Skip to content

Dependencies is 'runtimeOnly' configuration not listed in build-info #800

Open
@jordantangy

Description

Describe the bug

When publishing a build containing the ‘runtimeOnly’ dependency configuration in the ‘build.gradle’ file, the dependency is not reflected in the build-info.
Without listing these dependencies in the build info, we're missing the concept of SBOM (Software Bill of Materials), which is a comprehensive inventory of all third-party components within a codebase.
The SBOM is a concept that provides a detailed inventory of all third-party components in a codebase. By tracking and managing dependencies, it ensures compliance, and addresses security vulnerabilities. By not including ‘runtimeOnly’ dependencies in the build-info, we miss out on documenting these components, which compromises the integrity of SBOM and limits the ability to fully understand and manage the software's external dependencies.

To Reproduce

  1. Include a dependency with 'runtimeOnly' dependency configuration in the build.gradle file.
  2. Build the project.
  3. Publish to Artifactory using the command ./gradlew artifactoryPublish
  4. See the build-info missing the dependency specified in the 'runtimeOnly' configuration.

Expected behavior

The expected behavior is to that the build-info should list the dependencies specified in the 'runtimeOnly' configuration.

Screenshots

image

Versions

  • Extractor version: 5
  • Operating system: macOS
  • Artifactory Version: 7.92.1

Additional context
None.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    bugCreate a report to help us improve

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions