Using the SWID Maven Plugin

This project supports generating a SWID tag as part of the Apache Maven build system.

Two generation capabilities are provided:

  • Assembly SWID Generator: A container descriptor handler that supports generation of a SWID tag as a manifest of a Maven Assembly. Maven assemblies are binary distributions of Java code archived using a number of popular archive formats.
  • SWD Generation Mojo: An experimental Maven mojo for building a SWID tag for use within a Java JAR file.

The source for these capabilities can be found in the project’s Github repo.

The Assembly SWID Generator

To generate a SWID tag as part of the execution of the Maven Assembly plugin, a couple configurations need to be made.

The following example is the configuration used by the swidval project.

First, the assembly descriptor needs to be configured to use the swid-generator. In the following example, the assembly descriptor located in src/assembly/bin.xml has the needed <containerDescriptorHandler> configured as follows:

    <!-- Generates a SWID tag -->
          <!-- don't include the assembly in the generated payload -->
        <!-- use the following entities in the SWID tag -->
						<name>National Institute of Standards and Technology</name>

Second, the maven-assembly-plugin needs to be configured in your project’s POM as follows:

					<dependency> <!-- the dependency for the SWID generator -->
						<id>make-assembly-bin</id> <!-- this is used for inheritance merges -->
						<phase>package</phase> <!-- bind to the packaging phase -->
								<descriptor>src/assembly/bin.xml</descriptor> <!-- the location of the configured assembly descriptor -->

SWID Generator Mojo

See the mojo documentation.