Ivy in CycloneDX Antlib

Hi

by now I've achieved enough that I can show it. It is completely
undocumented, it isn't complete and I believe I don't understand Ivy
well enough (no surprise here).

https://github.com/apache/ant-antlibs-cyclonedx/pull/2

The target create-antlib-sbom-ivy creates an SBOM for the CycloneDX
Antlib using Ivy and one can compare the output to the SBOM we'd create
"the manual" way with the create-antlib-sbom target. The idea is to have
Ivy contribute as much as possible and override/augment it with stuff
the SBOM writer deems important. So I've added the ant and ant-launcher
components myself as Ivy is not able to add proper supplier information
or most of the external links. But Ivy figured out the depencency to the
components.

When comparing the two one will find differences. The "old" SBOM
contains a dependency of jackson-core on
ch.randelshofer/fastdoubleparser - which is what Jackson's SBOM
says. Actually the pom shades away the dependency and Ivy doesn't see
it. I'm not sure who's right here and tend to believe Ivy is - but here
is a difference between "my code" and the maven-cyclondedx-plugin. I've
not analyzed all differences I see.

What is completely missing is hashes for the dependencies. I haven't
spent enough time figuring out how to find the downloaded jar for an
IvyNode of the ResolveReport. If anybody else knows how to do that
faster than I can find it myself, that would be good.

The part where I don't understand Ivy is: Initially I didn't specify any
settingsId and Ivy resolved ivy.xml. After that the ResolveReport
contained AntUnit, which is a test dependency, even though I said
conf="default". Obviously ivyNode.isEvicted(conf) doesn't do what I
believed it would do. Is there an easy way to see whether a dependency
IvyNode that is part of ResolveReport is actually included in the
dependencies of a given set of configurations?

Most probably there are lots of other things that can be improved.

Stefan