Repository navigation
change *-cyclonedx.xml/json to *.cdx.xml/json #658
Description
According to specifications generated files should end with *.cdx.json, *.cdx.xml
https://cyclonedx.org/specification/overview/#recognized-file-patterns
Activity
slawekjaranowski commentedon Jun 21, 2026
Maybe easier will be add next pattern to specification, such some of tool can follow specification and don't recognize
*-cyclonedx.jsonas BOMs, like:hboutemy commentedon Jun 21, 2026
to me, it's a matter of taste, no taste matches everybody...
this
-cyclonedx.xmlchoice was done very early in the project, before this.cdx.jsonidea existed: as usual, early adopters are hit by new conventionsbut we can discuss that for next major release, if you wish: I don't know how @stevespringett feels about changing that after so many years
ppkarwasz commentedon Aug 25, 2026
I would rather set the default
typetocdx.jsonandcdx.xmlto:If a module produces both a normal artifact and one with the
shadedclassifier, their SBOM should slightly differ.hboutemy commentedon Aug 28, 2026
type?
I fear you're mixing Maven concepts: type is for dependency type, when an artifact has to be declared as a dependency
FTR: one doc that shows correspondence from dependency type to default classifier and extension https://maven.apache.org/ref/3.9.16/maven-core/artifact-handlers.html
but now I get that current
*-cyclonedx.xmland*-cyclonedx.jsonfile names, which means classifier=cyclonedx+ extension=xmlorjsonwould be replaced by
*.cdx.xmland*.cdx.jsonfile names, which means no classifier, but extension=cdx.xmlorcdx.json= the Maven description of what Slawek proposed
by default, no classifier, just extension
and if someone wants another SBOM to be attached in addition, yes, they can define a classifier and keep the same extensions
In the plugin https://cyclonedx.github.io/cyclonedx-maven-plugin/makeBom-mojo.html
this would change the default classifier value from
cyclonedxto emptyand the outputFormat values would change the extensions:
xmlformat would triggercdx.xmlextensions, etc...feasible: just need to choose to change
@stevespringett WDYT? is it time for CycloneDX Maven Plugin to change to newer conventions?
hboutemy commentedon Aug 28, 2026
now I get that title is wrong: doing
*.cdx.xmlis not changing classifier, but changing extension...I'll update the issue description
[-]Set default classifier as `cdx`[/-][+]change `*-cyclonedx.xml`/`json` to `*.cdx.xml`/`json`[/+]hboutemy commentedon Aug 28, 2026
and to be more complete:
this does not change the fact that default file generated locally are named
target/bom.xml/json, as still recommended in https://cyclonedx.org/specification/overview/#recognized-file-patternswhat we are talking here is the file names when stored in a remote Maven repository, where these notions of classifier, extension and dependency type are meaningful
slawekjaranowski commentedon Aug 28, 2026
hboutemy commentedon Aug 28, 2026
no: if you change classifier only, you'll get
*-cdx.json|xmlslawekjaranowski commentedon Aug 28, 2026
You are right, my mistake
ppkarwasz commentedon Aug 29, 2026
Sorry, I meant extension. Thank you for the correction.
slawekjaranowski commentedon Sep 5, 2026
With more testing .... changing classifier to empty will produce more complication, as we need classifier to produce additional checksum
checkusm plugin requires classifier ....