Matt Seil

Nevermind @kwwall this is easy. I figured out that you can leave your build package alone and just generate the metadata file. `mvn org.apache.felix:maven-bundle-plugin:manifest` Before a standard "mvn package" command...

I think this is too easy and simple not to just include it. The only thing I have to figure out is how to make sure it gets executed as...

I have a distinct feeling that the Eclipse foundations OSGI people aren't aware of or care about the SBOM. I think SBOM is the way of the future, but I...

I have to figure out forcing it to trigger, then I'll generate a PR. My thinking is more that the auto industry relies heavily on OSGI (I know from a...

I'll include the antisamy update on it as well

@zspitzer can you confirm that the only thing necessary would be the manifest dependency data? I'm digging down a rabbit hole: http://www.pnambic.com/home/2015/11/21/using-maven-to-bundle-non-osgi-third-party-libraries/ And I'm getting the picture that to enable...

[META-INF.zip](https://github.com/ESAPI/esapi-java-legacy/files/8142916/META-INF.zip) @kwwall --> Before I revert these changes, I THINK that for us to be OSGI compliant we'd have to accept their version of MANIFEST.MF. I've enclosed the differences in...

@zspitzer that doesn't *precisely* answer my question. What you show there is the result of using the bundle plugin. What I need to understand is if that manifest data--is sufficient...

So to be clear @kwwall, the NDA would be to gain access to the jarfiles used to analyze OSGI package compliance. I have absolutely no idea why an apache project...

@kwwall do you see anything that might conflict anywhere else with the manifest differences? **BEFORE:** ``` Manifest-Version: 1.0 Build-Jdk-Spec: 12 Specification-Title: ESAPI Specification-Version: 0.0 Specification-Vendor: The Open Web Application Security...