CycloneDX file names

[Stefan Bodewig <bo...@apache.org>]

Hi all

the Apache tooling project is working on something that is called
"Apache Trusted Releases" which seems to require CycloneDX SBOMs to use
the .cdx.json as extension[1]. The prior art of the Maven and Gradle
plugins may force them to reconsider but I've started to change things
so we use the convention in the future. Jaikiran has questioned the file
names already and the spec seems to say "use .cdx.json"[2]

Stefan

[1] https://github.com/apache/tooling-trusted-releases/issues/1332
[2] https://cyclonedx.org/specification/overview/#recognized-file-patterns

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org

Re: CycloneDX file names

[Stefan Bodewig <bo...@apache.org>]

On 2026-06-19, Stefan Bodewig wrote:

> the Apache tooling project is working on something that is called
> "Apache Trusted Releases" which seems to require CycloneDX SBOMs to use
> the .cdx.json as extension[1]. The prior art of the Maven and Gradle
> plugins may force them to reconsider but I've started to change things
> so we use the convention in the future.

https://github.com/apache/tooling-trusted-releases/issues/1332#issuecomment-4756893992

now looks as if some-artifact-cyclonedx.json would be supported as
well.

I'm really on the fence WRT how we name the SBOM we publish to Maven
Central, maybe following the conventions used by Maven and Gradle will
help people actually recognizing them.

For the SBOMs of zip, tar.gz and so I'd stick with .cdx.(json|xml) now,
as the standard clearly states this a preference.

Stefan

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org