Copilot commented on code in PR #15614:
URL: https://github.com/apache/grails-core/pull/15614#discussion_r3171167352
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -261,10 +261,20 @@ class SbomPlugin implements Plugin<Project> {
}
}
- // force the serialNumber to be reproducible by
removing it & recalculating
+ // force the serialNumber to be reproducible by
removing it & recalculating.
+ // Mix the projectPath into the UUID seed so two
modules whose post-processed
+ // BOM JSON happens to be identical (for example,
empty BOM platforms with no
+ // runtime dependencies, or modules whose
metadata.component is filled in
+ // identically by the CycloneDX plugin) still receive
distinct serialNumbers
+ // as required by the CycloneDX specification.
Including projectPath preserves
+ // reproducibility because the same project path +
same content always yields
+ // the same UUID across rebuilds. This guards against
collisions introduced by
+ // CycloneDX 3.0.0 / Gradle 9 metadata changes.
+ // See:
https://cyclonedx.org/docs/1.6/json/#serialNumber
bom['serialNumber'] = ''
def withOutSerial =
JsonOutput.prettyPrint(JsonOutput.toJson(bom))
Review Comment:
The comment says the serialNumber is "remov[ed]" before recalculating, but
the code sets it to an empty string (`bom['serialNumber'] = ''`). Either update
the comment to match the behavior (blanking) or actually remove the key (e.g.,
`bom.remove('serialNumber')`) so the documentation and implementation stay
consistent.
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -261,10 +261,20 @@ class SbomPlugin implements Plugin<Project> {
}
}
- // force the serialNumber to be reproducible by
removing it & recalculating
+ // force the serialNumber to be reproducible by
removing it & recalculating.
+ // Mix the projectPath into the UUID seed so two
modules whose post-processed
+ // BOM JSON happens to be identical (for example,
empty BOM platforms with no
+ // runtime dependencies, or modules whose
metadata.component is filled in
+ // identically by the CycloneDX plugin) still receive
distinct serialNumbers
+ // as required by the CycloneDX specification.
Including projectPath preserves
+ // reproducibility because the same project path +
same content always yields
+ // the same UUID across rebuilds. This guards against
collisions introduced by
+ // CycloneDX 3.0.0 / Gradle 9 metadata changes.
+ // See:
https://cyclonedx.org/docs/1.6/json/#serialNumber
bom['serialNumber'] = ''
def withOutSerial =
JsonOutput.prettyPrint(JsonOutput.toJson(bom))
- def uuid =
UUID.nameUUIDFromBytes(withOutSerial.getBytes(StandardCharsets.UTF_8.name()))
+ def uuidSeed = "${projectPath}\n${withOutSerial}"
Review Comment:
Local variable name `withOutSerial` is hard to read and inconsistent with
typical camelCase (would usually be `withoutSerial`). Consider renaming for
clarity since it's now referenced in the new `uuidSeed` logic.
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -261,10 +261,20 @@ class SbomPlugin implements Plugin<Project> {
}
}
- // force the serialNumber to be reproducible by
removing it & recalculating
+ // force the serialNumber to be reproducible by
removing it & recalculating.
+ // Mix the projectPath into the UUID seed so two
modules whose post-processed
+ // BOM JSON happens to be identical (for example,
empty BOM platforms with no
+ // runtime dependencies, or modules whose
metadata.component is filled in
+ // identically by the CycloneDX plugin) still receive
distinct serialNumbers
+ // as required by the CycloneDX specification.
Including projectPath preserves
+ // reproducibility because the same project path +
same content always yields
+ // the same UUID across rebuilds. This guards against
collisions introduced by
+ // CycloneDX 3.0.0 / Gradle 9 metadata changes.
+ // See:
https://cyclonedx.org/docs/1.6/json/#serialNumber
bom['serialNumber'] = ''
def withOutSerial =
JsonOutput.prettyPrint(JsonOutput.toJson(bom))
- def uuid =
UUID.nameUUIDFromBytes(withOutSerial.getBytes(StandardCharsets.UTF_8.name()))
+ def uuidSeed = "${projectPath}\n${withOutSerial}"
+ def uuid =
UUID.nameUUIDFromBytes(uuidSeed.getBytes(StandardCharsets.UTF_8.name()))
Review Comment:
`uuidSeed.getBytes(StandardCharsets.UTF_8.name())` uses the String-based
charset overload; using the `Charset` overload
(`getBytes(StandardCharsets.UTF_8)`) avoids the extra lookup/string conversion
and makes the intent clearer.
```suggestion
def uuid =
UUID.nameUUIDFromBytes(uuidSeed.getBytes(StandardCharsets.UTF_8))
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
