Skip to content

Commit

Permalink
Add p2-aware model converter for CycloneDX SBOM generation
Browse files Browse the repository at this point in the history
This change consists of two parts. The first part consists of generating
a valid package URL for a given p2 artifact. The PURL contains the
symbolic name, version and classifier of the artifact key, as well as
the repository it is located in.
The second part handles the dependencies between two PURLs. For the sake
of consistency, this dependency tree matches the tree calculated by the
dependency-tree mojo.
  • Loading branch information
ptziegler committed Feb 8, 2024
1 parent eb1f45e commit ae8181f
Show file tree
Hide file tree
Showing 19 changed files with 996 additions and 6 deletions.
19 changes: 19 additions & 0 deletions RELEASE_NOTES.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,25 @@ If you are reading this in the browser, then you can quickly jump to specific ve

## 5.0.0 (under development)

### Support for CycloneDX Maven Plugin

The `tycho-sbom` plugin can be added as a dependency to the CycloneDX plugin,
in order to handle the PURL creation of p2 artifacts:

```
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<dependencies>
<dependency>
<groupId>org.eclipse.tycho</groupId>
<artifactId>tycho-sbom</artifactId>
<version>${tycho-version}</version>
</dependency>
</dependencies>
</plugin>
```

### Support for parallel execution of product assembly / archiving

The mojos `materialize-products` and `archive-products` now support a new `<parallel>` parameter
Expand Down
3 changes: 2 additions & 1 deletion pom.xml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
- Copyright (c) 2008, 2022 Sonatype Inc. and others.
- Copyright (c) 2008, 2024 Sonatype Inc. and others.
- All rights reserved. This program and the accompanying materials
- are made available under the terms of the Eclipse Public License v1.0
- which accompanies this distribution, and is available at
Expand Down Expand Up @@ -542,6 +542,7 @@
<module>tycho-ds-plugin</module>
<module>tycho-buildtimestamp-jgit</module>
<module>tycho-baseline-plugin</module>
<module>tycho-sbom</module>
<!-- surefire -->
<module>tycho-surefire</module>
<!-- release -->
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*******************************************************************************
* Copyright (c) 2023 Christoph Läubrich and others.
* Copyright (c) 2023, 2024 Christoph Läubrich and others.
* All rights reserved. This program and the accompanying materials
* are made available under the terms of the Eclipse Public License v1.0
* which accompanies this distribution, and is available at
Expand Down Expand Up @@ -67,7 +67,7 @@ public File findArtifact(Artifact artifact) {
}).orElse(null);
}

private Optional<MavenProject> getTychoReactorProject(Artifact artifact) {
public Optional<MavenProject> getTychoReactorProject(Artifact artifact) {
if (isTychoReactorArtifact(artifact)) {
String projectKey = ArtifactUtils.key(artifact.getGroupId(), artifact.getArtifactId(),
artifact.getVersion());
Expand All @@ -81,13 +81,20 @@ private Optional<MavenProject> getTychoReactorProject(Artifact artifact) {
return Optional.empty();
}

private boolean isTychoReactorArtifact(Artifact artifact) {
public boolean isTychoReactorArtifact(Artifact artifact) {
if (artifact.getClassifier() == null || artifact.getClassifier().isBlank()) {
return PackagingType.TYCHO_PACKAGING_TYPES.contains(artifact.getProperty("type", ""));
return PackagingType.TYCHO_PACKAGING_TYPES.contains(getPackagingType(artifact));
}
return false;
}

public String getPackagingType(Artifact artifact) {
if (artifact != null) {
return artifact.getProperty("type", "");
}
return null;
}

@Override
public List<String> findVersions(Artifact artifact) {
return getTychoReactorProject(artifact).map(project -> List.of(artifact.getVersion())).orElse(List.of());
Expand Down
8 changes: 7 additions & 1 deletion tycho-its/pom.xml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
- Copyright (c) 2008, 2022 Sonatype Inc. and others.
- Copyright (c) 2008, 2024 Sonatype Inc. and others.
- All rights reserved. This program and the accompanying materials
- are made available under the terms of the Eclipse Public License v1.0
- which accompanies this distribution, and is available at
Expand Down Expand Up @@ -214,6 +214,12 @@
<version>3.1.0</version>
<scope>test</scope>
</dependency>
<!-- sbom tests -->
<dependency>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-core-java</artifactId>
<version>8.0.3</version>
</dependency>

<!-- artifacts to be tested -->
<dependency>
Expand Down
8 changes: 8 additions & 0 deletions tycho-its/projects/sbom/.mvn/extensions.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<extensions>
<extension>
<groupId>org.eclipse.tycho</groupId>
<artifactId>tycho-build</artifactId>
<version>${tycho-version}</version>
</extension>
</extensions>
1 change: 1 addition & 0 deletions tycho-its/projects/sbom/.mvn/maven.config
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
-Dtycho-version=5.0.0-SNAPSHOT
1 change: 1 addition & 0 deletions tycho-its/projects/sbom/example.feature/build.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
bin.includes = feature.xml
23 changes: 23 additions & 0 deletions tycho-its/projects/sbom/example.feature/feature.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
<?xml version="1.0" encoding="UTF-8"?>
<feature
id="example.feature"
label="Feature with SBOM"
version="1.0.0.qualifier">

<description url="http://www.example.com/description">
[Enter Feature Description here.]
</description>

<copyright url="http://www.example.com/copyright">
[Enter Copyright Description here.]
</copyright>

<license url="http://www.example.com/license">
[Enter License Description here.]
</license>

<plugin
id="example.plugin"
version="0.0.0"/>

</feature>
11 changes: 11 additions & 0 deletions tycho-its/projects/sbom/example.plugin/META-INF/MANIFEST.MF
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
Manifest-Version: 1.0
Bundle-ManifestVersion: 2
Bundle-Name: Plugin with SBOM
Bundle-SymbolicName: example.plugin
Bundle-Version: 1.0.0.qualifier
Require-Bundle: org.eclipse.core.databinding;bundle-version="1.13.100",
org.eclipse.core.databinding.beans;bundle-version="1.10.100",
org.eclipse.core.databinding.observable;bundle-version="1.13.100",
org.eclipse.core.databinding.property;bundle-version="1.10.100"
Automatic-Module-Name: example.plugin
Bundle-RequiredExecutionEnvironment: JavaSE-17
4 changes: 4 additions & 0 deletions tycho-its/projects/sbom/example.plugin/build.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
source.. = src/
output.. = bin/
bin.includes = META-INF/,\
.
86 changes: 86 additions & 0 deletions tycho-its/projects/sbom/pom.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,86 @@
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>tycho-demo</groupId>
<artifactId>sbom</artifactId>
<version>1.0.0-SNAPSHOT</version>
<packaging>pom</packaging>

<properties>
<tycho-version>5.0.0-SNAPSHOT</tycho-version>
<tycho.sbom.url>https://www.example.p2.repo/</tycho.sbom.url>
</properties>

<modules>
<module>example.feature</module>
<module>example.plugin</module>
<module>product</module>
<module>repository</module>
</modules>

<build>
<plugins>
<plugin>
<groupId>org.eclipse.tycho</groupId>
<artifactId>tycho-maven-plugin</artifactId>
<version>${tycho-version}</version>
<extensions>true</extensions>
</plugin>
<plugin>
<groupId>org.eclipse.tycho</groupId>
<artifactId>target-platform-configuration</artifactId>
<version>${tycho-version}</version>
<configuration>
<target>
<file>../target-definition.target</file>
</target>
<environments>
<environment>
<os>linux</os>
<ws>gtk</ws>
<arch>x86_64</arch>
</environment>
</environments>
</configuration>
</plugin>
<plugin>
<groupId>org.eclipse.tycho</groupId>
<artifactId>tycho-packaging-plugin</artifactId>
<version>${tycho-version}</version>
<configuration>
<forceContextQualifier>today</forceContextQualifier>
</configuration>
</plugin>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<version>2.7.9</version>
<configuration>
<includeTestScope>true</includeTestScope>
</configuration>
<executions>
<execution>
<goals>
<goal>makeBom</goal>
</goals>
</execution>
</executions>
<dependencies>
<dependency>
<groupId>org.eclipse.tycho</groupId>
<artifactId>tycho-sbom</artifactId>
<version>${tycho-version}</version>
</dependency>
</dependencies>
</plugin>
</plugins>
<pluginManagement>
<plugins>
<plugin>
<groupId>org.eclipse.tycho</groupId>
<artifactId>tycho-p2-director-plugin</artifactId>
<version>${tycho-version}</version>
</plugin>
</plugins>
</pluginManagement>
</build>
</project>
29 changes: 29 additions & 0 deletions tycho-its/projects/sbom/product/example.product
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
<?xml version="1.0" encoding="UTF-8"?>
<?pde version="3.5"?>

<product uid="example" version="1.0.0.qualifier" type="mixed" includeLaunchers="true" autoIncludeRequirements="false">

<configIni use="default">
</configIni>

<launcherArgs>
<vmArgsMac>-XstartOnFirstThread -Dorg.eclipse.swt.internal.carbon.smallFonts
</vmArgsMac>
</launcherArgs>

<plugins>
<plugin id="example.plugin"/>
<plugin id="org.eclipse.core.databinding"/>
<plugin id="org.eclipse.core.databinding.beans"/>
<plugin id="org.eclipse.core.databinding.observable"/>
<plugin id="org.eclipse.core.databinding.property"/>
<plugin id="org.eclipse.equinox.common"/>
<plugin id="org.eclipse.osgi"/>
</plugins>

<features>
<feature id="example.feature" installMode="root"/>
</features>


</product>
5 changes: 5 additions & 0 deletions tycho-its/projects/sbom/repository/category.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
<?xml version="1.0" encoding="UTF-8"?>
<site>
<feature id="example.feature"/>
<bundle id="example.plugin"/>
</site>
11 changes: 11 additions & 0 deletions tycho-its/projects/sbom/target-definition.target
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<?pde version="3.8"?>
<target name="target-definition">
<locations>
<location includeAllPlatforms="false" includeConfigurePhase="true" includeMode="planner" includeSource="true" type="InstallableUnit">
<repository location="https://download.eclipse.org/releases/2023-12/"/>
<unit id="org.eclipse.sdk.feature.group" version="0.0.0"/>
<unit id="org.eclipse.equinox.sdk.feature.group" version="0.0.0"/>
</location>
</locations>
</target>
Loading

0 comments on commit ae8181f

Please sign in to comment.