Skip to content

Commit 1a0c45f

Browse files
OliverNoconYoung Yang
OliverNocon
and
Young Yang
authored
fix: SBOM generation with proper metadata and hierarchy (#1133)
* modified: Makefile modified: cmd/testdata/mta-sbom/mta.yaml modified: internal/artifacts/sbom.go * modified: .circleci/config.yml modified: Dockerfile_mbtci_template modified: Makefile * feat(cycloneDX merge): remove duplicates, adapt sbom * chore: update cycloneDX cli version * chore: add comments * chore: fix linting issue * chore: adapt comment * fix: properly open file for writing * modified: .circleci/config.yml modified: Makefile modified: internal/artifacts/sbom.go modified: internal/commands/commands.go --------- Co-authored-by: Young Yang <young.yang03@sap.com>
1 parent 8e9e693 commit 1a0c45f

File tree

8 files changed

+124
-210
lines changed

8 files changed

+124
-210
lines changed

‎.circleci/config.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ jobs:
120120
- run:
121121
name: install cyclonedx-cli
122122
command: |
123-
CYCLONEDX_CLI_VERSION=0.24.2
123+
CYCLONEDX_CLI_VERSION=0.27.1
124124
CYCLONEDX_BINARY_NAME=cyclonedx
125125
CYCLONEDX_ARCH=x64
126126
CYCLONEDX_OS=linux
@@ -133,7 +133,7 @@ jobs:
133133
name: install cyclonedx-gomod
134134
command: |
135135
echo "cyclonedx-gomod version"
136-
go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
136+
go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@v1.4.0
137137
cyclonedx-gomod version
138138
- run:
139139
name: install cyclonedx-npm
@@ -305,7 +305,7 @@ jobs:
305305
#Push to GitHub Container Registry
306306
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
307307
sh $PWD/scripts/publish_image 11.0.17 14.21.1 ${MBT_VERSION} "ghcr.io/sap"
308-
308+
309309
publish-to-dockerhub-java11-node16:
310310
docker:
311311
- image: cimg/go:1.19
@@ -337,7 +337,7 @@ jobs:
337337
#Push to GitHub Container Registry
338338
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
339339
sh $PWD/scripts/publish_image 11.0.17 16.18.1 ${MBT_VERSION} "ghcr.io/sap"
340-
340+
341341
publish-to-dockerhub-java11-node18:
342342
docker:
343343
- image: cimg/go:1.19
@@ -433,7 +433,7 @@ jobs:
433433
#Push to GitHub Container Registry
434434
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
435435
sh $PWD/scripts/publish_image 17.0.12 14.21.1 ${MBT_VERSION} "ghcr.io/sap"
436-
436+
437437
publish-to-dockerhub-java17-node16:
438438
docker:
439439
- image: cimg/go:1.19
@@ -465,7 +465,7 @@ jobs:
465465
#Push to GitHub Container Registry
466466
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
467467
sh $PWD/scripts/publish_image 17.0.12 16.18.1 ${MBT_VERSION} "ghcr.io/sap"
468-
468+
469469
publish-to-dockerhub-java17-node18:
470470
docker:
471471
- image: cimg/go:1.19
@@ -497,7 +497,7 @@ jobs:
497497
#Push to GitHub Container Registry
498498
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
499499
sh $PWD/scripts/publish_image 17.0.12 18.20.4 ${MBT_VERSION} "ghcr.io/sap"
500-
500+
501501
publish-to-dockerhub-java17-node20:
502502
docker:
503503
- image: cimg/go:1.19
@@ -529,7 +529,7 @@ jobs:
529529
#Push to GitHub Container Registry
530530
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
531531
sh $PWD/scripts/publish_image 17.0.12 20.15.1 ${MBT_VERSION} "ghcr.io/sap"
532-
532+
533533
publish-to-dockerhub-java19-node14:
534534
docker:
535535
- image: cimg/go:1.19
@@ -561,7 +561,7 @@ jobs:
561561
#Push to GitHub Container Registry
562562
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
563563
sh $PWD/scripts/publish_image 19.0.1 14.21.1 ${MBT_VERSION} "ghcr.io/sap"
564-
564+
565565
publish-to-dockerhub-java19-node16:
566566
docker:
567567
- image: cimg/go:1.19
@@ -593,7 +593,7 @@ jobs:
593593
#Push to GitHub Container Registry
594594
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
595595
sh $PWD/scripts/publish_image 19.0.1 16.18.1 ${MBT_VERSION} "ghcr.io/sap"
596-
596+
597597
publish-to-dockerhub-java19-node18:
598598
docker:
599599
- image: cimg/go:1.19
@@ -688,7 +688,7 @@ jobs:
688688
#Push to GitHub Container Registry
689689
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
690690
sh $PWD/scripts/publish_image 21.0.4 18.20.4 ${MBT_VERSION} "ghcr.io/sap"
691-
691+
692692
publish-to-dockerhub-java21-node20:
693693
docker:
694694
- image: cimg/go:1.19
@@ -782,7 +782,7 @@ jobs:
782782
#Push to GitHub Container Registry
783783
echo "$CLOUD_MTA_BOT_GITHUB_TOKEN" | docker login "ghcr.io" --username $CLOUD_MTA_BOT_USER --password-stdin
784784
sh $PWD/scripts/publish_image 22.0.2 18.20.4 ${MBT_VERSION} "ghcr.io/sap"
785-
785+
786786
publish-to-dockerhub-java22-node20:
787787
docker:
788788
- image: cimg/go:1.19
@@ -877,7 +877,7 @@ jobs:
877877
git fetch
878878
git rebase
879879
- run:
880-
# mbt is an unscoped package, do not need to add "--access public" option in npm publish cmd
880+
# mbt is an unscoped package, do not need to add "--access public" option in npm publish cmd
881881
name: publish to npm
882882
command: |
883883
echo "//registry.npmjs.org/:_authToken=$CLOUD_MTA_BOT_NPM_TOKEN" > .npmrc

‎Dockerfile_mbtci_template‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ARG MAVEN_VERSION=3.9.4
1010
ARG UI5_VERSION=2.14.19
1111
ARG MAVEN_BASE_URL=https://downloads.apache.org/maven/maven-3/${MAVEN_VERSION}/binaries
1212
ARG SAPMACHINE_VERSION=JAVA_VERSION_TEMPLATE
13-
ARG CYCLONEDX_CLI_VERSION=0.24.2
13+
ARG CYCLONEDX_CLI_VERSION=0.27.1
1414
ARG CYCLONEDX_CLI_BINARY=cyclonedx
1515
ARG CYCLONEDX_GOMOD_VERSION=1.4.0
1616
ARG CYCLONEDX_GOMOD_BINARY=cyclonedx-gomod

‎Makefile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@
44
# Execute go build
55
# Copy files to machine go/bin folder (temp target to avoid manual steps when developing locally)
66

7-
all:format clean dir gen build-linux build-linux-arm build-darwin build-darwin-arm build-windows copy install-cyclonedx tests
7+
all:format clean dir gen build-linux build-linux-arm build-darwin build-darwin-arm build-windows copy install-cyclonedx
8+
# all:format clean dir gen build-linux build-linux-arm build-darwin build-darwin-arm build-windows copy install-cyclonedx tests
89
.PHONY: build-darwin-arm build-darwin build-linux build-linux-arm build-windows tests
910

1011
GOCMD=go
@@ -17,11 +18,11 @@ BUILD = $(CURDIR)/release
1718

1819
# cyclonedx-cli
1920
CYCLONEDX_CLI_BINARY = cyclonedx
20-
CYCLONEDX_CLI_VERSION = 0.24.2
21+
CYCLONEDX_CLI_VERSION = 0.27.1
2122

2223
# cyclonedx-gomod
2324
CYCLONEDX_GOMOD_BINARY = cyclonedx-gomod
24-
CYCLONEDX_GOMOD_VERSION = latest
25+
CYCLONEDX_GOMOD_VERSION = v1.4.0
2526

2627
# cyclonedx_npm
2728
CYCLONEDX_NPM_PACKAGE = @cyclonedx/cyclonedx-npm

‎cmd/testdata/mta-sbom/mta.yaml‎

Lines changed: 44 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,52 @@
11
ID: mta_sbom_test_app
2-
_schema-version: '2.1'
2+
_schema-version: "2.1"
33
version: 0.0.1
44

55
modules:
6-
- name: node-module
7-
type: nodejs
8-
path: nodejs
9-
provides:
10-
- name: node-js_api
6+
- name: node-module
7+
type: nodejs
8+
path: nodejs
9+
provides:
10+
- name: node-js_api
11+
properties:
12+
url: ${default-url}
13+
build-parameters:
14+
requires:
15+
- name: java-module
16+
17+
- name: java-module
18+
type: java
19+
path: java
1120
properties:
12-
url: ${default-url}
13-
build-parameters:
14-
requires:
15-
- name: java-module
16-
17-
- name: java-module
18-
type: java
19-
path: java
20-
properties:
21-
MEMORY_CALCULATOR_V1: true
22-
build-parameters:
23-
requires:
24-
- name: go-module
21+
MEMORY_CALCULATOR_V1: true
22+
build-parameters:
23+
requires:
24+
- name: go-module
2525

26-
- name: go-module
27-
type: go
28-
path: golang
29-
parameters:
30-
memory: 512M
31-
disk-quota: 256M
32-
properties:
33-
MEMORY_CALCULATOR_V1: true
34-
build-parameters:
35-
builder: golang
36-
requires:
37-
- name: custom-module
26+
- name: go-module
27+
type: go
28+
path: golang
29+
parameters:
30+
memory: 512M
31+
disk-quota: 256M
32+
properties:
33+
MEMORY_CALCULATOR_V1: true
34+
build-parameters:
35+
builder: golang
36+
requires:
37+
- name: custom-module
3838

39-
- name: custom-module
40-
type: html5
41-
path: nodejs
42-
build-parameters:
43-
builder: custom
44-
commands:
45-
- sh -c 'echo customer builder'
39+
- name: custom-module
40+
type: html5
41+
path: nodejs
42+
build-parameters:
43+
builder: custom
44+
commands:
45+
- sh -c 'echo customer builder'
4646

47+
- name: node-module-test
48+
type: nodejs
49+
path: nodejs
50+
build-parameters:
51+
requires:
52+
- name: java-module

‎go.mod‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,10 @@ module github.com/SAP/cloud-mta-build-tool
33
go 1.13
44

55
require (
6+
github.com/CycloneDX/cyclonedx-go v0.9.1
67
github.com/SAP/cloud-mta v1.0.6
78
github.com/deckarep/golang-set v1.7.1
89
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
9-
github.com/mattn/goveralls v0.0.11 // indirect
10-
github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5 // indirect
1110
github.com/onsi/ginkgo v1.16.2
1211
github.com/onsi/gomega v1.13.0
1312
github.com/pkg/errors v0.9.1

0 commit comments

Comments
 (0)