phoedos/pmd
1
1
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #4462 from adangel/create-sbom

Browse Source 
Provide Software Bill of Materials (SBOM)
This commit is contained in:
Juan Martín Sotuyo Dodero
2023-04-19 00:08:00 -03:00
committed by GitHub
parent 1789014dc6 a4893b964b
commit 08d362aa66
5 changed files with 51 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.ci/build.sh
View File

@ -179,6 +179,11 @@ function pmd_ci_deploy_build_artifacts() {
# Deploy to sourceforge files https://sourceforge.net/projects/pmd/files/pmd/
pmd_ci_sourceforge_uploadFile "pmd/${PMD_CI_MAVEN_PROJECT_VERSION}" "pmd-dist/target/pmd-bin-${PMD_CI_MAVEN_PROJECT_VERSION}.zip"
pmd_ci_sourceforge_uploadFile "pmd/${PMD_CI_MAVEN_PROJECT_VERSION}" "pmd-dist/target/pmd-src-${PMD_CI_MAVEN_PROJECT_VERSION}.zip"
# Deploy SBOM
cp pmd-dist/target/bom.xml "pmd-dist/target/pmd-${PMD_CI_MAVEN_PROJECT_VERSION}-cyclonedx.xml"
cp pmd-dist/target/bom.json "pmd-dist/target/pmd-${PMD_CI_MAVEN_PROJECT_VERSION}-cyclonedx.json"
pmd_ci_sourceforge_uploadFile "pmd/${PMD_CI_MAVEN_PROJECT_VERSION}" "pmd-dist/target/pmd-${PMD_CI_MAVEN_PROJECT_VERSION}-cyclonedx.xml"
pmd_ci_sourceforge_uploadFile "pmd/${PMD_CI_MAVEN_PROJECT_VERSION}" "pmd-dist/target/pmd-${PMD_CI_MAVEN_PROJECT_VERSION}-cyclonedx.json"
if pmd_ci_maven_isReleaseBuild; then
# create a draft github release
@ -188,6 +193,9 @@ function pmd_ci_deploy_build_artifacts() {
# Deploy to github releases
pmd_ci_gh_releases_uploadAsset "$GH_RELEASE" "pmd-dist/target/pmd-bin-${PMD_CI_MAVEN_PROJECT_VERSION}.zip"
pmd_ci_gh_releases_uploadAsset "$GH_RELEASE" "pmd-dist/target/pmd-src-${PMD_CI_MAVEN_PROJECT_VERSION}.zip"
# Deploy SBOM
pmd_ci_gh_releases_uploadAsset "$GH_RELEASE" "pmd-dist/target/pmd-${PMD_CI_MAVEN_PROJECT_VERSION}-cyclonedx.xml"
pmd_ci_gh_releases_uploadAsset "$GH_RELEASE" "pmd-dist/target/pmd-${PMD_CI_MAVEN_PROJECT_VERSION}-cyclonedx.json"
fi
}

3
docs/pages/release_notes.md
View File

@ -40,6 +40,8 @@ This section lists the most important changes from the last release candidate.
The remaining section describe the complete release notes for 7.0.0.
Fixed Issues:
* miscellaneous
* [#4462](https://github.com/pmd/pmd/issues/4462): Provide Software Bill of Materials (SBOM)
* java-codestyle
* [#4273](https://github.com/pmd/pmd/issues/4273): \[java] CommentDefaultAccessModifier ignoredAnnotations should include "org.junit.jupiter.api.extension.RegisterExtension" by default
* java-errorprone
@ -208,6 +210,7 @@ See [Detailed Release Notes for PMD 7](pmd_release_notes_pmd7.html).
* [#2497](https://github.com/pmd/pmd/issues/2497): PMD 7 Logo page
* [#2498](https://github.com/pmd/pmd/issues/2498): Update PMD 7 Logo in documentation
* [#3797](https://github.com/pmd/pmd/issues/3797): \[all] Use JUnit5
* [#4462](https://github.com/pmd/pmd/issues/4462): Provide Software Bill of Materials (SBOM)
* ant
* [#4080](https://github.com/pmd/pmd/issues/4080): \[ant] Split off Ant integration into a new submodule
* core

13
pmd-dist/src/main/resources/assemblies/pmd-bin.xml
View File

@ -53,6 +53,19 @@
</fileSet>
</fileSets>
<files>
<file>
<source>target/bom.xml</source>
<outputDirectory>sbom</outputDirectory>
<destName>pmd-${project.version}-cyclonedx.xml</destName>
</file>
<file>
<source>target/bom.json</source>
<outputDirectory>sbom</outputDirectory>
<destName>pmd-${project.version}-cyclonedx.json</destName>
</file>
</files>
<dependencySets>
<!-- shell completion goes to shell/ -->
<dependencySet>

2
pmd-dist/src/test/java/net/sourceforge/pmd/it/BinaryDistributionIT.java
View File

@ -87,6 +87,8 @@ class BinaryDistributionIT extends AbstractBinaryDistributionTest {
result.add(basedir + "shell/pmd-completion.sh");
result.add(basedir + "lib/pmd-core-" + PMDVersion.VERSION + ".jar");
result.add(basedir + "lib/pmd-java-" + PMDVersion.VERSION + ".jar");
result.add(basedir + "sbom/pmd-" + PMDVersion.VERSION + "-cyclonedx.xml");
result.add(basedir + "sbom/pmd-" + PMDVersion.VERSION + "-cyclonedx.json");
return result;
}

25
pom.xml
View File

@ -503,6 +503,11 @@
<artifactId>jacoco-maven-plugin</artifactId>
<version>0.8.8</version>
</plugin>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<version>2.7.6</version>
</plugin>
<!--This plugin's configuration is used to store Eclipse
m2e settings only. It has no influence on the Maven build itself. -->
<plugin>
@ -624,6 +629,26 @@
<nexusUrl>https://oss.sonatype.org/</nexusUrl>
</configuration>
</plugin>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<executions>
<execution>
<phase>package</phase>
<goals>
<goal>makeAggregateBom</goal>
</goals>
</execution>
</executions>
<!-- https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/326 -->
<dependencies>
<dependency>
<groupId>org.ow2.asm</groupId>
<artifactId>asm</artifactId>
<version>9.5</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</build>