From d390a462d3c100cf13cccd325329f9425465a081 Mon Sep 17 00:00:00 2001
From: Tatu Saloranta <tatu.saloranta@iki.fi>
Date: Tue, 29 Apr 2025 17:06:12 -0700
Subject: [PATCH 1/2] JSTEP-14: Add SBOM generation, publishing (#579)

---
 avro/pom.xml     | 11 +++++------
 cbor/pom.xml     | 11 +++++------
 ion/pom.xml      | 12 +++++-------
 pom.xml          | 11 +++++------
 protobuf/pom.xml | 18 ++++++++----------
 smile/pom.xml    | 11 +++++------
 6 files changed, 33 insertions(+), 41 deletions(-)

diff --git a/avro/pom.xml b/avro/pom.xml
index 7ef4189d9..f6f856c2d 100644
--- a/avro/pom.xml
+++ b/avro/pom.xml
@@ -79,12 +79,11 @@ abstractions.
       <plugin><!-- Inherited from oss-base. Generate PackageVersion.java.-->
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
-        <executions>
-          <execution>
-            <id>process-packageVersion</id>
-            <phase>generate-sources</phase>
-          </execution>
-        </executions>
+      </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
       </plugin>
       <!--  19-Mar-2019, tatu: Add rudimentary JDK9+ module info. To build with JDK 8
              will have to use `moduleInfoFile` as anything else requires JDK 9+
diff --git a/cbor/pom.xml b/cbor/pom.xml
index 95f28be2a..81c1c61ce 100644
--- a/cbor/pom.xml
+++ b/cbor/pom.xml
@@ -59,12 +59,11 @@ encoded data using Jackson abstractions (streaming API, data binding, tree model
         <!-- Inherited from oss-base. Generate PackageVersion.java.-->
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
-        <executions>
-          <execution>
-            <id>process-packageVersion</id>
-            <phase>generate-sources</phase>
-          </execution>
-        </executions>
+      </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
       </plugin>
       <!--  19-Mar-2019, tatu: Add rudimentary JDK9+ module info. To build with JDK 8
              will have to use `moduleInfoFile` as anything else requires JDK 9+
diff --git a/ion/pom.xml b/ion/pom.xml
index 14ae5f9d9..a10664e2f 100644
--- a/ion/pom.xml
+++ b/ion/pom.xml
@@ -11,7 +11,6 @@
     <artifactId>jackson-dataformats-binary</artifactId>
     <version>2.20.0-SNAPSHOT</version>
   </parent>
-  <groupId>com.fasterxml.jackson.dataformat</groupId>
   <artifactId>jackson-dataformat-ion</artifactId>
   <name>Jackson dataformat: Ion</name>
   <packaging>jar</packaging>
@@ -72,12 +71,11 @@ tree model)
         <!-- Inherited from oss-base. Generate PackageVersion.java.-->
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
-        <executions>
-          <execution>
-            <id>process-packageVersion</id>
-            <phase>generate-sources</phase>
-          </execution>
-        </executions>
+      </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
       </plugin>
       <!--  19-Mar-2019, tatu: Add rudimentary JDK9+ module info. To build with JDK 8
             will have to use `moduleInfoFile` as anything else requires JDK 9+
diff --git a/pom.xml b/pom.xml
index 54cc2509f..211b2ab53 100644
--- a/pom.xml
+++ b/pom.xml
@@ -35,7 +35,7 @@
     <connection>scm:git:git@github.com:FasterXML/jackson-dataformats-binary.git</connection>
     <developerConnection>scm:git:git@github.com:FasterXML/jackson-dataformats-binary.git</developerConnection>
     <url>https://github.com/FasterXML/jackson-dataformats-binary</url>
-    <tag>jackson-dataformats-binary-2.19.0</tag>
+    <tag>HEAD</tag>
   </scm>
   <issueManagement>
     <url>https://github.com/FasterXML/jackson-dataformats-binary/issues</url>
@@ -90,18 +90,17 @@
   <build>
     <pluginManagement>
       <plugins>
-	<plugin>
-	  <!-- Inherited from oss-base. Generate PackageVersion.java.-->
+	   <plugin>
+	     <!-- Inherited from oss-base. Generate PackageVersion.java.-->
           <groupId>com.google.code.maven-replacer-plugin</groupId>
           <artifactId>replacer</artifactId>
-	  <executions>
+	     <executions>
             <execution>
               <id>process-packageVersion</id>
               <phase>generate-sources</phase>
             </execution>
           </executions>
-	</plugin>
-
+	   </plugin>
       </plugins>
     </pluginManagement>
   </build>
diff --git a/protobuf/pom.xml b/protobuf/pom.xml
index 47f0044fc..f60575ee4 100644
--- a/protobuf/pom.xml
+++ b/protobuf/pom.xml
@@ -63,19 +63,17 @@ abstractions.
   </dependencies>
 
   <build>
-   <plugins>
-     <plugin>
+    <plugins>
+      <plugin>
        <!-- Inherited from oss-base. Generate PackageVersion.java.-->
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
-        <executions>
-          <execution>
-            <id>process-packageVersion</id>
-            <phase>generate-sources</phase>
-          </execution>
-        </executions>
-     </plugin>
-
+      </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+      </plugin>
       <plugin>
         <!--  We will shade proto-parser, to simplify deployment, avoid version conflicts -->
         <groupId>org.apache.maven.plugins</groupId>
diff --git a/smile/pom.xml b/smile/pom.xml
index 85fedcd35..c3fcf9528 100644
--- a/smile/pom.xml
+++ b/smile/pom.xml
@@ -77,12 +77,11 @@ tree model)
         <!-- Inherited from oss-base. Generate PackageVersion.java.-->
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
-        <executions>
-          <execution>
-            <id>process-packageVersion</id>
-            <phase>generate-sources</phase>
-          </execution>
-        </executions>
+      </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
       </plugin>
       <!-- 19-Mar-2019, tatu: Add rudimentary JDK9+ module info. To build with JDK 8
              will have to use `moduleInfoFile` as anything else requires JDK 9+

From 27bf29f2b39ce575b90522a081b0c2e263359d70 Mon Sep 17 00:00:00 2001
From: Tatu Saloranta <tatu.saloranta@iki.fi>
Date: Tue, 29 Apr 2025 17:09:11 -0700
Subject: [PATCH 2/2] Merge JSTEP-15 (sbom publishing) changes from 2.x

---
 avro/pom.xml     | 5 +++++
 cbor/pom.xml     | 5 +++++
 ion/pom.xml      | 5 +++++
 protobuf/pom.xml | 5 +++++
 smile/pom.xml    | 5 +++++
 5 files changed, 25 insertions(+)

diff --git a/avro/pom.xml b/avro/pom.xml
index ace8caedd..0fd6dd456 100644
--- a/avro/pom.xml
+++ b/avro/pom.xml
@@ -72,6 +72,11 @@ abstractions.
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
       </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+      </plugin>
       <!-- 05-Jul-2020, tatu: Add generation of Gradle Module Metadata -->
       <!-- 28-Feb-2025, jjohannes: Apply plugin last as it has to be the last of all 'package phase' plugins -->
       <plugin>
diff --git a/cbor/pom.xml b/cbor/pom.xml
index 73582fcaa..0bcba89d6 100644
--- a/cbor/pom.xml
+++ b/cbor/pom.xml
@@ -47,6 +47,11 @@ encoded data using Jackson abstractions (streaming API, data binding, tree model
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
       </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+      </plugin>
       <!-- 05-Jul-2020, tatu: Add generation of Gradle Module Metadata -->
       <!-- 28-Feb-2025, jjohannes: Apply plugin last as it has to be the last of all 'package phase' plugins -->
       <plugin>
diff --git a/ion/pom.xml b/ion/pom.xml
index d27712a32..f47c4130e 100644
--- a/ion/pom.xml
+++ b/ion/pom.xml
@@ -58,6 +58,11 @@ tree model)
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
       </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+      </plugin>
       <!-- 05-Jul-2020, tatu: Add generation of Gradle Module Metadata -->
       <!-- 28-Feb-2025, jjohannes: Apply plugin last as it has to be the last of all 'package phase' plugins -->
       <plugin>
diff --git a/protobuf/pom.xml b/protobuf/pom.xml
index 78097c0bb..35fe243b9 100644
--- a/protobuf/pom.xml
+++ b/protobuf/pom.xml
@@ -52,6 +52,11 @@ abstractions.
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
      </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+      </plugin>
       <!-- 05-Jul-2020, tatu: Add generation of Gradle Module Metadata -->
       <!-- 28-Feb-2025, jjohannes: Apply plugin last as it has to be the last of all 'package phase' plugins -->
       <plugin>
diff --git a/smile/pom.xml b/smile/pom.xml
index 5586137cb..73dcf601d 100644
--- a/smile/pom.xml
+++ b/smile/pom.xml
@@ -64,6 +64,11 @@ tree model)
         <groupId>com.google.code.maven-replacer-plugin</groupId>
         <artifactId>replacer</artifactId>
       </plugin>
+      <!-- 29-Apr-2025, tatu: SBOM generation [JSTEP-14] -->
+      <plugin>
+        <groupId>org.cyclonedx</groupId>
+        <artifactId>cyclonedx-maven-plugin</artifactId>
+      </plugin>
       <!-- 05-Jul-2020, tatu: Add generation of Gradle Module Metadata -->
       <!-- 28-Feb-2025, jjohannes: Apply plugin last as it has to be the last of all 'package phase' plugins -->
       <plugin>