This message was deleted.
# community-supports
Slackbot
03/29/2023, 2:38 PMThis message was deleted.
s
Sebastian Schuberth
03/29/2023, 2:41 PMMaybe you could leverage https://github.com/uklance/gradle-dependency-export/ to get the job done?
r
Roberto Leinardi
03/29/2023, 2:43 PMThis seems a good starting point, thanks!
s
Sebastian Schuberth
03/29/2023, 2:45 PMOther than that, you could also give https://github.com/oss-review-toolkit/ort I'm working on a try. It's meant to create SBOMs, but in fact what you want is somehting like an SOMB (that also contains the URLs to the dependencies and not just their coordinates).
Sebastian Schuberth
03/29/2023, 2:46 PMI'm working on revamping the Gradle analysis in ORT as we speak.
r
Roberto Leinardi
03/29/2023, 2:52 PMhey cool project! But ORT it seems to be very powerful but also very complex: I was hoping for a lightweight gradle plugin that I can easily run like any gradle tasks. Dependencies on Docker are a little out of scope for now...
s
Sebastian Schuberth
03/29/2023, 2:54 PMORT does not require Docker for Gradle project analysis. That's only required for other package managers / when doing more than just analysis.
r
Roberto Leinardi
03/29/2023, 3:01 PMI see, so I could just use the Gradle analysis to generate the BOM? Do you have an example of how the BOM looks like?
s
Sebastian Schuberth
03/29/2023, 3:03 PMHere's an example, with the line highlighted you're probably interested in: https://github.com/oss-review-toolkit/ort/blob/68f4fa173a17666bb71dbc8dcbc320252e2[…]ssets/projects/synthetic/gradle-library-expected-output-app.yml. Note that this is ORT's internal "SBOM" format. If you want something common like SPDX or CycloneDX, you'd have to also use the reporter tool.
r
Roberto Leinardi
03/29/2023, 3:11 PMYep, this output seems to contain the URLs I'm looking for. Does it have also the plugins from
gradlePluginPortal()s
Sebastian Schuberth
03/29/2023, 3:13 PMNo. That's indeed a problem regarding your use-case. We focus on runtime dependencies (sort of); Gradle plugins required during the build are out of scope for us.
r
Roberto Leinardi
03/29/2023, 3:15 PMmmm yeah, than I have to keep searching 😞
what about
gradle-dependency-exports
Sebastian Schuberth
03/29/2023, 3:16 PMI don't know. I've never used it myself, only looked at its source code partly.
r
Roberto Leinardi
03/29/2023, 3:16 PMI'll try it out, thanks!
Roberto Leinardi
03/29/2023, 4:40 PM@Sebastian Schuberth I'm trying to run the plugin but it complains about some Javadoc stuff, even if I set it to not exporting it, so I decide to get the code and try to see if I can get these dependencies but I'm stuck here:
Copy code
val componentIds = config.incoming.resolutionResult.allDependencies.map { it.selected.id }selectedselecteds
Sebastian Schuberth
03/29/2023, 4:42 PMYou probably need to cast
itResolvedDependencyResultSebastian Schuberth
03/29/2023, 4:42 PMselectedr
Roberto Leinardi
03/29/2023, 4:44 PMoh you are right! thanks a lot!
Roberto Leinardi
03/29/2023, 5:01 PMhey sorry to bother again but I'm not really familiar with Gradle plugins and, since you are and already looked at this code...
Would you say that these 4 fields are all
@Input Copy code
class MavenDependencyExport extends DefaultTask {
public Collection<Configuration> configurations = new LinkedHashSet<>()
public Map<String, Object> systemProperties = System.getProperties()
boolean exportSources
boolean exportJavadocs
Sebastian Schuberth
03/29/2023, 6:36 PMSorry, I'm not very familiar with Gradle plugin development per se.
r
Roberto Leinardi
03/29/2023, 6:38 PMno worries, thanks anyway 🙂
9 Views