Skip to content

Generate an SBOM #824

Open
Feature
#845
Open
Generate an SBOM#824
Feature
#845
Labels
build/environmentCategorizes an issue or PR relevant to the build environment.good first issueDenotes an issue ready for a new contributorhelp wantedDenotes an issue that needs help from a contributor.kind/wishCategorizes issue or PR as a wish.

Description

@pnoltes
pnoltes
opened on Feb 7, 2026

Update the CI to generate a Software Bill of Materials (SBOM) as part of the ASF Celix CI pipeline.

Notes / Open questions

  • We currently do not commit conan.lock to SCM
    • Should the lockfile be generated in CI and used for SBOM generation?
  • Which SBOM gen technology to use (cdxgen, sbomify, etc)?

It is ok to provide a proposal in a pull request.
Contributions, tooling suggestions, and prior experience are very welcome.

Expected outcome

  • CI job that generates an SBOM
  • SBOM published as a CI artifact
  • Short documentation describing: how the SBOM is generates

Activity

  1. pnoltes
    added a parent issue on Feb 7, 2026
  2. pnoltes
    added
    help wantedDenotes an issue that needs help from a contributor.
    build/environmentCategorizes an issue or PR relevant to the build environment.
    good first issueDenotes an issue ready for a new contributor
    kind/wishCategorizes issue or PR as a wish.
    on Feb 7, 2026
  3. pnoltes
    added the
    Task
    issue type on Feb 7, 2026
  4. pnoltes
    changed the issue type from
    Task
    to
    Feature
    on Feb 7, 2026

  5. PengZheng commented on Mar 12, 2026

    @PengZheng
    PengZheng
    on Mar 12, 2026
    Contributor
    Should the lockfile be generated in CI and used for SBOM generation?

    Yes, and Conan 2.x can generate SBOM for us, which saves us from the second question:

    Which SBOM gen technology to use (cdxgen, sbomify, etc)?

  6. mcc0nnell
    added a commit that references this issue on Aug 27, 2026

    Add Conan CycloneDX SBOM generation in CI

    44bf293
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    build/environmentCategorizes an issue or PR relevant to the build environment.good first issueDenotes an issue ready for a new contributorhelp wantedDenotes an issue that needs help from a contributor.kind/wishCategorizes issue or PR as a wish.

    Type

    Feature

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions