From 128b699738b2d3e26ae65cf3d424663799aef980 Mon Sep 17 00:00:00 2001
From: Alexey Loubyansky <olubyans@redhat.com>
Date: Fri, 12 Jun 2026 19:47:37 +0200
Subject: [PATCH] ARTEMIS-6209 Generate an SBOM for the distribution

---
 artemis-console/pom.xml                       | 24 +++++++++++++++++++
 artemis-distribution/pom.xml                  |  7 ++++++
 .../src/main/assembly/bin.xml                 | 16 +++++++++++++
 .../src/main/assembly/dir.xml                 |  6 +++++
 pom.xml                                       |  1 +
 5 files changed, 54 insertions(+)

diff --git a/artemis-console/pom.xml b/artemis-console/pom.xml
index c42c6a0303cd..4bef4a246310 100644
--- a/artemis-console/pom.xml
+++ b/artemis-console/pom.xml
@@ -83,6 +83,14 @@
                 <!-- include any other file types you want to filter -->
               </includes>
             </resource>
+            <resource>
+              <filtering>false</filtering>
+              <directory>${project.build.directory}</directory>
+              <targetPath>META-INF/sbom</targetPath>
+              <includes>
+                <include>bom.cdx.json</include>
+              </includes>
+            </resource>
           </webResources>
           <overlays>
             <overlay>
@@ -137,6 +145,22 @@
           </replacements>
         </configuration>
       </plugin>
+      <plugin>
+        <groupId>dev.cyberstamp.maven.assembly.sbom</groupId>
+        <artifactId>assembly-sbom-maven-plugin</artifactId>
+        <version>${assembly-sbom-version}</version>
+        <executions>
+          <execution>
+            <phase>prepare-package</phase>
+            <goals>
+              <goal>generate</goal>
+            </goals>
+            <configuration>
+              <outputFile>${project.build.directory}/bom.cdx.json</outputFile>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
       <plugin>
         <artifactId>maven-clean-plugin</artifactId>
         <configuration>
diff --git a/artemis-distribution/pom.xml b/artemis-distribution/pom.xml
index 6ce5e88d44e3..ca7c492deea8 100644
--- a/artemis-distribution/pom.xml
+++ b/artemis-distribution/pom.xml
@@ -174,6 +174,13 @@
          </plugin>
          <plugin>
             <artifactId>maven-assembly-plugin</artifactId>
+            <dependencies>
+               <dependency>
+                  <groupId>dev.cyberstamp.maven.assembly.sbom</groupId>
+                  <artifactId>assembly-sbom-handler</artifactId>
+                  <version>${assembly-sbom-version}</version>
+               </dependency>
+            </dependencies>
             <executions>
                <execution>
                   <id>bin</id>
diff --git a/artemis-distribution/src/main/assembly/bin.xml b/artemis-distribution/src/main/assembly/bin.xml
index 5ddee22df8bf..9ae41345b7fb 100644
--- a/artemis-distribution/src/main/assembly/bin.xml
+++ b/artemis-distribution/src/main/assembly/bin.xml
@@ -26,6 +26,22 @@
    </formats>
    <includeBaseDirectory>true</includeBaseDirectory>
 
+   <containerDescriptorHandlers>
+      <containerDescriptorHandler>
+         <handlerName>sbom</handlerName>
+         <configuration>
+             <!-- Pritty-print the SBOM JSON, defaults to false
+             <prettyPrint>true</prettyPrint -->
+             <!-- Whether to embed the SBOM in the archive or generate it next to it: embedded - default, external, all
+             <outputMode>all</outputMode -->
+             <!-- Whether to manifest only library components or all the files in a distribution, defaults to false
+             <librariesOnly>true</librariesOnly -->
+             <!-- Whether to attach an external SBOM as a Maven artifact, defaults to false
+             <attach>true</attach -->
+         </configuration>
+      </containerDescriptorHandler>
+   </containerDescriptorHandlers>
+
    <componentDescriptors>
        <componentDescriptor>dep.xml</componentDescriptor>
    </componentDescriptors>
diff --git a/artemis-distribution/src/main/assembly/dir.xml b/artemis-distribution/src/main/assembly/dir.xml
index f91f268e1a37..ce3cb9bbb2f3 100644
--- a/artemis-distribution/src/main/assembly/dir.xml
+++ b/artemis-distribution/src/main/assembly/dir.xml
@@ -25,6 +25,12 @@
    </formats>
    <includeBaseDirectory>true</includeBaseDirectory>
 
+   <containerDescriptorHandlers>
+      <containerDescriptorHandler>
+         <handlerName>sbom</handlerName>
+      </containerDescriptorHandler>
+   </containerDescriptorHandlers>
+
    <componentDescriptors>
        <componentDescriptor>dep.xml</componentDescriptor>
    </componentDescriptors>
diff --git a/pom.xml b/pom.xml
index e6f92f5af4c0..45233b9e7d4b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -91,6 +91,7 @@
 
       <activemq-artemis-native-version>2.0.0</activemq-artemis-native-version>
       <artemis-console-version>1.8.0</artemis-console-version>
+      <assembly-sbom-version>0.1.4</assembly-sbom-version>
       <karaf.version>4.4.11</karaf.version>
       <pax.exam.version>4.14.0</pax.exam.version>
       <commons.config.version>2.15.1</commons.config.version>