sub-projects use rootProject project metadata making them indistinguishable

[officerNordberg]

I have a main project with 2 sub projects. All three of these boms have the same group name version and consequently the same purl. pkg:maven/my-group/[email protected] These should use their subProject settings.

my-root-project\
|- build\
|  |- reports\
|     |- bom.json
|- project1
|  |- build\
|     |- reports\
|        |- bom.json
|- project2
|  |- build\
|     |- reports\
|        |- bom.json

Expected purls:

• pkg:maven/my-group/[email protected]
• pkg:maven/my-group/[email protected]
• pkg:maven/my-group/[email protected]

I can't see a reason for this code below only using getProject().getRootProject() but if there's some legit reason for this, it should at least be configurable.

https://github.com/CycloneDX/cyclonedx-gradle-plugin/blob/7d7bead5711601b5792b723eff4f71f6df07295f/src/main/java/org/cyclonedx/gradle/CycloneDxTask.java#L250-L264

[officerNordberg]

@stevespringett I have a fix for this in a fork, what's the process for getting eyes on this issue and then hopefully getting this into released code

[stevespringett]

Fantastic @officerNordberg. Please submit a pull request and ideally a unit test for the changes.

[officerNordberg]

nudge