Some sbom's missing FreeType version

[andrew-m-leonard]

When temurin-build downloads FreeType because it is not on the System, then that gets logged in the SBOM.
However if there is a "System" freetype that is detected, then its details are not stored in the SBOM, ie.

temurin-build/sbin/prepareWorkspace.sh

Line 455 in 751e5c8

echo "Skipping FreeType download"

[sxa]

Definitely sounds like a bug then, so my checks are failing correctly ;-)

[andrew-m-leonard]

@sxa
So our inclusion of FreeType is somewhat "mixed" and hard to understand, i've so far concluded:

• jdk8 will check for existence of installedfreetype directory on the build machine workspace and use that (but it's hard to know what version that lib is..?)
• jdk8 if installedfreetype does not exist, then it downloads into a folder "freetype" the hard coded version, and builds it and installs it... then copies to directory installedfreetype. This scenario gets stored in SBOM
• jdk11+ skips checking/downloading "19:06:42 Skipping Freetype", and then default to whatever is the "System" freetype:

19:07:17  checking for FREETYPE... yes
19:07:17  checking for freetype... yes (using pkg-config)
19:07:17  Using freetype: system

• jdk11+ Mac, Windows and AIX use "Bundled"

[andrew-m-leonard]

@sxa Is there any reason we can't just use "Bundled" everywhere?

[sxa]

@sxa Is there any reason we can't just use "Bundled" everywhere?

I don't know. I haven't really looked into it.