jamesfredley commented on code in PR #15614:
URL: https://github.com/apache/grails-core/pull/15614#discussion_r3176545492
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy:
##########
@@ -140,7 +140,10 @@ class SbomPlugin implements Plugin<Project> {
configureNormalization(project)
ensureLicensesValidated(project)
- // sboms are only published to Grails jar files at this time
+ // sboms are only published to Grails jar files at this time. Projects
that produce a fat
Review Comment:
Done in 1144b74e8a - restored the original one-line // sboms are only
published to Grails jar files at this time comment. Now that the shadow-jar
wiring lives entirely in grails-cli/build.gradle, the verbose explanation in
the generic plugin is unnecessary.
##########
grails-forge/grails-cli/build.gradle:
##########
@@ -92,6 +93,16 @@ jarTask.configure { Jar it ->
}
}
+// The shadowJar merges multiple jars (including transitive ones from
grails-shell-cli, grails-forge-cli,
+// etc.) into a single fat jar. Each of those source jars carries its own
META-INF/sbom.json published by
+// the org.apache.grails.buildsrc.sbom convention plugin, and shadow's
first-wins merge would otherwise
+// pick a transitive sbom.json (typically grails-shell-cli's) and produce a
fat jar whose SBOM describes
+// the wrong module. We exclude any incoming META-INF/sbom.json during the
merge and then re-introduce
+// this project's own SBOM (whose serialNumber is project-path-seeded and
unique). This keeps fat-jar
+// packaging concerns local to this project rather than leaking shadow
knowledge into the generic
+// org.apache.grails.buildsrc.sbom plugin. See:
https://cyclonedx.org/docs/1.6/json/#serialNumber
+TaskProvider<CyclonedxDirectTask> cyclonedxDirectBomTask =
tasks.named('cyclonedxDirectBom', CyclonedxDirectTask)
Review Comment:
Done in 1144b74e8a - moved the cyclonedxDirectBomTask declaration inside the
shadowJarTask.configure { ... } block (and inside the skipJavaComponent guard,
since that is its only caller).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
