CycloneDX / cyclonedx-maven-plugin

Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
https://cyclonedx.org/
Apache License 2.0
297 stars 84 forks source link

[WARNING] Unknown keyword meta:[enum|deprecated] - you should define your own Meta Schema #564

Open garydgregory opened 2 weeks ago

garydgregory commented 2 weeks ago

Hi All,

What am I supposed to do with these warnings:

[INFO] --- cyclonedx:2.9.0:makeAggregateBom (build-sbom-cyclonedx) @ commons-cli ---
[INFO] CycloneDX: Resolving Dependencies
[INFO] CycloneDX: Creating BOM version 1.6 with 0 component(s)
[INFO] CycloneDX: Writing and validating BOM (XML): /Users/garydgregory/git/commons-cli/target/commons-cli-1.9.1-SNAPSHOT-bom.xml
[INFO]            attaching as commons-cli-1.9.1-SNAPSHOT-cyclonedx.xml
[INFO] CycloneDX: Writing and validating BOM (JSON): /Users/garydgregory/git/commons-cli/target/commons-cli-1.9.1-SNAPSHOT-bom.json
[WARNING] Unknown keyword meta:enum - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword or if it should generate annotations AnnotationKeyword
[WARNING] Unknown keyword deprecated - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword or if it should generate annotations AnnotationKeyword
[INFO]            attaching as commons-cli-1.9.1-SNAPSHOT-cyclonedx.json
?

Reproducer:

git clone https://gitbox.apache.org/repos/asf/commons-cli
cd commons-cli
mvn clean verify -Dcommons.cyclonedx.version=2.9.0 -DskipTest

TY

hboutemy commented 1 week ago

thanks for the report: it seems #305 is going worse, with root cause https://github.com/CycloneDX/cyclonedx-core-java/issues/280

notice it seems the precise keyword issue from #305 seems to have been fixed by cyclonedx-core-java, but new similar issues addeed

I confess I opened https://github.com/CycloneDX/cyclonedx-core-java/issues/280 but I did not try to help fixing: this is definitively the project requiring additional love...