DE EN

SBOM Enforcer for Maven

An SBOM lists the components in a software build. SBOM Enforcer is an open source Maven plugin that checks the CycloneDX SBOM attached to that build. It helps maintainers find incorrect checksums and broken external references before they publish an SBOM.

Read the source code on GitHub.

Plugin goals

GoalDescriptionDefault phase
sbom-enforcer:check Runs configured rules on CycloneDX SBOMs attached to the Maven build. verify

What it checks

  • Dependency checksums: The checksum rule compares checksums in the SBOM with dependency artifacts. It can use a private Maven local repository for release checks.
  • External references: The validateReferences rule checks URLs in the SBOM. You can choose whether broken dependency links, redirects, and authentication responses fail the build.

The plugin currently supports SBOMs produced by the CycloneDX Maven plugin. Some reference checks make network requests, so their results can depend on the availability of external sites. A passing check does not prove that every SBOM entry is complete or that the software has no vulnerabilities.

Use SBOM Enforcer

Maven Central provides version 0.2.0 under io.github.sbom-enforcer:sbom-enforcer-maven-plugin. This release comes from the original project. Source changes in the fork are not part of this release. For all configuration options, read the plugin documentation.

Version 0.2.0 fails during plugin configuration on Maven 3.9.6. Maven 3.9.9 loads the plugin.

Generate a CycloneDX SBOM in your Maven build, then add the plugin. This example checks external references and reports broken dependency links without failing the build:

<plugin>
  <groupId>io.github.sbom-enforcer</groupId>
  <artifactId>sbom-enforcer-maven-plugin</artifactId>
  <version>0.2.0</version>
  <executions>
    <execution>
      <id>check-sbom</id>
      <phase>verify</phase>
      <goals><goal>check</goal></goals>
      <configuration>
        <rules>
          <validateReferences>
            <failOnDependencies>false</failOnDependencies>
          </validateReferences>
        </rules>
      </configuration>
    </execution>
  </executions>
</plugin>

Run mvn verify and review the findings. Add the checksum rule or stricter reference checks as needed.

Documentation