Skip to content

Commit 43d7f09

Browse files
jdaughertyjdaugherty
committed
fix: remove hashes for local components
1 parent f9d6f95 commit 43d7f09

File tree

1 file changed

+81
-70
lines changed

1 file changed

+81
-70
lines changed

‎build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy‎

Lines changed: 81 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -61,72 +61,72 @@ class SbomPlugin implements Plugin<Project> {
6161

6262
// licenses are standardized @ https://spdx.org/licenses/
6363
private static Map<String, LinkedHashMap<String, String>> LICENSES = [
64-
'Apache-2.0' : [
65-
id : 'Apache-2.0',
66-
url: 'https://www.apache.org/licenses/LICENSE-2.0'
67-
],
68-
'BSD-2-Clause': [
69-
id : 'BSD-2-Clause',
70-
url: 'https://opensource.org/license/bsd-3-clause/'
71-
],
72-
'BSD-3-Clause': [
73-
id : 'BSD-3-Clause',
74-
url: 'https://opensource.org/license/bsd-3-clause/'
75-
],
76-
// Variant of Apache 1.1 license. Approved by legal LEGAL-707
77-
'OpenSymphony': [
78-
// id is optional and the opensymphony license doesn't have an SPDX id
79-
name: 'The OpenSymphony Software License, Version 1.1',
80-
url : 'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
81-
],
82-
'UPL-1.0' : [
83-
id : 'UPL-1.0',
84-
url: 'https://oss.oracle.com/licenses/upl/'
85-
],
64+
'Apache-2.0' : [
65+
id : 'Apache-2.0',
66+
url: 'https://www.apache.org/licenses/LICENSE-2.0'
67+
],
68+
'BSD-2-Clause': [
69+
id : 'BSD-2-Clause',
70+
url: 'https://opensource.org/license/bsd-3-clause/'
71+
],
72+
'BSD-3-Clause': [
73+
id : 'BSD-3-Clause',
74+
url: 'https://opensource.org/license/bsd-3-clause/'
75+
],
76+
// Variant of Apache 1.1 license. Approved by legal LEGAL-707
77+
'OpenSymphony': [
78+
// id is optional and the opensymphony license doesn't have an SPDX id
79+
name: 'The OpenSymphony Software License, Version 1.1',
80+
url : 'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
81+
],
82+
'UPL-1.0' : [
83+
id : 'UPL-1.0',
84+
url: 'https://oss.oracle.com/licenses/upl/'
85+
],
8686
]
8787

8888
private static Map<String, String> LICENSE_MAPPING = [
89-
'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 'BSD-3-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
90-
'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
91-
'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
92-
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar': 'Apache-2.0', // maps incorrectly because of https://github.com/liquibase/liquibase/issues/2445 & the base pom does not define a license
93-
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom': 'UPL-1.0', // does not have map based on license id
94-
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom': 'UPL-1.0', // does not have map based on license id
95-
'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 'OpenSymphony', // custom license approved by legal LEGAL-707
96-
'pkg:maven/org.jruby/jzlib@1.1.5?type=jar' : 'BSD-3-Clause'// https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt shows it's a 3 clause
89+
'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 'BSD-3-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
90+
'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
91+
'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
92+
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar': 'Apache-2.0', // maps incorrectly because of https://github.com/liquibase/liquibase/issues/2445 & the base pom does not define a license
93+
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom': 'UPL-1.0', // does not have map based on license id
94+
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom': 'UPL-1.0', // does not have map based on license id
95+
'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 'OpenSymphony', // custom license approved by legal LEGAL-707
96+
'pkg:maven/org.jruby/jzlib@1.1.5?type=jar' : 'BSD-3-Clause'// https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt shows it's a 3 clause
9797
]
9898

9999
// we don't distribute these so these licenses are considered acceptable, but we still prefer ASF licenses.
100100
// Require a whitelist of any case of category X licenses to prevent accidental inclusion in a distributed artifact
101101
// this list will need to be updated anytime we change versions so we can revise the licenses
102102
private static Map<String, LinkedHashMap<String, String>> LICENSE_EXCEPTIONS = [
103-
'grails-data-hibernate5-core' : [
104-
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar': 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
105-
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar' : 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
106-
],
107-
'grails-data-hibernate5' : [
108-
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar': 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
109-
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar' : 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
110-
],
111-
'grails-data-hibernate5-spring-boot': [
112-
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar': 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
113-
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar' : 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
114-
],
115-
'grails-data-hibernate5-dbmigration': [
116-
'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 'CDDL-1.1', // api export
117-
],
103+
'grails-data-hibernate5-core' : [
104+
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar': 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
105+
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar' : 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
106+
],
107+
'grails-data-hibernate5' : [
108+
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar': 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
109+
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar' : 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
110+
],
111+
'grails-data-hibernate5-spring-boot': [
112+
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar': 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
113+
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar' : 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in hibernate 7
114+
],
115+
'grails-data-hibernate5-dbmigration': [
116+
'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 'CDDL-1.1', // api export
117+
],
118118
]
119119

120120
@Override
121121
void apply(Project project) {
122122
project.pluginManager.apply(CycloneDxPlugin)
123123

124124
def sbomOutputLocation = project.layout.buildDirectory.file(
125-
project.provider {
126-
def artifactId = lookupProperty(project, 'pomArtifactId', project.name)
127-
def version = project.findProperty('projectVersion')
128-
"$artifactId-$version-sbom.json" as String
129-
}
125+
project.provider {
126+
def artifactId = lookupProperty(project, 'pomArtifactId', project.name)
127+
def version = project.findProperty('projectVersion')
128+
"$artifactId-$version-sbom.json" as String
129+
}
130130
)
131131

132132
configureSbomTask(project, sbomOutputLocation)
@@ -144,25 +144,25 @@ class SbomPlugin implements Plugin<Project> {
144144
projectType = Component.Type.valueOf(lookupProperty(project, 'sbomProjectType', 'FRAMEWORK'))
145145
componentName = lookupProperty(project, 'pomArtifactId', project.name)
146146
task.@organizationalEntity.set(new OrganizationalEntity(
147-
name: 'Apache Software Foundation',
148-
urls: [
149-
'https://www.apache.org/',
150-
'https://security.apache.org/'
151-
],
152-
contacts: [
153-
new OrganizationalContact(
154-
name: 'Apache Grails Development Team',
155-
email: 'dev@grails.apache.org'
156-
)
157-
]
147+
name: 'Apache Software Foundation',
148+
urls: [
149+
'https://www.apache.org/',
150+
'https://security.apache.org/'
151+
],
152+
contacts: [
153+
new OrganizationalContact(
154+
name: 'Apache Grails Development Team',
155+
email: 'dev@grails.apache.org'
156+
)
157+
]
158158
))
159159
task.@licenseChoice.set(new LicenseChoice(
160-
licenses: [
161-
new License(
162-
name: 'Apache-2.0',
163-
url: 'https://www.apache.org/licenses/LICENSE-2.0.txt'
164-
)
165-
]
160+
licenses: [
161+
new License(
162+
name: 'Apache-2.0',
163+
url: 'https://www.apache.org/licenses/LICENSE-2.0.txt'
164+
)
165+
]
166166
))
167167

168168
def projectVersion = project.findProperty('projectVersion').toString()
@@ -181,7 +181,7 @@ class SbomPlugin implements Plugin<Project> {
181181
)
182182
]
183183

184-
if(!projectVersion.endsWith('SNAPSHOT')) {
184+
if (!projectVersion.endsWith('SNAPSHOT')) {
185185
references.add(
186186
new ExternalReference(
187187
url: "https://grails.apache.org/docs/${project.findProperty('projectVersion')}/index.html",
@@ -214,21 +214,32 @@ class SbomPlugin implements Plugin<Project> {
214214
ZonedDateTime buildDate = lookupProperty(project, 'buildDate')
215215
bom['metadata']['timestamp'] = DateTimeFormatter.ISO_INSTANT.format(buildDate.truncatedTo(ChronoUnit.SECONDS))
216216

217-
// components[*].licenses
217+
// components[*]
218218
def comps = (bom instanceof Map && bom.components instanceof List) ? bom.components : []
219219
comps.each { c ->
220+
// .licenses => choose a license that is compatible with ASF policy if multiple licensed
220221
if (c instanceof Map && c.licenses instanceof List && !(c.licenses as List).empty) {
221222
def chosen = pickLicense(task, c['bom-ref'] as String, c.licenses as List)
222223
if (chosen != null) {
223224
c.licenses = [chosen]
224225
}
225226
}
227+
228+
// .hashes => project hashes are only generated if the jar file has been created,
229+
// which with a parallel build may not have occurred, so for any dependency that is a
230+
// project we exclude them
231+
if (c instanceof Map && c.hashes instanceof List && !(c.hashes as List).empty) {
232+
def componentPath = c['bom-ref'] as String
233+
if (componentPath.contains('?project_path=')) {
234+
c.remove('hashes')
235+
}
236+
}
226237
}
227238

228239
// dependencies[*].dependsOn is not reproducible, so sort it
229240
def dependencies = (bom instanceof Map && bom.dependencies instanceof List) ? bom.dependencies : []
230241
dependencies.each { d ->
231-
if(d instanceof Map && d.dependsOn instanceof List && !(d.dependsOn as List).empty) {
242+
if (d instanceof Map && d.dependsOn instanceof List && !(d.dependsOn as List).empty) {
232243
d.dependsOn = (d.dependsOn as List).sort()
233244
}
234245
}

0 commit comments

Comments
 (0)