You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When publishing a build containing the ‘runtimeOnly’ dependency configuration in the ‘build.gradle’ file, the dependency is not reflected in the build-info.
Without listing these dependencies in the build info, we're missing the concept of SBOM (Software Bill of Materials), which is a comprehensive inventory of all third-party components within a codebase.
The SBOM is a concept that provides a detailed inventory of all third-party components in a codebase. By tracking and managing dependencies, it ensures compliance, and addresses security vulnerabilities. By not including ‘runtimeOnly’ dependencies in the build-info, we miss out on documenting these components, which compromises the integrity of SBOM and limits the ability to fully understand and manage the software's external dependencies.
To Reproduce
Include a dependency with 'runtimeOnly' dependency configuration in the build.gradle file.
Build the project.
Publish to Artifactory using the command ./gradlew artifactoryPublish
See the build-info missing the dependency specified in the 'runtimeOnly' configuration.
Expected behavior
The expected behavior is to that the build-info should list the dependencies specified in the 'runtimeOnly' configuration.
Screenshots
Versions
Extractor version: 5
Operating system: macOS
Artifactory Version: 7.92.1
Additional context
None.
The text was updated successfully, but these errors were encountered:
Describe the bug
When publishing a build containing the ‘runtimeOnly’ dependency configuration in the ‘build.gradle’ file, the dependency is not reflected in the build-info.
Without listing these dependencies in the build info, we're missing the concept of SBOM (Software Bill of Materials), which is a comprehensive inventory of all third-party components within a codebase.
The SBOM is a concept that provides a detailed inventory of all third-party components in a codebase. By tracking and managing dependencies, it ensures compliance, and addresses security vulnerabilities. By not including ‘runtimeOnly’ dependencies in the build-info, we miss out on documenting these components, which compromises the integrity of SBOM and limits the ability to fully understand and manage the software's external dependencies.
To Reproduce
Expected behavior
The expected behavior is to that the build-info should list the dependencies specified in the 'runtimeOnly' configuration.
Screenshots
Versions
Additional context
None.
The text was updated successfully, but these errors were encountered: