Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependencies is 'runtimeOnly' configuration not listed in build-info #800

Open
jordantangy opened this issue Aug 6, 2024 · 0 comments
Open
Labels
bug Create a report to help us improve

Comments

@jordantangy
Copy link

Describe the bug

When publishing a build containing the ‘runtimeOnly’ dependency configuration in the ‘build.gradle’ file, the dependency is not reflected in the build-info.
Without listing these dependencies in the build info, we're missing the concept of SBOM (Software Bill of Materials), which is a comprehensive inventory of all third-party components within a codebase.
The SBOM is a concept that provides a detailed inventory of all third-party components in a codebase. By tracking and managing dependencies, it ensures compliance, and addresses security vulnerabilities. By not including ‘runtimeOnly’ dependencies in the build-info, we miss out on documenting these components, which compromises the integrity of SBOM and limits the ability to fully understand and manage the software's external dependencies.

To Reproduce

  1. Include a dependency with 'runtimeOnly' dependency configuration in the build.gradle file.
  2. Build the project.
  3. Publish to Artifactory using the command ./gradlew artifactoryPublish
  4. See the build-info missing the dependency specified in the 'runtimeOnly' configuration.

Expected behavior

The expected behavior is to that the build-info should list the dependencies specified in the 'runtimeOnly' configuration.

Screenshots

image

Versions

  • Extractor version: 5
  • Operating system: macOS
  • Artifactory Version: 7.92.1

Additional context
None.

@jordantangy jordantangy added the bug Create a report to help us improve label Aug 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Create a report to help us improve
Projects
None yet
Development

No branches or pull requests

1 participant