Skip to content

Commit a812ec9

Browse files
snazysnazy
committed
tmp
1 parent b657987 commit a812ec9

File tree

2 files changed

+136
-69
lines changed

2 files changed

+136
-69
lines changed

‎build-logic/src/main/kotlin/polaris-sbom-bundle.gradle.kts‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing,
13+
* software distributed under the License is distributed on an
14+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
* KIND, either express or implied. See the License for the
16+
* specific language governing permissions and limitations
17+
* under the License.
18+
*/
19+
20+
import java.util.Base64
21+
import org.cyclonedx.model.AttachmentText
22+
import org.cyclonedx.model.License
23+
import org.cyclonedx.model.LicenseChoice
24+
import org.cyclonedx.model.Property
25+
import org.gradle.plugins.signing.SigningExtension
26+
import publishing.GenerateDigest
27+
import sbom.CyclonedxBundleTask
28+
import sbom.createCyclonedxConfigurations
29+
30+
plugins { id("org.cyclonedx.bom") }
31+
32+
val bundleSboms by
33+
configurations.creating {
34+
isCanBeConsumed = false
35+
isCanBeResolved = true
36+
}
37+
38+
val cyclonedxBundleBom = tasks.register<CyclonedxBundleTask>("cyclonedxBundleBom")
39+
40+
cyclonedxBundleBom.configure {
41+
inputBoms = bundleSboms
42+
// The distribution itself has no dependencies, just components
43+
includeDependencies = false
44+
45+
val relativeProjectDir = project.projectDir.relativeTo(project.rootProject.projectDir)
46+
val gitInfo = GitInfo.memoized(project)
47+
48+
licenseChoice.set(
49+
LicenseChoice().apply {
50+
addLicense(
51+
License().apply {
52+
val gitCommit = GitInfo.memoized(project).gitHead
53+
id = "Apache-2.0"
54+
// TODO URL or text ??
55+
url = gitInfo.rawGithubLink("$relativeProjectDir/LICENSE")
56+
setLicenseText(
57+
AttachmentText().apply() {
58+
contentType = "plain/text"
59+
encoding = "base64"
60+
text = Base64.getEncoder().encodeToString(project.file("LICENSE").readBytes())
61+
}
62+
)
63+
64+
// TODO Is there a better way to include NOTICE + DISCLAIMER in a CycloneDX SBOM?
65+
val props = mutableListOf<org.cyclonedx.model.Property>()
66+
props.add(
67+
Property().apply {
68+
name = "NOTICE"
69+
value = project.file("NOTICE").readText(Charsets.UTF_8).replace("\n", "\\n")
70+
}
71+
)
72+
val disclaimerFile = project.file("DISCLAIMER")
73+
if (disclaimerFile.isFile) {
74+
props.add(
75+
Property().apply {
76+
name = "DISCLAIMER"
77+
value = disclaimerFile.readText(Charsets.UTF_8).replace("\n", "\\n")
78+
}
79+
)
80+
}
81+
properties = props
82+
}
83+
)
84+
}
85+
)
86+
}
87+
88+
createCyclonedxConfigurations(project, cyclonedxBundleBom)
89+
90+
tasks.named("assemble") { dependsOn(cyclonedxBundleBom) }
91+
92+
val digestJson =
93+
tasks.register<GenerateDigest>("digestCyclonedxBundleBomJson") {
94+
description = "Generate the distribution SBOM JSON digest"
95+
dependsOn(cyclonedxBundleBom)
96+
file.set(cyclonedxBundleBom.get().jsonOutput)
97+
}
98+
99+
val digestXml =
100+
tasks.register<GenerateDigest>("digestCyclonedxBundleBomXml") {
101+
description = "Generate the distribution SBOM XML digest"
102+
dependsOn(cyclonedxBundleBom)
103+
file.set(cyclonedxBundleBom.get().xmlOutput)
104+
}
105+
106+
cyclonedxBundleBom.configure {
107+
finalizedBy(digestJson)
108+
finalizedBy(digestXml)
109+
}
110+
111+
if (project.hasProperty("release") || project.hasProperty("signArtifacts")) {
112+
afterEvaluate {
113+
plugins.withType<SigningPlugin>().configureEach {
114+
configure<SigningExtension> {
115+
sign(configurations.getByName("cyclonedxBundleBomAll"))
116+
117+
tasks.named("signCyclonedxBundleBomAll") {
118+
dependsOn(cyclonedxBundleBom)
119+
}
120+
}
121+
}
122+
}
123+
}

‎runtime/distribution/build.gradle.kts‎

Lines changed: 13 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,6 @@
1717
* under the License.
1818
*/
1919

20-
import java.util.Base64
21-
import kotlin.apply
22-
import org.cyclonedx.model.AttachmentText
23-
import org.cyclonedx.model.License
24-
import org.cyclonedx.model.LicenseChoice
25-
import org.cyclonedx.model.Property
2620
import publishing.GenerateDigest
2721
import publishing.PublishingHelperPlugin
2822
import sbom.CyclonedxBundleTask
@@ -32,7 +26,7 @@ plugins {
3226
id("signing")
3327
id("polaris-spotless")
3428
id("polaris-reproducible")
35-
id("org.cyclonedx.bom")
29+
id("polaris-sbom-bundle")
3630
}
3731

3832
description = "Apache Polaris Binary Distribution"
@@ -55,17 +49,21 @@ val serverDistribution by
5549
isCanBeResolved = true
5650
}
5751

58-
val applicationsSboms by
59-
configurations.creating {
60-
isCanBeConsumed = false
61-
isCanBeResolved = true
62-
}
63-
6452
dependencies {
6553
adminDistribution(project(":polaris-admin", "distributionElements"))
6654
serverDistribution(project(":polaris-server", "distributionElements"))
67-
applicationsSboms(project(":polaris-admin", "cyclonedxDirectBomJson"))
68-
applicationsSboms(project(":polaris-server", "cyclonedxDirectBomJson"))
55+
bundleSboms(project(":polaris-admin", "cyclonedxDirectBomJson"))
56+
bundleSboms(project(":polaris-server", "cyclonedxDirectBomJson"))
57+
}
58+
59+
tasks.named<CyclonedxBundleTask>("cyclonedxBundleBom") {
60+
val baseName = distributions.main.get().distributionBaseName.get()
61+
jsonOutput.set(
62+
project.layout.buildDirectory.file("distributions/$baseName-$version.cyclonedx.json")
63+
)
64+
xmlOutput.set(
65+
project.layout.buildDirectory.file("distributions/$baseName-$version.cyclonedx.xml")
66+
)
6967
}
7068

7169
distributions {
@@ -92,60 +90,6 @@ distributions {
9290
}
9391
}
9492

95-
tasks.register<CyclonedxBundleTask>("cyclonedxBundleBom") {
96-
val baseName = distributions.main.get().distributionBaseName.get()
97-
jsonOutput.set(project.layout.buildDirectory.file("distributions/$baseName-$version.json"))
98-
xmlOutput.set(project.layout.buildDirectory.file("distributions/$baseName-$version.xml"))
99-
100-
inputBoms = applicationsSboms
101-
// The distribution itself has no dependencies, just components
102-
includeDependencies = false
103-
104-
val relativeProjectDir = project.projectDir.relativeTo(project.rootProject.projectDir)
105-
val gitInfo = GitInfo.memoized(project)
106-
107-
licenseChoice.set(
108-
LicenseChoice().apply {
109-
addLicense(
110-
License().apply {
111-
val gitCommit = GitInfo.memoized(project).gitHead
112-
id = "Apache-2.0"
113-
// TODO URL or text ??
114-
url = gitInfo.rawGithubLink("$relativeProjectDir/LICENSE")
115-
setLicenseText(
116-
AttachmentText().apply() {
117-
contentType = "plain/text"
118-
encoding = "base64"
119-
text = Base64.getEncoder().encodeToString(project.file("LICENSE").readBytes())
120-
}
121-
)
122-
123-
// TODO Is there a better way to include NOTICE + DISCLAIMER in a CycloneDX SBOM?
124-
val props = mutableListOf<org.cyclonedx.model.Property>()
125-
props.add(
126-
Property().apply {
127-
name = "NOTICE"
128-
value = project.file("NOTICE").readText(Charsets.UTF_8).replace("\n", "\\n")
129-
}
130-
)
131-
val disclaimerFile = project.file("DISCLAIMER")
132-
if (disclaimerFile.isFile) {
133-
props.add(
134-
Property().apply {
135-
name = "DISCLAIMER"
136-
value = disclaimerFile.readText(Charsets.UTF_8).replace("\n", "\\n")
137-
}
138-
)
139-
}
140-
properties = props
141-
}
142-
)
143-
}
144-
)
145-
}
146-
147-
tasks.named("assemble") { dependsOn("cyclonedxBundleBom") }
148-
14993
val distTar = tasks.named<Tar>("distTar") { compression = Compression.GZIP }
15094

15195
val distZip = tasks.named<Zip>("distZip") {}

0 commit comments

Comments
 (0)