Proposal to implement Maven CycloneDX Property Taxonomy

[karthika-g]

Hi,

This is a proposal to add a new Namespace for Maven under cdx namespace. For example something like cdx:maven similar to npm.

With this a property to specify the scope of the dependency scope. i.e https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#dependency-scope which can be repreented as cdx:maven:package:scope

[jkowalleck]

caused by https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/384

---

@hboutemy what is your opinion on the new namespace?

[jkowalleck]

would somebody draft a pullrequest for the new namespace? See the existing ones for examples: https://github.com/CycloneDX/cyclonedx-property-taxonomy/tree/main/cdx

we then could discuss changes and additions in the opened pulrequest.

[hboutemy]

We already have created a few properties in previous cyclonedx-maven-plugin without making them formal: I'll need to formalize existing ones and new ones need to be created immediately in the official taxonomy I'll have a look next week, I'm busy for now...

[jkowalleck]

Great. Looking forward to merging your pullrequest. :D

[prabhu]

Maven plugin seems to be using a maven: prefix.

https://github.com/CycloneDX/cyclonedx-maven-plugin/blob/925b04fdd74e4e412e1cc06d7fad9e7a102e329c/src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java#L331

https://github.com/CycloneDX/cyclonedx-property-taxonomy

"properties" : [
      {
        "name" : "maven.goal",
        "value" : "makeAggregateBom"
      },
      {
        "name" : "maven.scopes",
        "value" : "compile,provided,runtime,system,test"
      }
    ]

[jkowalleck]

see discussion here: https://github.com/CycloneDX/cyclonedx-property-taxonomy/pull/69