Repository navigation
Feature - Include sbom for KeyCloak release #9448
Description
Description
Currently there's no bom (cyclonedx 1.3) for which dependencies the appliation release itself uses.
It would be neat if either:
- a maven build could produce an output (which could be suggested as an option in the readme.md)
- the release itself had a link to a complete bom file for a given release
Discussion
No response
Motivation
Dependecies such as log4j has revealed the need to get an overview of any given dependencies in an application.
Currently to produce the bom file with complete overview of the dependencies for KeyCloak, a computer with the correct maven setup is required. Knowledge of maven and how the KeyCloak build is setup, is also required.
Details
No response
Reacted by Vinod Anandan, Wes Jordan, Rob Lazzurs, Maximilian Csuk, DLoT, Bragolgirith, Lunkwill-Fook, Sascha Siegl, nicomoya123, Ryan Hartje and 17 more
Metadata
Metadata
Assignees
Type
Fields
Value
None yet
Effort
None yet
Votes
27
Projects
- Status
Activity
[-]Feature - Include sbom for application release[/-][+]Feature - Include sbom for KeyCloak release[/+]dpulrichth commentedon Nov 21, 2023
We would certainly appreciate a CycloneDX SBOM being published together with the actual binaries. It would greatly help with CVE management. While we regularly scan Keycloak docker images using trivy and aqua, those scanners tend to miss some of the more deeply nested dependencies. Scanners don't seem to have a standardized way of reporting findings, making the reports hard to analyze programmatically. Both of these problems could be solved by SBOMs, especially when paired with an SBOM management tool such as DependenyTrack or Fossa.
I have been able to produce a Keycloak 22.0.5 SBOM using https://github.com/CycloneDX/cyclonedx-maven-plugin by adding it to the root pom.xml inside the
<build></build>section, so technically it is possible to produce the SBOM. However, it may be necessary to produce more finely grained SBOMs, since this aggregate SBOM contains all the dependencies of all the modules in the reactor. For instance, the SBOM shows that there are vulnerable dependencies inside the Spring Boot adapter projects. While those findings are relevant for anyone using those adapters, they may not necessarily be relevant for someone running the actual keycloak server.I am not familiar enough with the many build profiles defined inside the root pom to decide where to add it properly and to submit a PR. I also do not know what the best way of publishing the SBOM would be. My best guess would be to add to the
Assetssection of the GitHub release.idunbarh commentedon Aug 6, 2024
I'm part of a tiger team working on SBOM Generation Reference Implementations and happy to help here.
Cross posting with SBOM Generation Idea.
phillipc commentedon Jul 17, 2026
Good topic: It would be easy to generate using Syft. In various formats, too.
syft scan dir:./keycloak -o cyclonedx-json > keycloak_sbom_cdx.jsonA GitHub Action would also be available: https://github.com/anchore/sbom-action
mabartos commentedon Aug 4, 2026
@vmuzikar @keycloak/cloud-native Quarkus provides the SBOM functionality live on the server, so it should be possible to also have it included as a release artifact -> Check it out: https://quarkus.io/blog/quarkus-3-36-released/#embedded-dependency-sboms