy with existing properties #69

jkowalleck commented Aug 2, 2023 •

edited

Loading

hboutemy commented Aug 3, 2023 •

edited

Loading

jkowalleck commented Aug 7, 2023 •

edited

Loading

jkowalleck commented Aug 13, 2023 •

edited

Loading

hboutemy Aug 22, 2023 •

edited

Loading

jkowalleck Aug 22, 2023 •

edited

Loading

jkowalleck Aug 24, 2023 •

edited

Loading