SPDX SBOM

[redcatbear]

Situation

Our friends at the Eclipse Foundation asked for an SBOM in SPDX v3 format.

This can be created as part of our Maven Build with the SPDX Maven Plugin

Acceptance Criteria

1. Build creates openfasttrace-<version>.spdx3.json for the product
2. SBOM contains all dependencies that are compile-time, runtime or provided
3. Granularity is module level
4. Dependency licenses are correctly listed (where available)5. Releases come with an SPDX SBOM
5. If possible, build should run a validator on the result SBOM

Solution Hint

Use spdx-maven-plugin.

Out-of-Scope

• File-level and snippet-level resolution
• SBOMs for the individual modules (we might add that in a later PR)