jamesfredley opened a new pull request, #15614: URL: https://github.com/apache/grails-core/pull/15614
## Summary Fixes duplicate `urn:uuid` `serialNumber` values across SBOMs after the upgrade to Gradle 9 + CycloneDX gradle plugin 3.0.0. ## Problem SbomPlugin post-processes each module's BOM JSON and rewrites the `serialNumber` deterministically via `UUID.nameUUIDFromBytes(<json bytes>)` so rebuilds yield identical SBOMs (and therefore identical jar checksums). After moving to Gradle 9.4.1 and CycloneDX gradle plugin 3.0.0, several modules now produce post-processed JSON whose body collides between modules (most visibly the empty BOM platforms `grails-bom`, `grails-base-bom`, `grails-hibernate5-bom`, `grails-micronaut-bom`). Hashing identical content gives identical UUIDs, so the resulting SBOMs share the same `serialNumber` - which violates the [CycloneDX 1.6 spec for `serialNumber`](https://cyclonedx.org/docs/1.6/json/#serialNumber) (must be unique per BOM). ## Fix Mix the captured `projectPath` into the hash input: ` groovy def uuidSeed = "\n" def uuid = UUID.nameUUIDFromBytes(uuidSeed.getBytes(StandardCharsets.UTF_8.name())) ` - Different modules always seed the hash with a different prefix → unique `serialNumber` per BOM. - The same module + same content still yields the same UUID across rebuilds → reproducible builds preserved. - `projectPath` is already captured at configuration time (line 217), so no new `Task.project` access at execution time and no configuration-cache regression. ## Verification Ran `cyclonedxDirectBom` on six modules on Gradle 9.4.1: | Module | `serialNumber` | |---|---| | `:grails-base-bom` | `urn:uuid:1f5bfc59-8a1d-380b-9a65-69aac07e18b0` | | `:grails-bom` | `urn:uuid:70b08f03-ec8b-3b7b-9cb4-d76a6a21ad90` | | `:grails-hibernate5-bom` | `urn:uuid:f0a86eec-77f6-3236-aed3-d99f00933967` | | `:grails-micronaut-bom` | `urn:uuid:23919eca-e83e-3e5a-a27a-1a7b1ce5cc31` | | `:grails-bootstrap` | `urn:uuid:3fe6e19d-48e4-3097-810e-1b504da46be6` | | `:grails-encoder` | `urn:uuid:7c15d8fa-2a54-39a5-8b14-c87cfa0b012b` | - **Uniqueness**: all six `serialNumber` values are distinct. - **Determinism**: re-running `--rerun-tasks` produces the exact same six values. Reproducible-build verification via `etc/bin/test-reproducible-builds.sh` inside the `etc/bin/Dockerfile` container is being run separately to confirm jar checksums match across two clean builds. ## Notes - `build-logic/plugins` does not have a Spock test sourceset wired up today, matching the pattern of recent SBOM fixes (`54b718b526`, `8c5d1d182d`). Adding one would be a separate, larger change. - No public API changes; only the build-tooling plugin `org.apache.grails.buildsrc.sbom`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
