From 528374c5bc66bb4e8bab1384f74506ffe39d3e57 Mon Sep 17 00:00:00 2001
From: lprimak <lenny@flowlogix.com>
Date: Fri, 18 Sep 2026 16:33:19 -0500
Subject: [PATCH 1/2] chore: Generate SBOM files with CycloneDX and SPDX maven
 plugins

---
 pom.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/pom.xml b/pom.xml
index 8f77fdd229..4c96973f1f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -531,6 +531,16 @@
                         </dependency>
                     </dependencies>
                 </plugin>
+                <plugin>
+                    <groupId>org.cyclonedx</groupId>
+                    <artifactId>cyclonedx-maven-plugin</artifactId>
+                    <version>2.9.3</version>
+                </plugin>
+                <plugin>
+                    <groupId>org.spdx</groupId>
+                    <artifactId>spdx-maven-plugin</artifactId>
+                    <version>1.0.4</version>
+                </plugin>
             </plugins>
         </pluginManagement>
         <plugins>
@@ -1678,6 +1688,41 @@
                             <csvSummary>false</csvSummary>
                         </configuration>
                     </plugin>
+                    <plugin>
+                        <groupId>org.cyclonedx</groupId>
+                        <artifactId>cyclonedx-maven-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <phase>package</phase>
+                                <goals>
+                                    <goal>makeAggregateBom</goal>
+                                </goals>
+                            </execution>
+                        </executions>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.spdx</groupId>
+                        <artifactId>spdx-maven-plugin</artifactId>
+                        <executions>
+                            <execution>
+                                <id>build-spdx-v2</id>
+                                <phase>package</phase>
+                                <goals>
+                                    <goal>createSPDX</goal>
+                                </goals>
+                            </execution>
+                            <execution>
+                                <id>build-spdx-v3</id>
+                                <phase>package</phase>
+                                <goals>
+                                    <goal>createSPDX</goal>
+                                </goals>
+                                <configuration>
+                                    <outputFormat>JSON-LD</outputFormat>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
                 </plugins>
             </build>
         </profile>

From 9b794e7636b05a3b423b85880d67e3e2e946ffbb Mon Sep 17 00:00:00 2001
From: lprimak <lenny@flowlogix.com>
Date: Fri, 18 Sep 2026 16:40:50 -0500
Subject: [PATCH 2/2] sbom generator gets its own profile

---
 pom.xml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 4c96973f1f..9d3774a1fa 100644
--- a/pom.xml
+++ b/pom.xml
@@ -754,7 +754,7 @@
                     <preparationGoals>validate</preparationGoals>
                     <preparationProfiles>skip-checkstyle</preparationProfiles>
                     <goals>deploy</goals>
-                    <releaseProfiles>docs,apache-release,${nexus-staging-profile}</releaseProfiles>
+                    <releaseProfiles>docs,apache-release,generate-sbom,${nexus-staging-profile}</releaseProfiles>
                     <mavenExecutorId>forked-path</mavenExecutorId>
                 </configuration>
             </plugin>
@@ -1688,6 +1688,13 @@
                             <csvSummary>false</csvSummary>
                         </configuration>
                     </plugin>
+                </plugins>
+            </build>
+        </profile>
+        <profile>
+            <id>generate-sbom</id>
+            <build>
+                <plugins>
                     <plugin>
                         <groupId>org.cyclonedx</groupId>
                         <artifactId>cyclonedx-maven-plugin</artifactId>