You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@zookeeper.apache.org by GitBox <gi...@apache.org> on 2023/01/11 00:07:36 UTC
[GitHub] [zookeeper] dongjoon-hyun opened a new pull request, #1969: ZOOKEEPER-4657: Publish SBOM artifacts
dongjoon-hyun opened a new pull request, #1969:
URL: https://github.com/apache/zookeeper/pull/1969
This PR aims to publish SBOM artifacts along with the other Apache projects.
- https://cwiki.apache.org/confluence/display/COMDEV/SBOM
Here is an article to give some context.
- https://www.activestate.com/blog/why-the-us-government-is-mandating-software-bill-of-materials-sbom/
Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: [CycloneDX](https://cyclonedx.org/), [Software Identification (SWID) tag](https://csrc.nist.gov/projects/Software-Identification-SWID), [Software Package Data Exchange® (SPDX)](https://spdx.dev/).
We can use one of the Maven plugin, [CycloneDX maven plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin), a lightweight software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.
https://maven.apache.org/plugins/index.html#misc
**The expected results**
```
$ mvn install -DskipTests
...
$ ls -al ~/.m2/repository/org/apache/zookeeper/zookeeper/3.9.0-SNAPSHOT/
total 16768
drwxr-xr-x 12 dongjoon staff 384 Jan 10 14:59 .
drwxr-xr-x 8 dongjoon staff 256 Jan 10 14:59 ..
-rw-r--r-- 1 dongjoon staff 436 Jan 10 14:59 _remote.repositories
-rw-r--r-- 1 dongjoon staff 1945 Jan 10 14:59 maven-metadata-local.xml
-rw-r--r-- 1 dongjoon staff 70780 Jan 10 14:59 zookeeper-3.9.0-SNAPSHOT-cyclonedx.json
-rw-r--r-- 1 dongjoon staff 61959 Jan 10 14:59 zookeeper-3.9.0-SNAPSHOT-cyclonedx.xml
-rw-r--r-- 1 dongjoon staff 3291660 Jan 10 14:59 zookeeper-3.9.0-SNAPSHOT-javadoc.jar
-rw-r--r-- 1 dongjoon staff 1365393 Jan 10 14:59 zookeeper-3.9.0-SNAPSHOT-osgi.jar
-rw-r--r-- 1 dongjoon staff 883895 Jan 10 14:59 zookeeper-3.9.0-SNAPSHOT-sources.jar
-rw-r--r-- 1 dongjoon staff 1533401 Jan 10 14:59 zookeeper-3.9.0-SNAPSHOT-tests.jar
-rw-r--r-- 1 dongjoon staff 1341057 Jan 10 14:59 zookeeper-3.9.0-SNAPSHOT.jar
-rw-r--r-- 1 dongjoon staff 11456 Jan 10 14:55 zookeeper-3.9.0-SNAPSHOT.pom
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] dongjoon-hyun commented on a diff in pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on code in PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#discussion_r1066529592
##########
pom.xml:
##########
@@ -918,6 +918,11 @@
<artifactId>maven-bundle-plugin</artifactId>
<version>5.1.1</version>
</plugin>
+ <plugin>
+ <groupId>org.cyclonedx</groupId>
+ <artifactId>cyclonedx-maven-plugin</artifactId>
+ <version>2.7.3</version>
Review Comment:
Thank you so much, @VinodAnandan !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] VinodAnandan commented on a diff in pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
VinodAnandan commented on code in PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#discussion_r1066512828
##########
pom.xml:
##########
@@ -918,6 +918,11 @@
<artifactId>maven-bundle-plugin</artifactId>
<version>5.1.1</version>
</plugin>
+ <plugin>
+ <groupId>org.cyclonedx</groupId>
+ <artifactId>cyclonedx-maven-plugin</artifactId>
+ <version>2.7.3</version>
Review Comment:
@dongjoon-hyun sure, I will try 2.7.4 update in a separate PR after this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] VinodAnandan commented on a diff in pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
VinodAnandan commented on code in PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#discussion_r1066463919
##########
pom.xml:
##########
@@ -918,6 +918,11 @@
<artifactId>maven-bundle-plugin</artifactId>
<version>5.1.1</version>
</plugin>
+ <plugin>
+ <groupId>org.cyclonedx</groupId>
+ <artifactId>cyclonedx-maven-plugin</artifactId>
+ <version>2.7.3</version>
Review Comment:
The cyclonedx-maven-plugin-2.7.4 was released last week, more information - https://github.com/CycloneDX/cyclonedx-maven-plugin/releases/tag/cyclonedx-maven-plugin-2.7.4
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] dongjoon-hyun commented on pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#issuecomment-1381020406
Thank you so much!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] VinodAnandan commented on a diff in pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
VinodAnandan commented on code in PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#discussion_r1066462607
##########
pom.xml:
##########
@@ -918,6 +918,11 @@
<artifactId>maven-bundle-plugin</artifactId>
<version>5.1.1</version>
</plugin>
+ <plugin>
+ <groupId>org.cyclonedx</groupId>
+ <artifactId>cyclonedx-maven-plugin</artifactId>
+ <version>2.7.3</version>
Review Comment:
```suggestion
<version>2.7.4</version>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] cnauroth merged pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
cnauroth merged PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] dongjoon-hyun commented on a diff in pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on code in PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#discussion_r1066489850
##########
pom.xml:
##########
@@ -918,6 +918,11 @@
<artifactId>maven-bundle-plugin</artifactId>
<version>5.1.1</version>
</plugin>
+ <plugin>
+ <groupId>org.cyclonedx</groupId>
+ <artifactId>cyclonedx-maven-plugin</artifactId>
+ <version>2.7.3</version>
Review Comment:
Actually, I found it doesn't work in some cases, @VinodAnandan . While helping other projects, I tried and reverted to back 2.7.3.
- https://cwiki.apache.org/confluence/display/COMDEV/SBOM
Could you try that in a separate PR after this PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] dongjoon-hyun commented on pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#issuecomment-1378115702
Hi, @cnauroth . I want to keep this PR AS-IS with 2.7.3 because it's the verified version in various environments and cases.
BTW, the CI failure looks irrelevant to this PR.
```
[ERROR] Errors:
[ERROR] ReadOnlyModeTest.testConnectionEvents:202 » Timeout Failed to connect in read-...
[INFO]
[ERROR] Tests run: 2999, Failures: 0, Errors: 1, Skipped: 4
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] dongjoon-hyun commented on pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
dongjoon-hyun commented on PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#issuecomment-1378115918
Thank you for review, @VinodAnandan and @cnauroth !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] hboutemy commented on a diff in pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by "hboutemy (via GitHub)" <gi...@apache.org>.
hboutemy commented on code in PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#discussion_r1096497728
##########
pom.xml:
##########
@@ -918,6 +918,11 @@
<artifactId>maven-bundle-plugin</artifactId>
<version>5.1.1</version>
</plugin>
+ <plugin>
+ <groupId>org.cyclonedx</groupId>
+ <artifactId>cyclonedx-maven-plugin</artifactId>
+ <version>2.7.3</version>
Review Comment:
@dongjoon-hyun
> Actually, I found it doesn't work in some cases
I'm working on improving the plugin, can you point me where 2.7.3 works but not 2.7.4? I was not supposed to introduce any regression :)
@VinodAnandan if you worked on this, I'm interested to help
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] cnauroth commented on pull request #1969: ZOOKEEPER-4657: Publish SBOM artifacts
Posted by GitBox <gi...@apache.org>.
cnauroth commented on PR #1969:
URL: https://github.com/apache/zookeeper/pull/1969#issuecomment-1381003653
I have committed this to master, branch-3.8 and branch-3.7. @dongjoon-hyun , thank you for the patch. @VinodAnandan , thank you for code reviewing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org