jdaugherty commented on code in PR #15614:
URL: https://github.com/apache/grails-core/pull/15614#discussion_r3171812163
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -140,7 +140,10 @@ class SbomPlugin implements Plugin<Project> {
configureNormalization(project)
ensureLicensesValidated(project)
- // sboms are only published to Grails jar files at this time
+ // sboms are only published to Grails jar files at this time. Projects
that produce a fat
Review Comment:
We should restore the original comment and remove this verbosity
##########
grails-forge/grails-cli-shadow/build.gradle:
##########
@@ -77,6 +77,12 @@ shadowJarTask.configure { ShadowJar it ->
it.exclude(
'META-INF/DEPENDENCIES', // until we publish our own SBOM, this
won't be correct so exclude
+ // This module does not apply org.apache.grails.buildsrc.sbom
(it's an intermediate build
+ // artifact, not published). Without this exclude, shadow's
first-wins merge picks one of
Review Comment:
we dont need such a long comment:
this is an intermediate build, exclude conflicting filed
##########
grails-forge/grails-cli/build.gradle:
##########
@@ -122,8 +133,27 @@ shadowJarTask.configure { ShadowJar it ->
'META-INF/DEPENDENCIES', // until we publish our own SBOM, this
won't be correct so exclude
'META-INF/grails-plugin.xml', // we do not start or compile a
grails application so these files are not needed (grails-core, url mappings,
etc plugins)
'META-INF/grails-plugin.xml.asc', // avoid signing artifacts
+ // Drop any incoming sbom.json that arrives via transitive jars
during the shadow merge;
+ // re-introduced below from this project's own cyclonedxDirectBom
output.
+ 'META-INF/sbom.json',
'about.html' // restatement of the Eclipse Distribution License -
Version 1.0 for jakarta
)
+
+ // Re-introduce this project's own SBOM after the merge (mirrors the
regular jar wiring done by
+ // the org.apache.grails.buildsrc.sbom plugin). Mirrored only when
skipJavaComponent is unset to
+ // match the convention used elsewhere in the build for projects that opt
out of jar publication.
+ if (!project.findProperty('skipJavaComponent')) {
+ it.from(cyclonedxDirectBomTask.flatMap { CyclonedxDirectTask t ->
t.jsonOutput }) { CopySpec spec ->
Review Comment:
flatMap is non lazy; isnt the json output the only output? If so just pass
the task here
##########
grails-forge/grails-cli/build.gradle:
##########
@@ -92,6 +93,16 @@ jarTask.configure { Jar it ->
}
}
+// The shadowJar merges multiple jars (including transitive ones from
grails-shell-cli, grails-forge-cli,
+// etc.) into a single fat jar. Each of those source jars carries its own
META-INF/sbom.json published by
+// the org.apache.grails.buildsrc.sbom convention plugin, and shadow's
first-wins merge would otherwise
+// pick a transitive sbom.json (typically grails-shell-cli's) and produce a
fat jar whose SBOM describes
+// the wrong module. We exclude any incoming META-INF/sbom.json during the
merge and then re-introduce
+// this project's own SBOM (whose serialNumber is project-path-seeded and
unique). This keeps fat-jar
+// packaging concerns local to this project rather than leaking shadow
knowledge into the generic
+// org.apache.grails.buildsrc.sbom plugin. See:
https://cyclonedx.org/docs/1.6/json/#serialNumber
+TaskProvider<CyclonedxDirectTask> cyclonedxDirectBomTask =
tasks.named('cyclonedxDirectBom', CyclonedxDirectTask)
Review Comment:
Move this into the configure since it doesn't appear to be used outside of it
##########
grails-forge/grails-cli/build.gradle:
##########
@@ -122,8 +133,27 @@ shadowJarTask.configure { ShadowJar it ->
'META-INF/DEPENDENCIES', // until we publish our own SBOM, this
won't be correct so exclude
'META-INF/grails-plugin.xml', // we do not start or compile a
grails application so these files are not needed (grails-core, url mappings,
etc plugins)
'META-INF/grails-plugin.xml.asc', // avoid signing artifacts
+ // Drop any incoming sbom.json that arrives via transitive jars
during the shadow merge;
+ // re-introduced below from this project's own cyclonedxDirectBom
output.
+ 'META-INF/sbom.json',
'about.html' // restatement of the Eclipse Distribution License -
Version 1.0 for jakarta
)
+
+ // Re-introduce this project's own SBOM after the merge (mirrors the
regular jar wiring done by
+ // the org.apache.grails.buildsrc.sbom plugin). Mirrored only when
skipJavaComponent is unset to
+ // match the convention used elsewhere in the build for projects that opt
out of jar publication.
+ if (!project.findProperty('skipJavaComponent')) {
+ it.from(cyclonedxDirectBomTask.flatMap { CyclonedxDirectTask t ->
t.jsonOutput }) { CopySpec spec ->
+ spec.into('META-INF')
+ spec.rename {
+ 'sbom.json'
+ }
+ }
+ it.manifest { Manifest manifest ->
+ manifest.attributes('Sbom-Location': 'META-INF/sbom.json')
Review Comment:
Is this added by the cyclonedx plugin already? Did you check the manifest
files? Do we do this anywhere else?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
