sbomLink ComponentResolver

Enriches a component by reading an existing CycloneDX SBOM.

At most one resource can be specified as nested element which is then read as CycloneDX SBOM and enriches the component that contains this ComponentResolver:

• type, name, group, version, purl, bomRef, scope, decription, publisher, copright, mimeType and supplier are taken from the SBOM's metadata component unless they are explicitly specified on the component element itself.
• manufacturer is taken from the SBOM's metadata component unless it is explicitly specified on the component element itself or supplierismanufacturer is true.
• Tags are merged with those of the SBOM's metadata component.
• authors, licenses, externalReferences, dependencys and nested components are taken from the SBOM's metadata component if and only if there is no corresponding element in this component element.
• a "bom"-type externalReference is added to the enclosing component if the nested resource provides an URL, the enclosing component doesn't already contain externalReferences, the parsed SBOM doesn't already contain such an externalReference and this element's createBomExternalReference is not false.
• Hashes of the linked SBOM are ignored completely.
• Other components specified in the linked SBOM are also added to the SBOM created by the compomentbom task if they are direct dependencies of the current component element. And their dependencies are set to "unknown" as handling of transitive dependencies is beyond the scope of this library.
  Components specified explicitly in the SBOM take precedence over those found by parsing an SBOM link. If there already exists a component as part of the SBOM with the same name and group as one read from the linked SBOM, the linked component will be ignored. Here the version is ignored, it is assumed the component explicitly specified is the result of a process that resolved conflicts in dependency versions. Currently this only applies to Components with pkg:maven/ Package-URLs as bom-ref.

The CycloneDX Core (Java) library is used to read the linked SBOM.

Attributes