Creating SBOMs for Tycho artifacts

What is an SBOM?

A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships. SBOMs are essential for:

• Security: Understanding your software supply chain and identifying vulnerable components
• Compliance: Meeting regulatory requirements and license obligations
• Transparency: Documenting what's in your software for customers and stakeholders

Tycho supports generating SBOMs in industry-standard formats like CycloneDX, making it easier to maintain visibility into your Eclipse-based applications.

SBOM Generation Approaches

Tycho has two ways of creating an SBOM for your artifacts one local using an extension for the cyclone-dx plugin and one more global approach using a prebuild products.

Using the cyclone-dx extension

The CycloneDX Maven Plugin creates SBOMs for individual Maven projects during the build lifecycle. Tycho provides an extension (tycho-sbom) that enables the CycloneDX plugin to properly understand and include OSGi/Eclipse-specific artifacts in the generated SBOM.

This approach is ideal for:

• Generating SBOMs as part of your regular Maven build
• Creating per-module SBOMs for individual components
• Integration with CI/CD pipelines

To use this extension, add the CycloneDX Maven Plugin with the Tycho SBOM dependency:

<plugin>
    <groupId>org.cyclonedx</groupId>
    <artifactId>cyclonedx-maven-plugin</artifactId>
    <dependencies>
        <dependency>
            <groupId>org.eclipse.tycho</groupId>
            <artifactId>tycho-sbom</artifactId>
            <version>${tycho-version}</version>
        </dependency>
    </dependencies>
</plugin>

For more information about the CycloneDX Maven Plugin, including configuration options and best practices, see the official CycloneDX Maven Plugin documentation.

See also this demo:

• https://github.com/eclipse-tycho/tycho/tree/main/tycho-its/projects/sbom

Using a prebuild product

The tycho-sbom:generator mojo wraps the Eclipse CBI p2repo-sbom tool as a Maven plugin, enabling SBOM generation for complete Eclipse products and installations. This tool is particularly powerful as it:

• Analyzes complete product installations rather than individual build artifacts
• Gathers metadata from multiple sources including Maven Central and ClearlyDefined
• Provides enhanced license identification and dependency mapping
• Generates comprehensive SBOMs that can be extended with additional metadata

This approach is ideal for:

• Generating SBOMs for final, assembled products
• Post-build SBOM generation from existing installations
• Creating SBOMs with enriched metadata from external sources

For detailed information about the underlying tool, see the p2repo-sbom documentation.

<plugin>
    <groupId>org.eclipse.tycho</groupId>
    <artifactId>tycho-sbom-plugin</artifactId>
    <version>${tycho-version}</version>
    <executions>
      <execution>
        <id>generate-sbom</id>
        <goals>
          <goal>generator</goal> 
        </goals>
        <configuration>
            <installations>${project.build.directory}/target/myproducts</installations>
        </configuration>
      </execution>
    </executions>
</plugin>