SBOM for jetty version 9.4.56

[akrattan]

Hello Team,
I am looking for SBOM for Jetty version 9.4.56. from where i can get it?

[joakime]

Jetty 9.x is EOL (End of Life) and has no support.

• EOL (End of Life) for Jetty 9 - January 2025 #7958
• EOL (End of Life) for Jetty 10 / Jetty 11 - January 2025 #10485

If you require a SBOM, use the supported version of Jetty.
As of today, that is Jetty 12.

Jetty 12 does have an SBOM, and it is found along side the jetty-home artifact as a cyclonedx classified sub-artifacts (available in both XML and JSON formats)

• The jetty-home artifacts available for Jetty 12.0.21 - https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/12.0.21/
• The SBOM in XML format - https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/12.0.21/jetty-home-12.0.21-cyclonedx.xml
• The SBOM in JSON format - https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/12.0.21/jetty-home-12.0.21-cyclonedx.json

[akrattan]

it this SBOM contains transitive or indirect 3PPs and till what level?

[joakime]

Best if you read the CycloneDX docs.

• https://cyclonedx.org/

We generate at release time, using the official maven plugin org.cyclonedx:cyclonedx-maven-plugin.

• https://github.com/jetty/jetty.project/blob/jetty-12.0.22/pom.xml#L1681-L1692