Re: Ivy in CycloneDX Antlib

On 2026-08-07, Stefan Bodewig wrote:

> Some differences are easy to explain and I'm fine with them:

> * jackson-core's SBOM lists a dependency on fastdoubleparser that is
>   actually shaded away by Maven and not visible in the POM (and thus not
>   visible to Ivy)

> * Ivy's own SBOM contains all optional dependencies - since
>   ant-antlibs-cyclondedx doesn't depend on the optional dependencies
>   they don't appear in the "new" SBOM.

> * the Maven generated SBOMs contain publisher fields and external
>   references that are (currently not available) from Ivy files.

> * licenses uses names instead of SPDX ids

> But there are differences I'm not happy with and which must be related
> to the way I identify dependencies.

> In the Ivy generated SBOM ivy doesn't seem to depend on Ant and
> commons-collections doesn't seem to depend on commons-codec anymore. I
> believe this is because the Antlib directly depends on them.

In the case of commons-collections this is because commons-collections'
dependency on commons-codec is optional in 4.5.0.

The same is true for Ivy's dependency on Ant which is also optional - at
least as far as the POM is concerned, I'm not sure this is true in
reality.

So these are the second cases of the "I'm fine with" list and I now
believe the code does what it is supposed to do. I still need to write
tests and document it.

I'd be grateful if people who know more about Ivy than I do could look
over
https://github.com/apache/ant-antlibs-cyclonedx/blob/support-ivy-as-component-source/src/main/org/apache/ant/cyclonedx/IvyModuleComponentResolver.java
and tell me what could be done better or what just works because the
only thing I have tested it on so far has been something simple.

Stefan