Merge pull request #416 from ppkarwasz/non-deployed

[409] Removes non-deployed artifacts from SBOM

src/it/makeAggregateBom/pom.xml

@@ -79,6 +79,7 @@
  <modules>
  <module>api</module>
  <module>impls</module>
+ <module>skipped</module>
  <module>util</module>
  </modules>
 

src/it/makeAggregateBom/skipped/deploy-config/pom.xml

@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ This file is part of CycloneDX Maven Plugin.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ SPDX-License-Identifier: Apache-2.0
+ Copyright (c) OWASP Foundation. All Rights Reserved.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.cyclonedx.its</groupId>
+ <artifactId>skipped</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ </parent>
+ <artifactId>deploy-config</artifactId>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-deploy-plugin</artifactId>
+ <version>3.1.1</version>
+ <configuration>
+ <skip>true</skip>
+ </configuration>
+ </plugin>
+ </plugins>
+ </build>
+</project>

src/it/makeAggregateBom/skipped/deploy-property/pom.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ This file is part of CycloneDX Maven Plugin.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ SPDX-License-Identifier: Apache-2.0
+ Copyright (c) OWASP Foundation. All Rights Reserved.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.cyclonedx.its</groupId>
+ <artifactId>skipped</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ </parent>
+ <artifactId>deploy-property</artifactId>
+
+ <properties>
+ <maven.deploy.skip>true</maven.deploy.skip>
+ </properties>
+</project>

src/it/makeAggregateBom/skipped/nexus-config/pom.xml

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ This file is part of CycloneDX Maven Plugin.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ SPDX-License-Identifier: Apache-2.0
+ Copyright (c) OWASP Foundation. All Rights Reserved.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.cyclonedx.its</groupId>
+ <artifactId>skipped</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ </parent>
+ <artifactId>nexus-config</artifactId>
+
+ <properties>
+ <skipNexusStagingDeployMojo>true</skipNexusStagingDeployMojo>
+ </properties>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.sonatype.plugins</groupId>
+ <artifactId>nexus-staging-maven-plugin</artifactId>
+ <version>1.6.8</version>
+ <extensions>true</extensions>
+ <configuration>
+ <skipNexusStagingDeployMojo>true</skipNexusStagingDeployMojo>
+ </configuration>
+ </plugin>
+ </plugins>
+ </build>
+</project>

src/it/makeAggregateBom/skipped/nexus-property/pom.xml

@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ This file is part of CycloneDX Maven Plugin.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ SPDX-License-Identifier: Apache-2.0
+ Copyright (c) OWASP Foundation. All Rights Reserved.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.cyclonedx.its</groupId>
+ <artifactId>skipped</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ </parent>
+ <artifactId>nexus-property</artifactId>
+
+ <properties>
+ <skipNexusStagingDeployMojo>true</skipNexusStagingDeployMojo>
+ </properties>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.sonatype.plugins</groupId>
+ <artifactId>nexus-staging-maven-plugin</artifactId>
+ <version>1.6.8</version>
+ <extensions>true</extensions>
+ </plugin>
+ </plugins>
+ </build>
+</project>

src/it/makeAggregateBom/skipped/pom.xml

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ This file is part of CycloneDX Maven Plugin.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+ SPDX-License-Identifier: Apache-2.0
+ Copyright (c) OWASP Foundation. All Rights Reserved.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.cyclonedx.its</groupId>
+ <artifactId>makeAggregateBom</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ </parent>
+ <artifactId>skipped</artifactId>
+ <packaging>pom</packaging>
+
+ <modules>
+ <module>deploy-property</module>
+ <module>deploy-config</module>
+ <module>nexus-property</module>
+ <module>nexus-config</module>
+ </modules>
+</project>

src/it/makeAggregateBom/verify.groovy

@@ -15,25 +15,39 @@ void assertBomFiles(String path, boolean aggregate) {
  assert bomFileJson.text.contains('"value" : "compile,provided,runtime,system"')
 }
 
+void assertNoBomFiles(String path) {
+ File bomFileXml = new File(basedir, path + ".xml")
+ File bomFileJson = new File(basedir, path + ".json")
+
+ assert !bomFileXml.exists()
+ assert !bomFileJson.exists()
+}
+
 assertBomFiles("target/bom", true) // aggregate
 assertBomFiles("api/target/bom", false)
 assertBomFiles("util/target/bom", false)
 assertBomFiles("impls/target/bom", false)
 assertBomFiles("impls/impl-A/target/bom", false)
 assertBomFiles("impls/impl-B/target/bom", false)
+assertBomFiles("skipped/target/bom", false)
+
+assertNoBomFiles("skipped/deploy-config/target/bom")
+assertNoBomFiles("skipped/deploy-property/target/bom")
+assertNoBomFiles("skipped/nexus-config/target/bom")
+assertNoBomFiles("skipped/nexus-property/target/bom")
 
 var buildLog = new File(basedir, "build.log").text
 
-assert 11 == (buildLog =~ /\[INFO\] CycloneDX: Resolving Dependencies/).size()
+assert 13 == (buildLog =~ /\[INFO\] CycloneDX: Resolving Dependencies/).size()
 assert 2 == (buildLog =~ /\[INFO\] CycloneDX: Resolving Aggregated Dependencies/).size()
 
-// 13 = 6 modules for main cyclonedx-makeAggregateBom execution
+// 15 = 7 modules for main cyclonedx-makeAggregateBom execution
 // + 1 for root module cyclonedx-makeAggregateBom-root-only execution
-// + 6 modules for additional cyclonedx-makeBom execution
-assert 13 == (buildLog =~ /\[INFO\] CycloneDX: Writing and validating BOM \(XML\)/).size()
-assert 13 == (buildLog =~ /\[INFO\] CycloneDX: Writing and validating BOM \(JSON\)/).size()
+// + 7 modules for additional cyclonedx-makeBom execution
+assert 15 == (buildLog =~ /\[INFO\] CycloneDX: Writing and validating BOM \(XML\)/).size()
+assert 15 == (buildLog =~ /\[INFO\] CycloneDX: Writing and validating BOM \(JSON\)/).size()
 // cyclonedx-makeAggregateBom-root-only execution skips 5 non-root modules
-assert 5 == (buildLog =~ /\[INFO\] Skipping CycloneDX on non-execution root/).size()
+assert 6 == (buildLog =~ /\[INFO\] Skipping CycloneDX on non-execution root/).size()
 
 // [WARNING] artifact org.cyclonedx.its:api:xml:cyclonedx:1.0-SNAPSHOT already attached, replace previous instance
 assert 0 == (buildLog =~ /-SNAPSHOT already attached, replace previous instance/).size()
@@ -65,4 +79,5 @@ String rootDependencies = bom.substring(bom.indexOf('<dependency ref="pkg:maven/
 assert rootDependencies.contains('<dependency ref="pkg:maven/org.cyclonedx.its/api@1.0-SNAPSHOT?type=jar"/>')
 assert rootDependencies.contains('<dependency ref="pkg:maven/org.cyclonedx.its/impls@1.0-SNAPSHOT?type=pom"/>')
 assert rootDependencies.contains('<dependency ref="pkg:maven/org.cyclonedx.its/util@1.0-SNAPSHOT?type=jar"/>')
-assert 4 == (rootDependencies =~ /<dependency ref="pkg:maven/).size()
+assert rootDependencies.contains('<dependency ref="pkg:maven/org.cyclonedx.its/skipped@1.0-SNAPSHOT?type=pom"/>')
+assert 5 == (rootDependencies =~ /<dependency ref="pkg:maven/).size()

src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java

@@ -21,12 +21,15 @@
 import org.apache.commons.io.FileUtils;
 import org.apache.maven.artifact.Artifact;
 import org.apache.maven.execution.MavenSession;
+import org.apache.maven.model.Plugin;
+import org.apache.maven.model.PluginExecution;
 import org.apache.maven.plugin.AbstractMojo;
 import org.apache.maven.plugin.MojoExecutionException;
 import org.apache.maven.plugins.annotations.Parameter;
 import org.apache.maven.project.MavenProject;
 import org.apache.maven.project.MavenProjectHelper;
 import org.apache.maven.shared.dependency.analyzer.ProjectDependencyAnalysis;
+import org.codehaus.plexus.util.xml.Xpp3Dom;
 import org.cyclonedx.BomGeneratorFactory;
 import org.cyclonedx.CycloneDxSchema;
 import org.cyclonedx.exception.GeneratorException;
@@ -234,6 +237,12 @@ public abstract class BaseCycloneDxMojo extends AbstractMojo {
  protected static final String MESSAGE_ATTACHING_BOM = " attaching as %s-%s-cyclonedx.%s";
  protected static final String MESSAGE_VALIDATION_FAILURE = "The BOM does not conform to the CycloneDX BOM standard as defined by the XSD";
 
+ /**
+ * Maven plugins that deploy artifacts.
+ */
+ private static final String MAVEN_DEPLOY_PLUGIN = "org.apache.maven.plugins:maven-deploy-plugin";
+ private static final String NEXUS_STAGING_PLUGIN = "org.sonatype.plugins:nexus-staging-maven-plugin";
+
  /**
  * Returns a reference to the current project.
  *
@@ -262,9 +271,15 @@ protected Component convert(Artifact artifact) {
  */
  protected abstract String extractComponentsAndDependencies(Set<String> topLevelComponents, Map<String, Component> components, Map<String, Dependency> dependencies) throws MojoExecutionException;
 
+ /**
+ * @return {@literal true} if the execution should be skipped.
+ */
+ protected boolean shouldSkip() {
+ return Boolean.parseBoolean(System.getProperty("cyclonedx.skip", Boolean.toString(skip)));
+ }
+
  public void execute() throws MojoExecutionException {
- final boolean shouldSkip = Boolean.parseBoolean(System.getProperty("cyclonedx.skip", Boolean.toString(skip)));
- if (shouldSkip) {
+ if (shouldSkip()) {
  getLog().info("Skipping CycloneDX");
  return;
  }
@@ -511,4 +526,44 @@ private Component.Scope mergeScopes(final Component.Scope existing, final Compon
  }
  return existing;
  }
+
+ static boolean isDeployable(final MavenProject project) {
+ return isDeployable(project,
+ MAVEN_DEPLOY_PLUGIN,
+ "skip",
+ "maven.deploy.skip")
+ || isDeployable(project,
+ NEXUS_STAGING_PLUGIN,
+ "skipNexusStagingDeployMojo",
+ "skipNexusStagingDeployMojo");
+ }
+
+ private static boolean isDeployable(final MavenProject project,
+ final String pluginKey,
+ final String parameter,
+ final String propertyName) {
+ final Plugin plugin = project.getPlugin(pluginKey);
+ if (plugin != null) {
+ // Default skip value
+ final String property = System.getProperty(propertyName, project.getProperties().getProperty(propertyName));
+ final boolean defaultSkipValue = property != null ? Boolean.parseBoolean(property) : false;
+ // Find an execution that is not skipped
+ for (final PluginExecution execution : plugin.getExecutions()) {
+ if (execution.getGoals().contains("deploy")) {
+ final Xpp3Dom executionConf = (Xpp3Dom) execution.getConfiguration();
+ boolean skipValue = defaultSkipValue;
+ if (executionConf != null) {
+ Xpp3Dom target = executionConf.getChild(parameter);
+ if (target != null) {
+ skipValue = Boolean.parseBoolean(target.getValue());
+ }
+ }
+ if (!skipValue) {
+ return true;
+ }
+ }
+ }
+ }
+ return false;
+ }
 }

src/main/java/org/cyclonedx/maven/CycloneDxAggregateMojo.java

@@ -91,6 +91,9 @@ protected boolean shouldExclude(MavenProject mavenProject) {
  if (excludeTestProject && mavenProject.getArtifactId().contains("test")) {
  shouldExclude = true;
  }
+ if (!BaseCycloneDxMojo.isDeployable(mavenProject)) {
+ shouldExclude = true;
+ }
  return shouldExclude;
  }
 
@@ -146,7 +149,7 @@ protected String extractComponentsAndDependencies(final Set<String> topLevelComp
  */
  private void addMavenProjectsAsParentDependencies(List<MavenProject> reactorProjects, Map<String, Dependency> dependencies) {
  for (final MavenProject project: reactorProjects) {
- if (project.hasParent()) {
+ if (project.hasParent() && !shouldExclude(project)) {
  final String parentRef = generatePackageUrl(project.getParent().getArtifact());
  Dependency parentDependency = dependencies.get(parentRef);
  if (parentDependency != null) {

src/main/java/org/cyclonedx/maven/CycloneDxMojo.java

@@ -94,6 +94,12 @@ protected ProjectDependencyAnalysis doProjectDependencyAnalysis(final MavenProje
  return null;
  }
 
+ @Override
+ protected boolean shouldSkip() {
+ // The list of artifacts would be empty
+ return super.shouldSkip() || !isDeployable(getProject());
+ }
+
  protected String extractComponentsAndDependencies(final Set<String> topLevelComponents, final Map<String, Component> components, final Map<String, Dependency> dependencies) throws MojoExecutionException {
  getLog().info(MESSAGE_RESOLVING_DEPS);