support for `maven-shade-plugin`

[raboof]

When using maven-shade-plugin, the sbom should likely somehow encode which dependencies are 'embedded' in the jar, and which are 'regular' dependencies.

AFAIK there is no convention on how to express this difference yet in CycloneDX. Likely it would make sense to make use of the assembly concept?

I have a test/demo project for this at https://github.com/raboof/maven-shade-sbom/

[stevespringett]

Yes, using a CycloneDX assembly would be the correct way to represent this.

[prabhu]

evidence.identity can also be used to describe the technique and confidence.

[ppkarwasz]

@stevespringett,

By assembly do you mean components.components or something else?

[stevespringett]

Correct @ppkarwasz