jamesfredley commented on code in PR #15614:
URL: https://github.com/apache/grails-core/pull/15614#discussion_r3171193826
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -261,10 +261,20 @@ class SbomPlugin implements Plugin<Project> {
}
}
- // force the serialNumber to be reproducible by
removing it & recalculating
+ // force the serialNumber to be reproducible by
removing it & recalculating.
+ // Mix the projectPath into the UUID seed so two
modules whose post-processed
+ // BOM JSON happens to be identical (for example,
empty BOM platforms with no
+ // runtime dependencies, or modules whose
metadata.component is filled in
+ // identically by the CycloneDX plugin) still receive
distinct serialNumbers
+ // as required by the CycloneDX specification.
Including projectPath preserves
+ // reproducibility because the same project path +
same content always yields
+ // the same UUID across rebuilds. This guards against
collisions introduced by
+ // CycloneDX 3.0.0 / Gradle 9 metadata changes.
+ // See:
https://cyclonedx.org/docs/1.6/json/#serialNumber
bom['serialNumber'] = ''
def withOutSerial =
JsonOutput.prettyPrint(JsonOutput.toJson(bom))
Review Comment:
Good catch - updated the comment to say `clearing it` in 462b2f8d45 to match
the actual `bom['serialNumber'] = ''` behavior. Kept the blanking approach
(rather than `bom.remove`) so the field position is preserved in the JSON
output and existing serialNumbers stay byte-identical.
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -261,10 +261,20 @@ class SbomPlugin implements Plugin<Project> {
}
}
- // force the serialNumber to be reproducible by
removing it & recalculating
+ // force the serialNumber to be reproducible by
removing it & recalculating.
+ // Mix the projectPath into the UUID seed so two
modules whose post-processed
+ // BOM JSON happens to be identical (for example,
empty BOM platforms with no
+ // runtime dependencies, or modules whose
metadata.component is filled in
+ // identically by the CycloneDX plugin) still receive
distinct serialNumbers
+ // as required by the CycloneDX specification.
Including projectPath preserves
+ // reproducibility because the same project path +
same content always yields
+ // the same UUID across rebuilds. This guards against
collisions introduced by
+ // CycloneDX 3.0.0 / Gradle 9 metadata changes.
+ // See:
https://cyclonedx.org/docs/1.6/json/#serialNumber
bom['serialNumber'] = ''
def withOutSerial =
JsonOutput.prettyPrint(JsonOutput.toJson(bom))
- def uuid =
UUID.nameUUIDFromBytes(withOutSerial.getBytes(StandardCharsets.UTF_8.name()))
+ def uuidSeed = "${projectPath}\n${withOutSerial}"
Review Comment:
Renamed to `withoutSerial` (proper camelCase) in 462b2f8d45.
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -261,10 +261,20 @@ class SbomPlugin implements Plugin<Project> {
}
}
- // force the serialNumber to be reproducible by
removing it & recalculating
+ // force the serialNumber to be reproducible by
removing it & recalculating.
+ // Mix the projectPath into the UUID seed so two
modules whose post-processed
+ // BOM JSON happens to be identical (for example,
empty BOM platforms with no
+ // runtime dependencies, or modules whose
metadata.component is filled in
+ // identically by the CycloneDX plugin) still receive
distinct serialNumbers
+ // as required by the CycloneDX specification.
Including projectPath preserves
+ // reproducibility because the same project path +
same content always yields
+ // the same UUID across rebuilds. This guards against
collisions introduced by
+ // CycloneDX 3.0.0 / Gradle 9 metadata changes.
+ // See:
https://cyclonedx.org/docs/1.6/json/#serialNumber
bom['serialNumber'] = ''
def withOutSerial =
JsonOutput.prettyPrint(JsonOutput.toJson(bom))
- def uuid =
UUID.nameUUIDFromBytes(withOutSerial.getBytes(StandardCharsets.UTF_8.name()))
+ def uuidSeed = "${projectPath}\n${withOutSerial}"
+ def uuid =
UUID.nameUUIDFromBytes(uuidSeed.getBytes(StandardCharsets.UTF_8.name()))
Review Comment:
Switched to the `Charset` overload (`StandardCharsets.UTF_8`) in 462b2f8d45.
Re-ran `cyclonedxDirectBom` on the same six modules and confirmed all
`serialNumber` values are byte-identical to the prior commit, so this is purely
a cleanup with no behavior change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
