jamesfredley commented on code in PR #15614:
URL: https://github.com/apache/grails-core/pull/15614#discussion_r3176546101
##########
grails-forge/grails-cli/build.gradle:
##########
@@ -122,8 +133,27 @@ shadowJarTask.configure { ShadowJar it ->
'META-INF/DEPENDENCIES', // until we publish our own SBOM, this
won't be correct so exclude
'META-INF/grails-plugin.xml', // we do not start or compile a
grails application so these files are not needed (grails-core, url mappings,
etc plugins)
'META-INF/grails-plugin.xml.asc', // avoid signing artifacts
+ // Drop any incoming sbom.json that arrives via transitive jars
during the shadow merge;
+ // re-introduced below from this project's own cyclonedxDirectBom
output.
+ 'META-INF/sbom.json',
'about.html' // restatement of the Eclipse Distribution License -
Version 1.0 for jakarta
)
+
+ // Re-introduce this project's own SBOM after the merge (mirrors the
regular jar wiring done by
+ // the org.apache.grails.buildsrc.sbom plugin). Mirrored only when
skipJavaComponent is unset to
+ // match the convention used elsewhere in the build for projects that opt
out of jar publication.
+ if (!project.findProperty('skipJavaComponent')) {
+ it.from(cyclonedxDirectBomTask.flatMap { CyclonedxDirectTask t ->
t.jsonOutput }) { CopySpec spec ->
+ spec.into('META-INF')
+ spec.rename {
+ 'sbom.json'
+ }
+ }
+ it.manifest { Manifest manifest ->
+ manifest.attributes('Sbom-Location': 'META-INF/sbom.json')
Review Comment:
I checked all three:
1. **Is this added by the cyclonedx plugin already?** No. Searched the
cyclonedx-gradle-plugin source (3.0.x and master) for `Sbom-Location` /
`Sbom-Format` and there are zero hits - the plugin does not touch the jar
manifest at all.
2. **Did you check the manifest files?** Yes. Extracted
`META-INF/MANIFEST.MF` from `grails-cli-8.0.0-SNAPSHOT.jar` (regular) and
`-all.jar` (fat) after `--rerun-tasks`:
- `Sbom-Location: META-INF/sbom.json`
- `Sbom-Format: CycloneDX`
Without the explicit `manifest { ... }` block on the shadowJar configure,
those entries vanish from the fat jar (shadow merges manifests but does not
regenerate the SBOM-pointing entries).
3. **Do we do this anywhere else?** Yes -
`SbomPlugin.publishSbomForJarProjects` adds the same two attributes to the
regular jar in the same module (lines 389-392). The shadow-jar wiring
intentionally mirrors that to keep both jars discoverable by downstream SBOM
consumers via the standard manifest header.
Left the manifest block in place; the entries are validated to appear in the
output.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
