Add CBOM generation to our java repositories

[n1ckl0sk0rtge]

Use cbomkit-action to generate CBOMs for CBOMkit, cbomkit-action and sonar-cryptography-plugin.

• CBOMkit: Add support for generating CBOM as part of the GitHub workflow cbomkit/cbomkit#193
• cbomkit-action
• sonar-cryptography-plugin

[ryjones]

I have questions; why are these jar files checked in instead of being pulled from GHCR or similar?

• ./cbomkit/src/main/resources/java/scan/bcprov-jdk18on-1.80.jar
• ./cbomkit/src/main/resources/java/scan/bcprov-jdk18on-1.79.jar
• ./sonar-cryptography/java/src/test/resources/test-jars/bcprov-jdk18on-1.80.jar
• ./sonar-cryptography/java/src/test/resources/test-jars/bcprov-jdk18on-1.78.1.jar
• ./cbomkit-action/src/main/resources/java/scan/bcprov-jdk18on-1.80.jar
• ./cbomkit-action/src/main/resources/java/scan/bcprov-jdk18on-1.78.1.jar

[ryjones]

@n1ckl0sk0rtge please see above

[san-zrl]

Use cbomkit-action to generate CBOMs for CBOMkit, cbomkit-action and sonar-cryptography-plugin.

• CBOMkit: Add support for generating CBOM as part of the GitHub workflow cbomkit#193
• cbomkit-action: Create CBOM in workflow
• cbomkit-lib: Bump cbomkit-action in workflow to v2.1.1
• [sonar-cryptography: Generate CBOM

Re. sonar-cryptography: Should we generate the CBOM every time the project is built or only when a new release is published? Currently done when building the project.

I suggest to to close this issue and to continue the bc discussion elsewhere.

[ryjones]

@san-zrl please see my question above

[san-zrl]

Hi @ryjones

Sonarqube provides an API for specifying class files and jars of Java dependencies. The behavior of the Sonarqube Java scanner depends on the presence of these classes and jars. The more background information is provided the more (accurate) findings we get. Here is an example to illustrate this point:

Scanning results (number of findings) for keycloak. Classes and jar are specified as patterns (with absolute path). Classes are passed as "sonar.java.binaries" , jars are passed as "sonar.java.libraries",e.g., bouncy-castle (bc) jars:

no classes, no jars: 122
no classes, only bcjars:127
no classes, only .m2 jars: 129
no classes, only project jars: 145
no classes, bcjars + project jars: 145
no classes, bc*jars + project jars + .m2 jars: 145

classes, no jars: 138
classes, only bc*.jars: 143
classes, only .m2 jars: 145
classes, only project jars: 145
classes, bc*jars + project jars: 145

That's why cbomkit-action requires compilation of Java source code prior to scanning This is also the recommended method for creating CBOMs. CBOMkit does not. It analyses source code only and thus provides less accurate results.

The bcprov jars contain the compiled bouncy-castle code. All CBOMkit Java scanning methods use them by default since it improves the scanning results.

[ryjones]

Understood - thanks for the clarification