Add p2-aware model converter for CycloneDX SBOM generation

This change consists of two parts. The first part consists of generating a valid package URL for a given p2 artifact. The PURL contains the symbolic name, version and classifier of the artifact key, as well as the repository it is located in. The second part handles the dependencies between two PURLs. For the sake of consistency, this dependency tree matches the tree calculated by the dependency-tree mojo.
eclipse-tycho · Feb 8, 2024 · ae8181f · ae8181f
1 parent eb1f45e
commit ae8181f
Show file tree

Hide file tree

Showing 19 changed files with 996 additions and 6 deletions.
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
@@ -6,6 +6,25 @@ If you are reading this in the browser, then you can quickly jump to specific ve
 
 ## 5.0.0 (under development)
 
+### Support for CycloneDX Maven Plugin
+
+The `tycho-sbom` plugin can be added as a dependency to the CycloneDX plugin,
+in order to handle the PURL creation of p2 artifacts:
+
+```
+<plugin>
+	<groupId>org.cyclonedx</groupId>
+	<artifactId>cyclonedx-maven-plugin</artifactId>
+	<dependencies>
+		<dependency>
+			<groupId>org.eclipse.tycho</groupId>
+			<artifactId>tycho-sbom</artifactId>
+			<version>${tycho-version}</version>
+		</dependency>
+	</dependencies>
+</plugin>
+```
+
 ### Support for parallel execution of product assembly / archiving
 
 The mojos `materialize-products` and `archive-products` now support a new `<parallel>` parameter 

diff --git a/pom.xml b/pom.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
- - Copyright (c) 2008, 2022 Sonatype Inc. and others.
+ - Copyright (c) 2008, 2024 Sonatype Inc. and others.
  - All rights reserved. This program and the accompanying materials
  - are made available under the terms of the Eclipse Public License v1.0
  - which accompanies this distribution, and is available at
@@ -542,6 +542,7 @@
 		<module>tycho-ds-plugin</module>
 		<module>tycho-buildtimestamp-jgit</module>
 		<module>tycho-baseline-plugin</module>
+		<module>tycho-sbom</module>
 		<!-- surefire -->
 		<module>tycho-surefire</module>
 		<!-- release -->

diff --git a/tycho-core/src/main/java/org/eclipse/tycho/core/maven/TychoReactorReader.java b/tycho-core/src/main/java/org/eclipse/tycho/core/maven/TychoReactorReader.java
@@ -1,5 +1,5 @@
 /*******************************************************************************
- * Copyright (c) 2023 Christoph Läubrich and others.
+ * Copyright (c) 2023, 2024 Christoph Läubrich and others.
  * All rights reserved. This program and the accompanying materials
  * are made available under the terms of the Eclipse Public License v1.0
  * which accompanies this distribution, and is available at
@@ -67,7 +67,7 @@ public File findArtifact(Artifact artifact) {
         }).orElse(null);
     }
 
-    private Optional<MavenProject> getTychoReactorProject(Artifact artifact) {
+    public Optional<MavenProject> getTychoReactorProject(Artifact artifact) {
         if (isTychoReactorArtifact(artifact)) {
             String projectKey = ArtifactUtils.key(artifact.getGroupId(), artifact.getArtifactId(),
                     artifact.getVersion());
@@ -81,13 +81,20 @@ private Optional<MavenProject> getTychoReactorProject(Artifact artifact) {
         return Optional.empty();
     }
 
-    private boolean isTychoReactorArtifact(Artifact artifact) {
+    public boolean isTychoReactorArtifact(Artifact artifact) {
         if (artifact.getClassifier() == null || artifact.getClassifier().isBlank()) {
-            return PackagingType.TYCHO_PACKAGING_TYPES.contains(artifact.getProperty("type", ""));
+            return PackagingType.TYCHO_PACKAGING_TYPES.contains(getPackagingType(artifact));
         }
         return false;
     }
 
+    public String getPackagingType(Artifact artifact) {
+        if (artifact != null) {
+            return artifact.getProperty("type", "");
+        }
+        return null;
+    }
+
     @Override
     public List<String> findVersions(Artifact artifact) {
         return getTychoReactorProject(artifact).map(project -> List.of(artifact.getVersion())).orElse(List.of());

diff --git a/tycho-its/pom.xml b/tycho-its/pom.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
- - Copyright (c) 2008, 2022 Sonatype Inc. and others.
+ - Copyright (c) 2008, 2024 Sonatype Inc. and others.
  - All rights reserved. This program and the accompanying materials
  - are made available under the terms of the Eclipse Public License v1.0
  - which accompanies this distribution, and is available at
@@ -214,6 +214,12 @@
 			<version>3.1.0</version>
 			<scope>test</scope>
 		</dependency>
+		<!-- sbom tests -->
+		<dependency>
+			<groupId>org.cyclonedx</groupId>
+			<artifactId>cyclonedx-core-java</artifactId>
+			<version>8.0.3</version>
+		</dependency>
 
 		<!-- artifacts to be tested -->
 		<dependency>

diff --git a/tycho-its/projects/sbom/.mvn/extensions.xml b/tycho-its/projects/sbom/.mvn/extensions.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<extensions>
+  <extension>
+    <groupId>org.eclipse.tycho</groupId>
+    <artifactId>tycho-build</artifactId>
+    <version>${tycho-version}</version>
+  </extension>
+</extensions>
diff --git a/tycho-its/projects/sbom/.mvn/maven.config b/tycho-its/projects/sbom/.mvn/maven.config
@@ -0,0 +1 @@
+-Dtycho-version=5.0.0-SNAPSHOT
diff --git a/tycho-its/projects/sbom/example.feature/build.properties b/tycho-its/projects/sbom/example.feature/build.properties
@@ -0,0 +1 @@
+bin.includes = feature.xml
diff --git a/tycho-its/projects/sbom/example.feature/feature.xml b/tycho-its/projects/sbom/example.feature/feature.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<feature
+      id="example.feature"
+      label="Feature with SBOM"
+      version="1.0.0.qualifier">
+
+   <description url="http://www.example.com/description">
+      [Enter Feature Description here.]
+   </description>
+
+   <copyright url="http://www.example.com/copyright">
+      [Enter Copyright Description here.]
+   </copyright>
+
+   <license url="http://www.example.com/license">
+      [Enter License Description here.]
+   </license>
+
+   <plugin
+         id="example.plugin"
+         version="0.0.0"/>
+
+</feature>
diff --git a/tycho-its/projects/sbom/example.plugin/META-INF/MANIFEST.MF b/tycho-its/projects/sbom/example.plugin/META-INF/MANIFEST.MF
@@ -0,0 +1,11 @@
+Manifest-Version: 1.0
+Bundle-ManifestVersion: 2
+Bundle-Name: Plugin with SBOM
+Bundle-SymbolicName: example.plugin
+Bundle-Version: 1.0.0.qualifier
+Require-Bundle: org.eclipse.core.databinding;bundle-version="1.13.100",
+ org.eclipse.core.databinding.beans;bundle-version="1.10.100",
+ org.eclipse.core.databinding.observable;bundle-version="1.13.100",
+ org.eclipse.core.databinding.property;bundle-version="1.10.100"
+Automatic-Module-Name: example.plugin
+Bundle-RequiredExecutionEnvironment: JavaSE-17
diff --git a/tycho-its/projects/sbom/example.plugin/build.properties b/tycho-its/projects/sbom/example.plugin/build.properties
@@ -0,0 +1,4 @@
+source.. = src/
+output.. = bin/
+bin.includes = META-INF/,\
+               .
diff --git a/tycho-its/projects/sbom/pom.xml b/tycho-its/projects/sbom/pom.xml
@@ -0,0 +1,86 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<groupId>tycho-demo</groupId>
+	<artifactId>sbom</artifactId>
+	<version>1.0.0-SNAPSHOT</version>
+	<packaging>pom</packaging>
+
+	<properties>
+		<tycho-version>5.0.0-SNAPSHOT</tycho-version>
+		<tycho.sbom.url>https://www.example.p2.repo/</tycho.sbom.url>
+	</properties>
+
+	<modules>
+		<module>example.feature</module>
+		<module>example.plugin</module>
+		<module>product</module>
+		<module>repository</module>
+	</modules>
+
+	<build>
+		<plugins>
+			<plugin>
+				<groupId>org.eclipse.tycho</groupId>
+				<artifactId>tycho-maven-plugin</artifactId>
+				<version>${tycho-version}</version>
+				<extensions>true</extensions>
+			</plugin>
+			<plugin>
+				<groupId>org.eclipse.tycho</groupId>
+				<artifactId>target-platform-configuration</artifactId>
+				<version>${tycho-version}</version>
+				<configuration>
+					<target>
+						<file>../target-definition.target</file>
+					</target>
+					<environments>
+						<environment>
+							<os>linux</os>
+							<ws>gtk</ws>
+							<arch>x86_64</arch>
+						</environment>
+					</environments>
+				</configuration>
+			</plugin>
+			<plugin>
+				<groupId>org.eclipse.tycho</groupId>
+				<artifactId>tycho-packaging-plugin</artifactId>
+				<version>${tycho-version}</version>
+				<configuration>
+					<forceContextQualifier>today</forceContextQualifier>
+				</configuration>
+			</plugin>
+			<plugin>
+				<groupId>org.cyclonedx</groupId>
+				<artifactId>cyclonedx-maven-plugin</artifactId>
+				<version>2.7.9</version>
+				<configuration>
+					<includeTestScope>true</includeTestScope>
+				</configuration>
+				<executions>
+					<execution>
+						<goals>
+							<goal>makeBom</goal>
+						</goals>
+					</execution>
+				</executions>
+				<dependencies>
+					<dependency>
+						<groupId>org.eclipse.tycho</groupId>
+						<artifactId>tycho-sbom</artifactId>
+						<version>${tycho-version}</version>
+					</dependency>
+				</dependencies>
+			</plugin>
+		</plugins>
+		<pluginManagement>
+			<plugins>
+				<plugin>
+					<groupId>org.eclipse.tycho</groupId>
+					<artifactId>tycho-p2-director-plugin</artifactId>
+					<version>${tycho-version}</version>
+				</plugin>
+			</plugins>
+		</pluginManagement>		
+	</build>
+</project>
diff --git a/tycho-its/projects/sbom/product/example.product b/tycho-its/projects/sbom/product/example.product
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?pde version="3.5"?>
+
+<product uid="example" version="1.0.0.qualifier" type="mixed" includeLaunchers="true" autoIncludeRequirements="false">
+
+   <configIni use="default">
+   </configIni>
+
+   <launcherArgs>
+      <vmArgsMac>-XstartOnFirstThread -Dorg.eclipse.swt.internal.carbon.smallFonts
+      </vmArgsMac>
+   </launcherArgs>
+
+   <plugins>
+      <plugin id="example.plugin"/>
+      <plugin id="org.eclipse.core.databinding"/>
+      <plugin id="org.eclipse.core.databinding.beans"/>
+      <plugin id="org.eclipse.core.databinding.observable"/>
+      <plugin id="org.eclipse.core.databinding.property"/>
+      <plugin id="org.eclipse.equinox.common"/>
+      <plugin id="org.eclipse.osgi"/>
+   </plugins>
+
+   <features>
+      <feature id="example.feature" installMode="root"/>
+   </features>
+
+
+</product>
diff --git a/tycho-its/projects/sbom/repository/category.xml b/tycho-its/projects/sbom/repository/category.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<site>
+   <feature id="example.feature"/>
+   <bundle id="example.plugin"/>
+</site>
diff --git a/tycho-its/projects/sbom/target-definition.target b/tycho-its/projects/sbom/target-definition.target
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<?pde version="3.8"?>
+<target name="target-definition">
+	<locations>
+		<location includeAllPlatforms="false" includeConfigurePhase="true" includeMode="planner" includeSource="true" type="InstallableUnit">
+			<repository location="https://download.eclipse.org/releases/2023-12/"/>
+			<unit id="org.eclipse.sdk.feature.group" version="0.0.0"/>
+			<unit id="org.eclipse.equinox.sdk.feature.group" version="0.0.0"/>
+		</location>
+	</locations>
+</target>