diff --git a/.gitignore b/.gitignore index 7232a54..1229602 100644 --- a/.gitignore +++ b/.gitignore @@ -11,6 +11,7 @@ project/plugins/project/ .history .cache .lib/ +.bsp/ ### Scala template *.class diff --git a/README.md b/README.md index cfd5533..910f03a 100644 --- a/README.md +++ b/README.md @@ -51,17 +51,18 @@ The `listBom` command can be used to generate the contents of the BOM without wr ### configuration -| Setting | Type | Default | Description | -|------------------------------|---------|------------------------------------------------------------------------|----------------------------------------------------------------| -| bomFileName | String | `"${artifactId}-${artifactVersion}.bom.xml"` | bom file name | -| bomFormat | String | `json` or `xml`, defaults to the format of bomFileName or else `json` | bom format | -| bomSchemaVersion | String | `"1.6"` | bom schema version | -| includeBomSerialNumber | Boolean | `false` | include serial number in bom | -| includeBomTimestamp | Boolean | `false` | include timestamp in bom | -| includeBomToolVersion | Boolean | `true` | include tool version in bom | -| includeBomHashes | Boolean | `true` | include artifact hashes in bom | -| enableBomSha3Hashes | Boolean | `true` | enable the generation of sha3 hashes (not available on java 8) | -| includeBomExternalReferences | Boolean | `true` | include external references in bom | +| Setting | Type | Default | Description | +|------------------------------|---------|------------------------------------------------------------------------|-----------------------------------------------------------------| +| bomFileName | String | `"${artifactId}-${artifactVersion}.bom.xml"` | bom file name | +| bomFormat | String | `json` or `xml`, defaults to the format of bomFileName or else `json` | bom format | +| bomSchemaVersion | String | `"1.6"` | bom schema version | +| includeBomSerialNumber | Boolean | `false` | include serial number in bom | +| includeBomTimestamp | Boolean | `false` | include timestamp in bom | +| includeBomToolVersion | Boolean | `true` | include tool version in bom | +| includeBomHashes | Boolean | `true` | include artifact hashes in bom | +| enableBomSha3Hashes | Boolean | `true` | enable the generation of sha3 hashes (not available on java 8) | +| includeBomExternalReferences | Boolean | `true` | include external references in bom | +| includeBomDependencyTree | Boolean | `true` | include dependency tree in bom (bomSchemaVersion 1.1 and later) | Sample configuration: @@ -102,7 +103,7 @@ executed. [Scripted](https://www.scala-sbt.org/1.x/docs/Testing-sbt-plugins.html) is a tool that allow you to test sbt plugins. For each test it is necessary to create a specially crafted project. These projects are inside src/sbt-test directory. -Scripted tests are run using `scripted` command. +Scripted tests are run using `scripted` command. Note that these fail on JDK 21 due to the old version of sbt. ### Formatting diff --git a/src/main/scala/com/github/sbt/sbom/BomExtractor.scala b/src/main/scala/com/github/sbt/sbom/BomExtractor.scala index 77e1645..cf29beb 100644 --- a/src/main/scala/com/github/sbt/sbom/BomExtractor.scala +++ b/src/main/scala/com/github/sbt/sbom/BomExtractor.scala @@ -7,7 +7,17 @@ package com.github.sbt.sbom import com.github.packageurl.PackageURL import com.github.sbt.sbom.licenses.LicensesArchive import org.cyclonedx.Version -import org.cyclonedx.model.{ Bom, Component, ExternalReference, Hash, License, LicenseChoice, Metadata, Tool } +import org.cyclonedx.model.{ + Bom, + Component, + Dependency, + ExternalReference, + Hash, + License, + LicenseChoice, + Metadata, + Tool +} import org.cyclonedx.util.BomUtils import sbt._ import sbt.librarymanagement.ModuleReport @@ -16,7 +26,9 @@ import java.util import java.util.UUID import scala.collection.JavaConverters._ -class BomExtractor(settings: BomExtractorParams, report: UpdateReport, log: Logger) { +import SbtUpdateReport.ModuleGraph + +class BomExtractor(settings: BomExtractorParams, report: UpdateReport, rootModuleID: ModuleID, log: Logger) { private val serialNumber: String = "urn:uuid:" + UUID.randomUUID.toString def bom: Bom = { @@ -28,6 +40,9 @@ class BomExtractor(settings: BomExtractorParams, report: UpdateReport, log: Logg bom.setMetadata(metadata) } bom.setComponents(components.asJava) + if (settings.includeBomDependencyTree && settings.schemaVersion.getVersion >= Version.VERSION_11.getVersion) { + bom.setDependencies(dependencyTree.asJava) + } bom } @@ -114,9 +129,7 @@ class BomExtractor(settings: BomExtractorParams, report: UpdateReport, log: Logg component.setVersion(version) component.setModified(false) component.setType(Component.Type.LIBRARY) - component.setPurl( - new PackageURL(PackageURL.StandardTypes.MAVEN, group, name, version, new util.TreeMap(), null).canonicalize() - ) + component.setPurl(purl(group, name, version)) if (settings.schemaVersion.getVersion >= Version.VERSION_11.getVersion) { // component bom-refs must be unique component.setBomRef(component.getPurl) @@ -201,6 +214,46 @@ class BomExtractor(settings: BomExtractorParams, report: UpdateReport, log: Logg } } + private def purl(group: String, name: String, version: String): String = + new PackageURL(PackageURL.StandardTypes.MAVEN, group, name, version, new util.TreeMap(), null).canonicalize() + + private def dependencyTree: Seq[Dependency] = { + val dependencyTree = configurationsForComponents(settings.configuration).flatMap { configuration => + dependencyTreeForConfiguration(configuration) + }.distinct // deduplicate dependencies reported by multiple configurations + + dependencyTree + } + + private def dependencyTreeForConfiguration(configuration: Configuration): Seq[Dependency] = { + report + .configuration(configuration) + .toSeq + .flatMap { configurationReport => + new DependencyTreeExtractor(configurationReport).dependencyTree + } + } + + class DependencyTreeExtractor(configurationReport: ConfigurationReport) { + def dependencyTree: Seq[Dependency] = + moduleGraph.nodes + .sortBy(_.id.idString) + .map { node => + val bomRef = purl(node.id.organization, node.id.name, node.id.version) + + val dependency = new Dependency(bomRef) + + val dependsOn = moduleGraph.dependencyMap.getOrElse(node.id, Nil).sortBy(_.id.idString) + dependsOn.foreach { module => + val bomRef = purl(module.id.organization, module.id.name, module.id.version) + dependency.addDependency(new Dependency(bomRef)) + } + + dependency + } + + private def moduleGraph: ModuleGraph = SbtUpdateReport.fromConfigurationReport(configurationReport, rootModuleID) + } def logComponent(component: Component): Unit = { log.info(s"""" |${component.getGroup}" % "${component.getName}" % "${component.getVersion}", diff --git a/src/main/scala/com/github/sbt/sbom/BomExtractorParams.scala b/src/main/scala/com/github/sbt/sbom/BomExtractorParams.scala index 0bbc8f8..b721848 100644 --- a/src/main/scala/com/github/sbt/sbom/BomExtractorParams.scala +++ b/src/main/scala/com/github/sbt/sbom/BomExtractorParams.scala @@ -16,4 +16,5 @@ final case class BomExtractorParams( includeBomHashes: Boolean, enableBomSha3Hashes: Boolean, includeBomExternalReferences: Boolean, + includeBomDependencyTree: Boolean, ) diff --git a/src/main/scala/com/github/sbt/sbom/BomSbtPlugin.scala b/src/main/scala/com/github/sbt/sbom/BomSbtPlugin.scala index 701d128..5c64e1c 100644 --- a/src/main/scala/com/github/sbt/sbom/BomSbtPlugin.scala +++ b/src/main/scala/com/github/sbt/sbom/BomSbtPlugin.scala @@ -47,6 +47,9 @@ object BomSbtPlugin extends AutoPlugin { lazy val includeBomExternalReferences: SettingKey[Boolean] = settingKey[Boolean]( "should the resulting BOM contain external references? default is true" ) + lazy val includeBomDependencyTree: SettingKey[Boolean] = settingKey[Boolean]( + "should the resulting BOM contain the dependency tree? default is true" + ) lazy val makeBom: TaskKey[sbt.File] = taskKey[sbt.File]("Generates bom file") lazy val listBom: TaskKey[String] = taskKey[String]("Returns the bom") lazy val components: TaskKey[Component] = taskKey[Component]("Returns the bom") @@ -75,6 +78,7 @@ object BomSbtPlugin extends AutoPlugin { includeBomHashes := true, enableBomSha3Hashes := true, includeBomExternalReferences := true, + includeBomDependencyTree := true, makeBom := Def.taskDyn(BomSbtSettings.makeBomTask(Classpaths.updateTask.value, Compile)).value, listBom := Def.taskDyn(BomSbtSettings.listBomTask(Classpaths.updateTask.value, Compile)).value, Test / makeBom := Def.taskDyn(BomSbtSettings.makeBomTask(Classpaths.updateTask.value, Test)).value, diff --git a/src/main/scala/com/github/sbt/sbom/BomSbtSettings.scala b/src/main/scala/com/github/sbt/sbom/BomSbtSettings.scala index 12b8a03..c5f84e3 100644 --- a/src/main/scala/com/github/sbt/sbom/BomSbtSettings.scala +++ b/src/main/scala/com/github/sbt/sbom/BomSbtSettings.scala @@ -5,7 +5,7 @@ package com.github.sbt.sbom import com.github.sbt.sbom.BomSbtPlugin.autoImport._ -import sbt.Keys.{ sLog, target } +import sbt.Keys.{ projectID, sLog, scalaBinaryVersion, scalaVersion, target } import sbt._ object BomSbtSettings { @@ -20,6 +20,9 @@ object BomSbtSettings { BomTaskProperties( report, currentConfiguration, + CrossVersion(scalaVersion.value, scalaBinaryVersion.value)( + projectID.value + ), sLog.value, bomSchemaVersion.value, format, @@ -29,6 +32,7 @@ object BomSbtSettings { includeBomHashes.value, enableBomSha3Hashes.value, includeBomExternalReferences.value, + includeBomDependencyTree.value, ), target.value / (currentConfiguration / bomFileName).value ).execute @@ -45,6 +49,9 @@ object BomSbtSettings { BomTaskProperties( report, currentConfiguration, + CrossVersion(scalaVersion.value, scalaBinaryVersion.value)( + projectID.value + ), sLog.value, bomSchemaVersion.value, format, @@ -54,6 +61,7 @@ object BomSbtSettings { includeBomHashes.value, enableBomSha3Hashes.value, includeBomExternalReferences.value, + includeBomDependencyTree.value, ) ).execute } diff --git a/src/main/scala/com/github/sbt/sbom/BomTask.scala b/src/main/scala/com/github/sbt/sbom/BomTask.scala index 892dd5d..62dd0ab 100644 --- a/src/main/scala/com/github/sbt/sbom/BomTask.scala +++ b/src/main/scala/com/github/sbt/sbom/BomTask.scala @@ -18,6 +18,7 @@ import scala.collection.JavaConverters._ final case class BomTaskProperties( report: UpdateReport, currentConfiguration: Configuration, + rootModuleID: ModuleID, log: Logger, schemaVersion: String, bomFormat: BomFormat, @@ -27,6 +28,7 @@ final case class BomTaskProperties( includeBomHashes: Boolean, enableBomSha3Hashes: Boolean, includeBomExternalReferences: Boolean, + includeBomDependencyTree: Boolean, ) abstract class BomTask[T](protected val properties: BomTaskProperties) { @@ -35,7 +37,7 @@ abstract class BomTask[T](protected val properties: BomTaskProperties) { protected def getBomText: String = { val params: BomExtractorParams = extractorParams(currentConfiguration) - val bom: Bom = new BomExtractor(params, report, log).bom + val bom: Bom = new BomExtractor(params, report, rootModuleID, log).bom val bomText: String = bomFormat match { case BomFormat.Json => BomGeneratorFactory.createJson(schemaVersion, bom).toJsonString case BomFormat.Xml => BomGeneratorFactory.createXml(schemaVersion, bom).toXmlString @@ -81,6 +83,7 @@ abstract class BomTask[T](protected val properties: BomTaskProperties) { includeBomHashes, enableBomSha3Hashes, includeBomExternalReferences, + includeBomDependencyTree, ) protected def logBomInfo(params: BomExtractorParams, bom: Bom): Unit = { @@ -93,6 +96,8 @@ abstract class BomTask[T](protected val properties: BomTaskProperties) { protected def currentConfiguration: Configuration = properties.currentConfiguration + protected def rootModuleID: ModuleID = properties.rootModuleID + protected def log: Logger = properties.log protected lazy val schemaVersion: Version = @@ -117,4 +122,6 @@ abstract class BomTask[T](protected val properties: BomTaskProperties) { protected lazy val enableBomSha3Hashes: Boolean = properties.enableBomSha3Hashes protected lazy val includeBomExternalReferences: Boolean = properties.includeBomExternalReferences + + protected lazy val includeBomDependencyTree: Boolean = properties.includeBomDependencyTree } diff --git a/src/main/scala/com/github/sbt/sbom/SbtUpdateReport.scala b/src/main/scala/com/github/sbt/sbom/SbtUpdateReport.scala new file mode 100644 index 0000000..3e02fcc --- /dev/null +++ b/src/main/scala/com/github/sbt/sbom/SbtUpdateReport.scala @@ -0,0 +1,93 @@ +// SPDX-FileCopyrightText: 2023, Scala center, 2011 - 2022, Lightbend, Inc., 2008 - 2010, Mark Harrah +// +// SPDX-License-Identifier: Apache-2.0 + +package com.github.sbt.sbom + +import sbt.librarymanagement.{ ConfigurationReport, ModuleID, ModuleReport } +import sbt.{ File, OrganizationArtifactReport } + +import scala.collection.mutable + +/* + * taken from sbt at https://github.com/sbt/sbt/blob/1.10.x/main/src/main/scala/sbt/internal/graph/backend/SbtUpdateReport.scala + * + * Copyright 2023, Scala center + * Copyright 2011 - 2022, Lightbend, Inc. + * Copyright 2008 - 2010, Mark Harrah + * Licensed under Apache License 2.0 (see LICENSE) + */ +object SbtUpdateReport { + case class Module( + id: GraphModuleId, + license: Option[String] = None, + extraInfo: String = "", + evictedByVersion: Option[String] = None, + jarFile: Option[File] = None, + error: Option[String] = None + ) + + private type Edge = (GraphModuleId, GraphModuleId) + private def Edge(from: GraphModuleId, to: GraphModuleId): Edge = from -> to + + case class ModuleGraph(nodes: Seq[Module], edges: Seq[Edge]) { + lazy val modules: Map[GraphModuleId, Module] = + nodes.map(n => (n.id, n)).toMap + + def module(id: GraphModuleId): Option[Module] = modules.get(id) + + lazy val dependencyMap: Map[GraphModuleId, Seq[Module]] = + createMap(identity) + + def createMap( + bindingFor: ((GraphModuleId, GraphModuleId)) => (GraphModuleId, GraphModuleId) + ): Map[GraphModuleId, Seq[Module]] = { + val m = new mutable.HashMap[GraphModuleId, mutable.Set[Module]] with mutable.MultiMap[GraphModuleId, Module] + edges.foreach { entry => + val (f, t) = bindingFor(entry) + module(t).foreach(m.addBinding(f, _)) + } + m.toMap.mapValues(_.toSeq.sortBy(_.id.idString)).toMap.withDefaultValue(Nil) + } + + def roots: Seq[Module] = + nodes.filter(n => !edges.exists(_._2 == n.id)).sortBy(_.id.idString) + } + + case class GraphModuleId(organization: String, name: String, version: String) { + def idString: String = organization + ":" + name + ":" + version + } + object GraphModuleId { + def apply(sbtId: ModuleID): GraphModuleId = + GraphModuleId(sbtId.organization, sbtId.name, sbtId.revision) + } + + def fromConfigurationReport(report: ConfigurationReport, rootInfo: ModuleID): ModuleGraph = { + def moduleEdges(orgArt: OrganizationArtifactReport): Seq[(Module, Seq[Edge])] = { + val chosenVersion = orgArt.modules.find(!_.evicted).map(_.module.revision) + orgArt.modules.map(moduleEdge(chosenVersion)) + } + + def moduleEdge(chosenVersion: Option[String])(report: ModuleReport): (Module, Seq[Edge]) = { + val evictedByVersion = if (report.evicted) chosenVersion else None + val jarFile = report.artifacts + .find(_._1.`type` == "jar") + .orElse(report.artifacts.find(_._1.extension == "jar")) + .map(_._2) + ( + Module( + id = GraphModuleId(report.module), + license = report.licenses.headOption.map(_._1), + evictedByVersion = evictedByVersion, + jarFile = jarFile, + error = report.problem + ), + report.callers.map(caller => Edge(GraphModuleId(caller.caller), GraphModuleId(report.module))) + ) + } + val (nodes, edges) = report.details.flatMap(moduleEdges).unzip + val root = Module(GraphModuleId(rootInfo)) + + ModuleGraph(root +: nodes, edges.flatten) + } +} diff --git a/src/sbt-test/dependencies/compile/etc/bom.xml b/src/sbt-test/dependencies/compile/etc/bom.xml index a883c74..e93fdef 100644 --- a/src/sbt-test/dependencies/compile/etc/bom.xml +++ b/src/sbt-test/dependencies/compile/etc/bom.xml @@ -373,4 +373,66 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/sbt-test/dependencies/compileNoTree/build.sbt b/src/sbt-test/dependencies/compileNoTree/build.sbt new file mode 100644 index 0000000..9c14d67 --- /dev/null +++ b/src/sbt-test/dependencies/compileNoTree/build.sbt @@ -0,0 +1,31 @@ +// SPDX-FileCopyrightText: The sbt-sbom team +// +// SPDX-License-Identifier: MIT + +lazy val root = (project in file(".")) + .settings( + name := "dependencies", + version := "0.1", + libraryDependencies ++= Dependencies.library, + bomFileName := "bom.xml", + includeBomToolVersion := false, + enableBomSha3Hashes := false, + includeBomDependencyTree := false, + scalaVersion := "2.12.20", + check := Def + .sequential( + Compile / clean, + Compile / compile, + checkTask + ) + .value + ) + +lazy val check = taskKey[Unit]("check") +lazy val checkTask = Def.task { + val s: TaskStreams = streams.value + s.log.info("Verifying bom content...") + makeBom.value + import scala.sys.process._ + require(Seq("diff", "-w", "target/bom.xml", s"${thisProject.value.base}/etc/bom.xml").! == 0) +} diff --git a/src/sbt-test/dependencies/compileNoTree/etc/bom.xml b/src/sbt-test/dependencies/compileNoTree/etc/bom.xml new file mode 100644 index 0000000..804b30c --- /dev/null +++ b/src/sbt-test/dependencies/compileNoTree/etc/bom.xml @@ -0,0 +1,376 @@ + + + + + + CycloneDX SBT plugin + + + + + + org.scala-lang + scala-library + 2.12.20 + required + + 6c78ebf7399f0bb5f449b72322453eb6 + 562dc9629943eec010e27898c3be65ffa9210558 + 4d8a8f984cce31a329a24f10b0bf336f042cb62aeb435290a1b20243154cfccb + 32f566686e83ba54e24d6679667f9e699485ce360b2513def7be69b91122ac6c1f40b08411cfb933c64a6a92985ca719190e2cf3825eb68ffdffe47348f40b89 + d5f770f83025aabf1257f043692dc4a942112313e878f12f495e76cb6715a06462a98e67e9c934797f1efeda8eec172f + + + + Apache-2.0 + https://www.apache.org/licenses/LICENSE-2.0 + + + pkg:maven/org.scala-lang/scala-library@2.12.20 + false + + + https://www.scala-lang.org/ + + + + + io.circe + circe-core_2.12 + 0.10.0 + required + + 6178c7c6dc2a134d8a6c9eced6d3c2d6 + c602b4fc3b221407a63f0f2c832bdba0da8309dd + 71d7866949089afbd925d14c1810182e9c43dd6d5031a8da067e4aa717cc9703 + ac5c383dbf97e8da2f7c3642d6446e151310e3644396e5b6183f977fdb1ab8cd5305422074cae4acf2d14ab80e424569352c14e9bf4d3c26de38502081d0f3e7 + 7edbca13c4c58e97876b367ddb531b9eccda8fa9930b01b3261447b70ac8ac6b4404e94d45797b5e2246c8fff7b0ca00 + + + + Apache-2.0 + http://www.apache.org/licenses/LICENSE-2.0 + + + pkg:maven/io.circe/circe-core_2.12@0.10.0 + false + + + https://github.com/circe/circe + + + + + io.circe + circe-generic_2.12 + 0.10.0 + required + + 6529f9b6d17052e1b2969f1dd29e451f + 53844268ad4bbd79ddeae4d768267de17baa02be + f3cea34efd423c092293d7eef76820c9445517b385430697befbc7ed2a714e9f + 512693f15466e83a8d971d1ac61842c75f2b61bcfc9c8f0c8277e96a4623f18ab7b3b66d23639e94d546c053af8277c72541b23cc884eac8ac653d7a7fd3e628 + b23f9867d5fa52486a3d578f5c028767a2825bbb16b0fa9393f2fccd6442f1fed180b9bea46f972925aac93e285235a1 + + + + Apache-2.0 + http://www.apache.org/licenses/LICENSE-2.0 + + + pkg:maven/io.circe/circe-generic_2.12@0.10.0 + false + + + https://github.com/circe/circe + + + + + io.circe + circe-parser_2.12 + 0.10.0 + required + + aa1c3a734b5e548c2d70373d8dfbac54 + a5508300b924dffebbb09f3350014089dd40d7ff + 27c58a6bee47df9eeda409373870283c42a9321a5c7859f6ec49dadc802aa520 + 083fa871ae2b3da51554f8915c77c3792c4b836f92d1ede5cb6bdcdc074f29739f4ea20fd27a4eb2659e69f7f837b80e5f5e87652533cc516719778593d750a5 + ce01c27ace5772de1a42bd0c7375465110501cf409e8467e8a5cb3b0be56b34cca6dd682379725abd5887351535ea0d7 + + + + Apache-2.0 + http://www.apache.org/licenses/LICENSE-2.0 + + + pkg:maven/io.circe/circe-parser_2.12@0.10.0 + false + + + https://github.com/circe/circe + + + + + io.circe + circe-numbers_2.12 + 0.10.0 + required + + f3e3c4a14b3016deb670d94d86481060 + 8c87ded057189cbeee0d7c2e9f55cc4dac487ee1 + d7845d065c7320892f82bbc4d360e99de1f91892c32202115b09d96541fcb868 + 6026234fb7f08e54631f7b297e16810d7999580ad44d1f7b6136b0d9b1f331fc0920b4ef1461c92507a22b963d88cd16341ab649b9c76ec84cd7d4ea6c9a4cc1 + 78f487d65ae2feea7ca33d0e58054e31ca1984b9925ad64a95eb613e4a8282e118ad59ada2295d4bd5f2e3ff29d88596 + + + + Apache-2.0 + http://www.apache.org/licenses/LICENSE-2.0 + + + pkg:maven/io.circe/circe-numbers_2.12@0.10.0 + false + + + https://github.com/circe/circe + + + + + org.typelevel + cats-core_2.12 + 1.4.0 + required + + 6d99f15cd7419e8b3cc72ffd38a5815e + e9be08c0a1b39f39d8a9130a856c9b184dd1ec2f + ab9eeca930b3e51bd063d45c1ec51097a41dd6f61d155d880f5f14be0ab14f35 + 376efe8fc921a2268c27ce56885f230aa016531f624b87cae30676b1f06965a8794699a9c5c99816b326f6ca1df2981668a4373c3da0c3b8a39cc1ed0b06a535 + 3bbcf83eeed4bf1dca3c08aa6ea9d5deb57429de844a6e385aeff4a6eb5ea1149c7616011f5cabbc692f7779e696d86d + + + + MIT + http://opensource.org/licenses/MIT + + + pkg:maven/org.typelevel/cats-core_2.12@1.4.0 + false + + + https://github.com/typelevel/cats + + + + + com.chuusai + shapeless_2.12 + 2.3.3 + required + + 002995e4aa53f59d06e99734826cc960 + 6041e2c4871650c556a9c6842e43c04ed462b11f + 312e301432375132ab49592bd8d22b9cd42a338a6300c6157fb4eafd1e3d5033 + 58043efb20dd5490d07b188b2876509b521e77fc77b4c3ea2f9f88bc03030620dbea5a28ea4c769fde8593165eb210df1194b0f3845cbcdf78683ab553dbe186 + 6e0536bbbec29990b9de1f6fcf5526cb694596bb22603dd4c6d95a2c92bc3c27891af223a3a0d4a1e3dea96188bdd4be + + + + Apache-2.0 + http://www.apache.org/licenses/LICENSE-2.0.txt + + + pkg:maven/com.chuusai/shapeless_2.12@2.3.3 + false + + + https://github.com/milessabin/shapeless + + + + + io.circe + circe-jawn_2.12 + 0.10.0 + required + + 3514a887a30482ecda106bfffd400b8f + 979ce1dc1d26ae0bf33601e0bb4d3a49dba549d9 + 8ebc3204f91e25b28fa8fb0ae17c58c2826f3fb4c3cb0a6f10d3c95760ecb600 + 9d6cdd7e0ff044537567ad0dc4d349dd545cfeda7d4aea0febbb3ed61e460f3ce79f89c87c9b7f93f09b49a5a1ced1bd0fad25a1b9704dac037b0017c9217599 + 45d8a33e61952899e78dd41c304a30fd6b3175c2f6d0843b33ea6ccd61d5768d4a09aa10010a2b868eccf1ed2e6e9057 + + + + Apache-2.0 + http://www.apache.org/licenses/LICENSE-2.0 + + + pkg:maven/io.circe/circe-jawn_2.12@0.10.0 + false + + + https://github.com/circe/circe + + + + + org.typelevel + cats-macros_2.12 + 1.4.0 + required + + d6909c57983d748597c1d4c08d7aeae4 + 2436705a12dd4a9999c7568db4f54e4f1b95ac23 + 28d318d6265ed08f15f61af407a22bacbe6f5e139075cc06df21e6d48a7a7eb2 + b76c63d66265c3b910bea35bac86f5b788601adbbd72eb8f6a4f9fbaa2b7f8385c859b29661853555c10076c4b3aaad6941f89ad471a718ee3ef0772078c3651 + 8315ca4c6e07a2295368c0ecd148ac5797669c7c716db7a37ed88f60cdeb0c87b638275cd49dcc3bb59cebd167df8144 + + + + MIT + http://opensource.org/licenses/MIT + + + pkg:maven/org.typelevel/cats-macros_2.12@1.4.0 + false + + + https://github.com/typelevel/cats + + + + + org.typelevel + cats-kernel_2.12 + 1.4.0 + required + + 78d0958b2a31998e2d5f5b00f6632706 + af8aea4585e5bd90fe071324f98c461ac7b62907 + 118074e737f810edd004588f0c681efb7d0d216ae9c481e3c952a07e47d3578b + 9e34a66d68f5d4a5f35922162b29c0ba48b9769d47e858cb65aea885574c3757ebeeb7eeceb992a703e6ed1d247e53251899010a9738b389d5baf59077fbac2c + 245d6916298e3ad164dd0ad61cc49e64caacb7d35c633706ca9e25c3eece2dd6abb2a425f97bcbdd3fa9da106e0fb44a + + + + MIT + http://opensource.org/licenses/MIT + + + pkg:maven/org.typelevel/cats-kernel_2.12@1.4.0 + false + + + https://github.com/typelevel/cats + + + + + org.typelevel + machinist_2.12 + 0.6.5 + required + + caf84ca04bbf75e7f48cf740b59d05dd + abf43203c83e1c39532e24e87d279712c0ddf823 + 9b449314637d967b8acf1bcb744b605e118fe6ac6c7d08e8db68b7f39267d8e5 + 66ab34632201528e68221f269222f30c0648330bf2874e166081544daa500e575d2ee5699b9a48cdd14ca39b8df6539a7773f5eb4c5ab8f09b13bd08fa183ea0 + 5acbdede736ec7a94d42e6c0a8e0dd8a151b20676e49af97fe3d065e62ebdf681c24aabcf849a1e3c50e0d9ffcfd5116 + + + + MIT + http://opensource.org/licenses/MIT + + + pkg:maven/org.typelevel/machinist_2.12@0.6.5 + false + + + http://github.com/typelevel/machinist + + + + + org.typelevel + macro-compat_2.12 + 1.1.1 + required + + c6c8927e9d6b7e3e4f60c019f146d099 + ed809d26ef4237d7c079ae6cf7ebd0dfa7986adf + 8b1514ec99ac9c7eded284367b6c9f8f17a097198a44e6f24488706d66bbd2b8 + 6e9a616ed2771fe68c8390b85dd30cac910c6f33b15e32638a082358a860e9bdef6e1235aed423bfd718198dffb5bf8c48b5a461e19023c98f39294e6bba2482 + 8e1d59c356d27364b8d36ff178ffc10efe4df56b27a42735c9ef14f633ee3b2b7abf71ba4cbb38e9f5fe394453a3262f + + + + Apache-2.0 + http://www.apache.org/licenses/LICENSE-2.0.txt + + + pkg:maven/org.typelevel/macro-compat_2.12@1.1.1 + false + + + https://github.com/milessabin/macro-compat + + + + + org.spire-math + jawn-parser_2.12 + 0.13.0 + required + + 85a145b9224a5eb625a795536609ca37 + 4a2e53bbe3c6f467384327abc9bab25d7cdcada4 + 4aa94d58b2b36f1df8270e1dbfc46b07cc4d9850a963b6f82d9c654a71f5ec53 + 49cac3420253f280b6dccc70cd2805c6b14bd43a862392a6766cf6412948ebde4add69e1876efb3335f18f1b24c9064323b17d87c6abb6a41edd7e9b2b3e01fa + cee97b1aff168ea812eba4a1f136a2fdd27258bf53177c566489fbd88d8167ce92f84d0872ee84ce8d24291089a6e4a8 + + + + MIT + http://opensource.org/licenses/MIT + + + pkg:maven/org.spire-math/jawn-parser_2.12@0.13.0 + false + + + http://github.com/non/jawn + + + + + org.scala-lang + scala-reflect + 2.12.20 + required + + c809ef0d711bb6ef6f4cfc5247fcd6df + f923933d1c168535e66ca825c18207a8db2b20a6 + 5f1914cdc7a70580ea6038d929ebb25736ecf2234f677e2d47f8a4b2bc81e1fb + ef2d1215e47b4921597f4f21aa4ff66434bcbfce3325b48567b0ca44e0184aff22097874bc1023142a2e0b4b1c963148f50509ee56371ecd2c7610f28c00f63c + 24a908a2d59f64796ba2e602b3702cefcfe471264caa6038163c523692e17becc5a7316e82610359c697727889548391 + + + + Apache-2.0 + https://www.apache.org/licenses/LICENSE-2.0 + + + pkg:maven/org.scala-lang/scala-reflect@2.12.20 + false + + + https://www.scala-lang.org/ + + + + + diff --git a/src/sbt-test/dependencies/compileNoTree/project/Dependencies.scala b/src/sbt-test/dependencies/compileNoTree/project/Dependencies.scala new file mode 100644 index 0000000..0ae3888 --- /dev/null +++ b/src/sbt-test/dependencies/compileNoTree/project/Dependencies.scala @@ -0,0 +1,19 @@ +// SPDX-FileCopyrightText: The sbt-sbom team +// +// SPDX-License-Identifier: MIT + +import sbt._ + +object Dependencies { + + private val circeVersion = "0.10.0" + private val scalatestVersion = "3.0.5" + + lazy val library = Seq( + "io.circe" %% "circe-core" % circeVersion, + "io.circe" %% "circe-generic" % circeVersion, + "io.circe" %% "circe-parser" % circeVersion, + "org.scalatest" %% "scalatest" % scalatestVersion % Test + ) + +} diff --git a/src/sbt-test/dependencies/compileNoTree/project/plugins.sbt b/src/sbt-test/dependencies/compileNoTree/project/plugins.sbt new file mode 100644 index 0000000..4b38ff3 --- /dev/null +++ b/src/sbt-test/dependencies/compileNoTree/project/plugins.sbt @@ -0,0 +1,21 @@ +// SPDX-FileCopyrightText: The sbt-sbom team +// +// SPDX-License-Identifier: MIT + +( + sys.props.get("plugin.version"), + sys.props.get("plugin.organization") +) match { + case (Some(version), Some(organization)) => + addSbtPlugin(organization % "sbt-sbom" % version) + case (None, _) => + sys.error( + """|The system property 'plugin.version' is not defined. + |Specify this property using the scriptedLaunchOpts -D.""".stripMargin + ) + case (_, None) => + sys.error( + """|The system property 'plugin.organization' is not defined. + |Specify this property using the scriptedLaunchOpts -D.""".stripMargin + ) +} diff --git a/src/sbt-test/dependencies/compileNoTree/test b/src/sbt-test/dependencies/compileNoTree/test new file mode 100644 index 0000000..05d507b --- /dev/null +++ b/src/sbt-test/dependencies/compileNoTree/test @@ -0,0 +1,3 @@ +# SPDX-FileCopyrightText: The sbt-sbom team +# SPDX-License-Identifier: MIT +> check diff --git a/src/sbt-test/dependencies/integrationTest/etc/bom.xml b/src/sbt-test/dependencies/integrationTest/etc/bom.xml index a883c74..e93fdef 100644 --- a/src/sbt-test/dependencies/integrationTest/etc/bom.xml +++ b/src/sbt-test/dependencies/integrationTest/etc/bom.xml @@ -373,4 +373,66 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/sbt-test/dependencies/test/etc/bom.xml b/src/sbt-test/dependencies/test/etc/bom.xml index c92c973..b777bf2 100644 --- a/src/sbt-test/dependencies/test/etc/bom.xml +++ b/src/sbt-test/dependencies/test/etc/bom.xml @@ -451,4 +451,80 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/sbt-test/dependenciesJson/compile/etc/bom.json b/src/sbt-test/dependenciesJson/compile/etc/bom.json index b2ef527..b992cc2 100644 --- a/src/sbt-test/dependenciesJson/compile/etc/bom.json +++ b/src/sbt-test/dependenciesJson/compile/etc/bom.json @@ -654,5 +654,112 @@ } ] } + ], + "dependencies" : [ + { + "ref" : "pkg:maven/com.chuusai/shapeless_2.12@2.3.3", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/macro-compat_2.12@1.1.1" + ] + }, + { + "ref" : "pkg:maven/dependencies/dependencies_2.12@0.1", + "dependsOn" : [ + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/io.circe/circe-generic_2.12@0.10.0", + "pkg:maven/io.circe/circe-parser_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/io.circe/circe-numbers_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/cats-core_2.12@1.4.0" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-generic_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/com.chuusai/shapeless_2.12@2.3.3", + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-jawn_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.spire-math/jawn-parser_2.12@0.13.0" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-numbers_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-parser_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/io.circe/circe-jawn_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.scala-lang/scala-library@2.12.20", + "dependsOn" : [ ] + }, + { + "ref" : "pkg:maven/org.scala-lang/scala-reflect@2.12.20", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.spire-math/jawn-parser_2.12@0.13.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/cats-core_2.12@1.4.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/cats-kernel_2.12@1.4.0", + "pkg:maven/org.typelevel/cats-macros_2.12@1.4.0", + "pkg:maven/org.typelevel/machinist_2.12@0.6.5" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/cats-kernel_2.12@1.4.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/cats-macros_2.12@1.4.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/machinist_2.12@0.6.5" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/machinist_2.12@0.6.5", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.scala-lang/scala-reflect@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/macro-compat_2.12@1.1.1", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + } ] } \ No newline at end of file diff --git a/src/sbt-test/dependenciesJson/compileNoTree/build.sbt b/src/sbt-test/dependenciesJson/compileNoTree/build.sbt new file mode 100644 index 0000000..5c2ff31 --- /dev/null +++ b/src/sbt-test/dependenciesJson/compileNoTree/build.sbt @@ -0,0 +1,31 @@ +// SPDX-FileCopyrightText: The sbt-sbom team +// +// SPDX-License-Identifier: MIT + +lazy val root = (project in file(".")) + .settings( + name := "dependencies", + version := "0.1", + libraryDependencies ++= Dependencies.library, + bomFileName := "bom.json", + includeBomToolVersion := false, + enableBomSha3Hashes := false, + includeBomDependencyTree := false, + scalaVersion := "2.12.20", + check := Def + .sequential( + Compile / clean, + Compile / compile, + checkTask + ) + .value + ) + +lazy val check = taskKey[Unit]("check") +lazy val checkTask = Def.task { + val s: TaskStreams = streams.value + s.log.info("Verifying bom content...") + makeBom.value + import scala.sys.process._ + require(Seq("diff", "-w", "target/bom.json", s"${thisProject.value.base}/etc/bom.json").! == 0) +} diff --git a/src/sbt-test/dependenciesJson/compileNoTree/etc/bom.json b/src/sbt-test/dependenciesJson/compileNoTree/etc/bom.json new file mode 100644 index 0000000..fa19c00 --- /dev/null +++ b/src/sbt-test/dependenciesJson/compileNoTree/etc/bom.json @@ -0,0 +1,658 @@ +{ + "bomFormat" : "CycloneDX", + "specVersion" : "1.6", + "version" : 1, + "metadata" : { + "tools" : [ + { + "name" : "CycloneDX SBT plugin" + } + ] + }, + "components" : [ + { + "type" : "library", + "bom-ref" : "pkg:maven/org.scala-lang/scala-library@2.12.20", + "group" : "org.scala-lang", + "name" : "scala-library", + "version" : "2.12.20", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "6c78ebf7399f0bb5f449b72322453eb6" + }, + { + "alg" : "SHA-1", + "content" : "562dc9629943eec010e27898c3be65ffa9210558" + }, + { + "alg" : "SHA-256", + "content" : "4d8a8f984cce31a329a24f10b0bf336f042cb62aeb435290a1b20243154cfccb" + }, + { + "alg" : "SHA-512", + "content" : "32f566686e83ba54e24d6679667f9e699485ce360b2513def7be69b91122ac6c1f40b08411cfb933c64a6a92985ca719190e2cf3825eb68ffdffe47348f40b89" + }, + { + "alg" : "SHA-384", + "content" : "d5f770f83025aabf1257f043692dc4a942112313e878f12f495e76cb6715a06462a98e67e9c934797f1efeda8eec172f" + } + ], + "licenses" : [ + { + "license" : { + "id" : "Apache-2.0", + "url" : "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl" : "pkg:maven/org.scala-lang/scala-library@2.12.20", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://www.scala-lang.org/" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "group" : "io.circe", + "name" : "circe-core_2.12", + "version" : "0.10.0", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "6178c7c6dc2a134d8a6c9eced6d3c2d6" + }, + { + "alg" : "SHA-1", + "content" : "c602b4fc3b221407a63f0f2c832bdba0da8309dd" + }, + { + "alg" : "SHA-256", + "content" : "71d7866949089afbd925d14c1810182e9c43dd6d5031a8da067e4aa717cc9703" + }, + { + "alg" : "SHA-512", + "content" : "ac5c383dbf97e8da2f7c3642d6446e151310e3644396e5b6183f977fdb1ab8cd5305422074cae4acf2d14ab80e424569352c14e9bf4d3c26de38502081d0f3e7" + }, + { + "alg" : "SHA-384", + "content" : "7edbca13c4c58e97876b367ddb531b9eccda8fa9930b01b3261447b70ac8ac6b4404e94d45797b5e2246c8fff7b0ca00" + } + ], + "licenses" : [ + { + "license" : { + "id" : "Apache-2.0", + "url" : "http://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl" : "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/circe/circe" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/io.circe/circe-generic_2.12@0.10.0", + "group" : "io.circe", + "name" : "circe-generic_2.12", + "version" : "0.10.0", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "6529f9b6d17052e1b2969f1dd29e451f" + }, + { + "alg" : "SHA-1", + "content" : "53844268ad4bbd79ddeae4d768267de17baa02be" + }, + { + "alg" : "SHA-256", + "content" : "f3cea34efd423c092293d7eef76820c9445517b385430697befbc7ed2a714e9f" + }, + { + "alg" : "SHA-512", + "content" : "512693f15466e83a8d971d1ac61842c75f2b61bcfc9c8f0c8277e96a4623f18ab7b3b66d23639e94d546c053af8277c72541b23cc884eac8ac653d7a7fd3e628" + }, + { + "alg" : "SHA-384", + "content" : "b23f9867d5fa52486a3d578f5c028767a2825bbb16b0fa9393f2fccd6442f1fed180b9bea46f972925aac93e285235a1" + } + ], + "licenses" : [ + { + "license" : { + "id" : "Apache-2.0", + "url" : "http://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl" : "pkg:maven/io.circe/circe-generic_2.12@0.10.0", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/circe/circe" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/io.circe/circe-parser_2.12@0.10.0", + "group" : "io.circe", + "name" : "circe-parser_2.12", + "version" : "0.10.0", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "aa1c3a734b5e548c2d70373d8dfbac54" + }, + { + "alg" : "SHA-1", + "content" : "a5508300b924dffebbb09f3350014089dd40d7ff" + }, + { + "alg" : "SHA-256", + "content" : "27c58a6bee47df9eeda409373870283c42a9321a5c7859f6ec49dadc802aa520" + }, + { + "alg" : "SHA-512", + "content" : "083fa871ae2b3da51554f8915c77c3792c4b836f92d1ede5cb6bdcdc074f29739f4ea20fd27a4eb2659e69f7f837b80e5f5e87652533cc516719778593d750a5" + }, + { + "alg" : "SHA-384", + "content" : "ce01c27ace5772de1a42bd0c7375465110501cf409e8467e8a5cb3b0be56b34cca6dd682379725abd5887351535ea0d7" + } + ], + "licenses" : [ + { + "license" : { + "id" : "Apache-2.0", + "url" : "http://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl" : "pkg:maven/io.circe/circe-parser_2.12@0.10.0", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/circe/circe" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/io.circe/circe-numbers_2.12@0.10.0", + "group" : "io.circe", + "name" : "circe-numbers_2.12", + "version" : "0.10.0", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "f3e3c4a14b3016deb670d94d86481060" + }, + { + "alg" : "SHA-1", + "content" : "8c87ded057189cbeee0d7c2e9f55cc4dac487ee1" + }, + { + "alg" : "SHA-256", + "content" : "d7845d065c7320892f82bbc4d360e99de1f91892c32202115b09d96541fcb868" + }, + { + "alg" : "SHA-512", + "content" : "6026234fb7f08e54631f7b297e16810d7999580ad44d1f7b6136b0d9b1f331fc0920b4ef1461c92507a22b963d88cd16341ab649b9c76ec84cd7d4ea6c9a4cc1" + }, + { + "alg" : "SHA-384", + "content" : "78f487d65ae2feea7ca33d0e58054e31ca1984b9925ad64a95eb613e4a8282e118ad59ada2295d4bd5f2e3ff29d88596" + } + ], + "licenses" : [ + { + "license" : { + "id" : "Apache-2.0", + "url" : "http://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl" : "pkg:maven/io.circe/circe-numbers_2.12@0.10.0", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/circe/circe" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/org.typelevel/cats-core_2.12@1.4.0", + "group" : "org.typelevel", + "name" : "cats-core_2.12", + "version" : "1.4.0", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "6d99f15cd7419e8b3cc72ffd38a5815e" + }, + { + "alg" : "SHA-1", + "content" : "e9be08c0a1b39f39d8a9130a856c9b184dd1ec2f" + }, + { + "alg" : "SHA-256", + "content" : "ab9eeca930b3e51bd063d45c1ec51097a41dd6f61d155d880f5f14be0ab14f35" + }, + { + "alg" : "SHA-512", + "content" : "376efe8fc921a2268c27ce56885f230aa016531f624b87cae30676b1f06965a8794699a9c5c99816b326f6ca1df2981668a4373c3da0c3b8a39cc1ed0b06a535" + }, + { + "alg" : "SHA-384", + "content" : "3bbcf83eeed4bf1dca3c08aa6ea9d5deb57429de844a6e385aeff4a6eb5ea1149c7616011f5cabbc692f7779e696d86d" + } + ], + "licenses" : [ + { + "license" : { + "id" : "MIT", + "url" : "http://opensource.org/licenses/MIT" + } + } + ], + "purl" : "pkg:maven/org.typelevel/cats-core_2.12@1.4.0", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/typelevel/cats" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/com.chuusai/shapeless_2.12@2.3.3", + "group" : "com.chuusai", + "name" : "shapeless_2.12", + "version" : "2.3.3", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "002995e4aa53f59d06e99734826cc960" + }, + { + "alg" : "SHA-1", + "content" : "6041e2c4871650c556a9c6842e43c04ed462b11f" + }, + { + "alg" : "SHA-256", + "content" : "312e301432375132ab49592bd8d22b9cd42a338a6300c6157fb4eafd1e3d5033" + }, + { + "alg" : "SHA-512", + "content" : "58043efb20dd5490d07b188b2876509b521e77fc77b4c3ea2f9f88bc03030620dbea5a28ea4c769fde8593165eb210df1194b0f3845cbcdf78683ab553dbe186" + }, + { + "alg" : "SHA-384", + "content" : "6e0536bbbec29990b9de1f6fcf5526cb694596bb22603dd4c6d95a2c92bc3c27891af223a3a0d4a1e3dea96188bdd4be" + } + ], + "licenses" : [ + { + "license" : { + "id" : "Apache-2.0", + "url" : "http://www.apache.org/licenses/LICENSE-2.0.txt" + } + } + ], + "purl" : "pkg:maven/com.chuusai/shapeless_2.12@2.3.3", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/milessabin/shapeless" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/io.circe/circe-jawn_2.12@0.10.0", + "group" : "io.circe", + "name" : "circe-jawn_2.12", + "version" : "0.10.0", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "3514a887a30482ecda106bfffd400b8f" + }, + { + "alg" : "SHA-1", + "content" : "979ce1dc1d26ae0bf33601e0bb4d3a49dba549d9" + }, + { + "alg" : "SHA-256", + "content" : "8ebc3204f91e25b28fa8fb0ae17c58c2826f3fb4c3cb0a6f10d3c95760ecb600" + }, + { + "alg" : "SHA-512", + "content" : "9d6cdd7e0ff044537567ad0dc4d349dd545cfeda7d4aea0febbb3ed61e460f3ce79f89c87c9b7f93f09b49a5a1ced1bd0fad25a1b9704dac037b0017c9217599" + }, + { + "alg" : "SHA-384", + "content" : "45d8a33e61952899e78dd41c304a30fd6b3175c2f6d0843b33ea6ccd61d5768d4a09aa10010a2b868eccf1ed2e6e9057" + } + ], + "licenses" : [ + { + "license" : { + "id" : "Apache-2.0", + "url" : "http://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl" : "pkg:maven/io.circe/circe-jawn_2.12@0.10.0", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/circe/circe" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/org.typelevel/cats-macros_2.12@1.4.0", + "group" : "org.typelevel", + "name" : "cats-macros_2.12", + "version" : "1.4.0", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "d6909c57983d748597c1d4c08d7aeae4" + }, + { + "alg" : "SHA-1", + "content" : "2436705a12dd4a9999c7568db4f54e4f1b95ac23" + }, + { + "alg" : "SHA-256", + "content" : "28d318d6265ed08f15f61af407a22bacbe6f5e139075cc06df21e6d48a7a7eb2" + }, + { + "alg" : "SHA-512", + "content" : "b76c63d66265c3b910bea35bac86f5b788601adbbd72eb8f6a4f9fbaa2b7f8385c859b29661853555c10076c4b3aaad6941f89ad471a718ee3ef0772078c3651" + }, + { + "alg" : "SHA-384", + "content" : "8315ca4c6e07a2295368c0ecd148ac5797669c7c716db7a37ed88f60cdeb0c87b638275cd49dcc3bb59cebd167df8144" + } + ], + "licenses" : [ + { + "license" : { + "id" : "MIT", + "url" : "http://opensource.org/licenses/MIT" + } + } + ], + "purl" : "pkg:maven/org.typelevel/cats-macros_2.12@1.4.0", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/typelevel/cats" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/org.typelevel/cats-kernel_2.12@1.4.0", + "group" : "org.typelevel", + "name" : "cats-kernel_2.12", + "version" : "1.4.0", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "78d0958b2a31998e2d5f5b00f6632706" + }, + { + "alg" : "SHA-1", + "content" : "af8aea4585e5bd90fe071324f98c461ac7b62907" + }, + { + "alg" : "SHA-256", + "content" : "118074e737f810edd004588f0c681efb7d0d216ae9c481e3c952a07e47d3578b" + }, + { + "alg" : "SHA-512", + "content" : "9e34a66d68f5d4a5f35922162b29c0ba48b9769d47e858cb65aea885574c3757ebeeb7eeceb992a703e6ed1d247e53251899010a9738b389d5baf59077fbac2c" + }, + { + "alg" : "SHA-384", + "content" : "245d6916298e3ad164dd0ad61cc49e64caacb7d35c633706ca9e25c3eece2dd6abb2a425f97bcbdd3fa9da106e0fb44a" + } + ], + "licenses" : [ + { + "license" : { + "id" : "MIT", + "url" : "http://opensource.org/licenses/MIT" + } + } + ], + "purl" : "pkg:maven/org.typelevel/cats-kernel_2.12@1.4.0", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/typelevel/cats" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/org.typelevel/machinist_2.12@0.6.5", + "group" : "org.typelevel", + "name" : "machinist_2.12", + "version" : "0.6.5", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "caf84ca04bbf75e7f48cf740b59d05dd" + }, + { + "alg" : "SHA-1", + "content" : "abf43203c83e1c39532e24e87d279712c0ddf823" + }, + { + "alg" : "SHA-256", + "content" : "9b449314637d967b8acf1bcb744b605e118fe6ac6c7d08e8db68b7f39267d8e5" + }, + { + "alg" : "SHA-512", + "content" : "66ab34632201528e68221f269222f30c0648330bf2874e166081544daa500e575d2ee5699b9a48cdd14ca39b8df6539a7773f5eb4c5ab8f09b13bd08fa183ea0" + }, + { + "alg" : "SHA-384", + "content" : "5acbdede736ec7a94d42e6c0a8e0dd8a151b20676e49af97fe3d065e62ebdf681c24aabcf849a1e3c50e0d9ffcfd5116" + } + ], + "licenses" : [ + { + "license" : { + "id" : "MIT", + "url" : "http://opensource.org/licenses/MIT" + } + } + ], + "purl" : "pkg:maven/org.typelevel/machinist_2.12@0.6.5", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "http://github.com/typelevel/machinist" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/org.typelevel/macro-compat_2.12@1.1.1", + "group" : "org.typelevel", + "name" : "macro-compat_2.12", + "version" : "1.1.1", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "c6c8927e9d6b7e3e4f60c019f146d099" + }, + { + "alg" : "SHA-1", + "content" : "ed809d26ef4237d7c079ae6cf7ebd0dfa7986adf" + }, + { + "alg" : "SHA-256", + "content" : "8b1514ec99ac9c7eded284367b6c9f8f17a097198a44e6f24488706d66bbd2b8" + }, + { + "alg" : "SHA-512", + "content" : "6e9a616ed2771fe68c8390b85dd30cac910c6f33b15e32638a082358a860e9bdef6e1235aed423bfd718198dffb5bf8c48b5a461e19023c98f39294e6bba2482" + }, + { + "alg" : "SHA-384", + "content" : "8e1d59c356d27364b8d36ff178ffc10efe4df56b27a42735c9ef14f633ee3b2b7abf71ba4cbb38e9f5fe394453a3262f" + } + ], + "licenses" : [ + { + "license" : { + "id" : "Apache-2.0", + "url" : "http://www.apache.org/licenses/LICENSE-2.0.txt" + } + } + ], + "purl" : "pkg:maven/org.typelevel/macro-compat_2.12@1.1.1", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://github.com/milessabin/macro-compat" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/org.spire-math/jawn-parser_2.12@0.13.0", + "group" : "org.spire-math", + "name" : "jawn-parser_2.12", + "version" : "0.13.0", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "85a145b9224a5eb625a795536609ca37" + }, + { + "alg" : "SHA-1", + "content" : "4a2e53bbe3c6f467384327abc9bab25d7cdcada4" + }, + { + "alg" : "SHA-256", + "content" : "4aa94d58b2b36f1df8270e1dbfc46b07cc4d9850a963b6f82d9c654a71f5ec53" + }, + { + "alg" : "SHA-512", + "content" : "49cac3420253f280b6dccc70cd2805c6b14bd43a862392a6766cf6412948ebde4add69e1876efb3335f18f1b24c9064323b17d87c6abb6a41edd7e9b2b3e01fa" + }, + { + "alg" : "SHA-384", + "content" : "cee97b1aff168ea812eba4a1f136a2fdd27258bf53177c566489fbd88d8167ce92f84d0872ee84ce8d24291089a6e4a8" + } + ], + "licenses" : [ + { + "license" : { + "id" : "MIT", + "url" : "http://opensource.org/licenses/MIT" + } + } + ], + "purl" : "pkg:maven/org.spire-math/jawn-parser_2.12@0.13.0", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "http://github.com/non/jawn" + } + ] + }, + { + "type" : "library", + "bom-ref" : "pkg:maven/org.scala-lang/scala-reflect@2.12.20", + "group" : "org.scala-lang", + "name" : "scala-reflect", + "version" : "2.12.20", + "scope" : "required", + "hashes" : [ + { + "alg" : "MD5", + "content" : "c809ef0d711bb6ef6f4cfc5247fcd6df" + }, + { + "alg" : "SHA-1", + "content" : "f923933d1c168535e66ca825c18207a8db2b20a6" + }, + { + "alg" : "SHA-256", + "content" : "5f1914cdc7a70580ea6038d929ebb25736ecf2234f677e2d47f8a4b2bc81e1fb" + }, + { + "alg" : "SHA-512", + "content" : "ef2d1215e47b4921597f4f21aa4ff66434bcbfce3325b48567b0ca44e0184aff22097874bc1023142a2e0b4b1c963148f50509ee56371ecd2c7610f28c00f63c" + }, + { + "alg" : "SHA-384", + "content" : "24a908a2d59f64796ba2e602b3702cefcfe471264caa6038163c523692e17becc5a7316e82610359c697727889548391" + } + ], + "licenses" : [ + { + "license" : { + "id" : "Apache-2.0", + "url" : "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl" : "pkg:maven/org.scala-lang/scala-reflect@2.12.20", + "modified" : false, + "externalReferences" : [ + { + "type" : "website", + "url" : "https://www.scala-lang.org/" + } + ] + } + ] +} diff --git a/src/sbt-test/dependenciesJson/compileNoTree/project/Dependencies.scala b/src/sbt-test/dependenciesJson/compileNoTree/project/Dependencies.scala new file mode 100644 index 0000000..0ae3888 --- /dev/null +++ b/src/sbt-test/dependenciesJson/compileNoTree/project/Dependencies.scala @@ -0,0 +1,19 @@ +// SPDX-FileCopyrightText: The sbt-sbom team +// +// SPDX-License-Identifier: MIT + +import sbt._ + +object Dependencies { + + private val circeVersion = "0.10.0" + private val scalatestVersion = "3.0.5" + + lazy val library = Seq( + "io.circe" %% "circe-core" % circeVersion, + "io.circe" %% "circe-generic" % circeVersion, + "io.circe" %% "circe-parser" % circeVersion, + "org.scalatest" %% "scalatest" % scalatestVersion % Test + ) + +} diff --git a/src/sbt-test/dependenciesJson/compileNoTree/project/plugins.sbt b/src/sbt-test/dependenciesJson/compileNoTree/project/plugins.sbt new file mode 100644 index 0000000..4b38ff3 --- /dev/null +++ b/src/sbt-test/dependenciesJson/compileNoTree/project/plugins.sbt @@ -0,0 +1,21 @@ +// SPDX-FileCopyrightText: The sbt-sbom team +// +// SPDX-License-Identifier: MIT + +( + sys.props.get("plugin.version"), + sys.props.get("plugin.organization") +) match { + case (Some(version), Some(organization)) => + addSbtPlugin(organization % "sbt-sbom" % version) + case (None, _) => + sys.error( + """|The system property 'plugin.version' is not defined. + |Specify this property using the scriptedLaunchOpts -D.""".stripMargin + ) + case (_, None) => + sys.error( + """|The system property 'plugin.organization' is not defined. + |Specify this property using the scriptedLaunchOpts -D.""".stripMargin + ) +} diff --git a/src/sbt-test/dependenciesJson/compileNoTree/test b/src/sbt-test/dependenciesJson/compileNoTree/test new file mode 100644 index 0000000..05d507b --- /dev/null +++ b/src/sbt-test/dependenciesJson/compileNoTree/test @@ -0,0 +1,3 @@ +# SPDX-FileCopyrightText: The sbt-sbom team +# SPDX-License-Identifier: MIT +> check diff --git a/src/sbt-test/dependenciesJson/integrationTest/etc/bom.json b/src/sbt-test/dependenciesJson/integrationTest/etc/bom.json index b2ef527..b992cc2 100644 --- a/src/sbt-test/dependenciesJson/integrationTest/etc/bom.json +++ b/src/sbt-test/dependenciesJson/integrationTest/etc/bom.json @@ -654,5 +654,112 @@ } ] } + ], + "dependencies" : [ + { + "ref" : "pkg:maven/com.chuusai/shapeless_2.12@2.3.3", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/macro-compat_2.12@1.1.1" + ] + }, + { + "ref" : "pkg:maven/dependencies/dependencies_2.12@0.1", + "dependsOn" : [ + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/io.circe/circe-generic_2.12@0.10.0", + "pkg:maven/io.circe/circe-parser_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/io.circe/circe-numbers_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/cats-core_2.12@1.4.0" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-generic_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/com.chuusai/shapeless_2.12@2.3.3", + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-jawn_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.spire-math/jawn-parser_2.12@0.13.0" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-numbers_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-parser_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/io.circe/circe-jawn_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.scala-lang/scala-library@2.12.20", + "dependsOn" : [ ] + }, + { + "ref" : "pkg:maven/org.scala-lang/scala-reflect@2.12.20", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.spire-math/jawn-parser_2.12@0.13.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/cats-core_2.12@1.4.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/cats-kernel_2.12@1.4.0", + "pkg:maven/org.typelevel/cats-macros_2.12@1.4.0", + "pkg:maven/org.typelevel/machinist_2.12@0.6.5" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/cats-kernel_2.12@1.4.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/cats-macros_2.12@1.4.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/machinist_2.12@0.6.5" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/machinist_2.12@0.6.5", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.scala-lang/scala-reflect@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/macro-compat_2.12@1.1.1", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + } ] } \ No newline at end of file diff --git a/src/sbt-test/dependenciesJson/test/etc/bom.json b/src/sbt-test/dependenciesJson/test/etc/bom.json index 872a4af..2d4feeb 100644 --- a/src/sbt-test/dependenciesJson/test/etc/bom.json +++ b/src/sbt-test/dependenciesJson/test/etc/bom.json @@ -792,5 +792,135 @@ } ] } + ], + "dependencies" : [ + { + "ref" : "pkg:maven/com.chuusai/shapeless_2.12@2.3.3", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/macro-compat_2.12@1.1.1" + ] + }, + { + "ref" : "pkg:maven/dependencies/dependencies_2.12@0.1", + "dependsOn" : [ + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/io.circe/circe-generic_2.12@0.10.0", + "pkg:maven/io.circe/circe-parser_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.scalatest/scalatest_2.12@3.0.5" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/io.circe/circe-numbers_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/cats-core_2.12@1.4.0" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-generic_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/com.chuusai/shapeless_2.12@2.3.3", + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-jawn_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.spire-math/jawn-parser_2.12@0.13.0" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-numbers_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/io.circe/circe-parser_2.12@0.10.0", + "dependsOn" : [ + "pkg:maven/io.circe/circe-core_2.12@0.10.0", + "pkg:maven/io.circe/circe-jawn_2.12@0.10.0", + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.scala-lang.modules/scala-xml_2.12@1.0.6", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.scala-lang/scala-library@2.12.20", + "dependsOn" : [ ] + }, + { + "ref" : "pkg:maven/org.scala-lang/scala-reflect@2.12.20", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.scalactic/scalactic_2.12@3.0.5", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.scala-lang/scala-reflect@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.scalatest/scalatest_2.12@3.0.5", + "dependsOn" : [ + "pkg:maven/org.scala-lang.modules/scala-xml_2.12@1.0.6", + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.scala-lang/scala-reflect@2.12.20", + "pkg:maven/org.scalactic/scalactic_2.12@3.0.5" + ] + }, + { + "ref" : "pkg:maven/org.spire-math/jawn-parser_2.12@0.13.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/cats-core_2.12@1.4.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/cats-kernel_2.12@1.4.0", + "pkg:maven/org.typelevel/cats-macros_2.12@1.4.0", + "pkg:maven/org.typelevel/machinist_2.12@0.6.5" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/cats-kernel_2.12@1.4.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/cats-macros_2.12@1.4.0", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.typelevel/machinist_2.12@0.6.5" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/machinist_2.12@0.6.5", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20", + "pkg:maven/org.scala-lang/scala-reflect@2.12.20" + ] + }, + { + "ref" : "pkg:maven/org.typelevel/macro-compat_2.12@1.1.1", + "dependsOn" : [ + "pkg:maven/org.scala-lang/scala-library@2.12.20" + ] + } ] } \ No newline at end of file