From 4473c0972a81552ba9227ae7eb951f8d152a6648 Mon Sep 17 00:00:00 2001 From: Andrew Leonard Date: Wed, 4 Dec 2024 16:24:53 +0000 Subject: [PATCH] Some fixes for TemurinGenSBOM and latest CDXA update Signed-off-by: Andrew Leonard --- cyclonedx-lib/build.xml | 184 +++++++++--------- .../src/temurin/sbom/TemurinGenCDXA.java | 17 +- .../src/temurin/sbom/TemurinGenSBOM.java | 66 +++++-- sbin/build.sh | 2 +- 4 files changed, 157 insertions(+), 112 deletions(-) diff --git a/cyclonedx-lib/build.xml b/cyclonedx-lib/build.xml index f4e11f65c..d145a3a8a 100644 --- a/cyclonedx-lib/build.xml +++ b/cyclonedx-lib/build.xml @@ -204,7 +204,7 @@ - + @@ -224,7 +224,7 @@ - + @@ -251,8 +251,8 @@ - - + + @@ -263,7 +263,7 @@ - + @@ -275,7 +275,7 @@ - + @@ -283,7 +283,7 @@ - + @@ -295,7 +295,7 @@ - + @@ -307,7 +307,7 @@ - + @@ -319,7 +319,7 @@ - + @@ -331,7 +331,7 @@ - + @@ -339,7 +339,7 @@ - + @@ -351,7 +351,7 @@ - + @@ -363,7 +363,7 @@ - + @@ -373,7 +373,7 @@ - + @@ -385,7 +385,7 @@ - + @@ -397,7 +397,7 @@ - + @@ -407,7 +407,7 @@ - + @@ -419,7 +419,7 @@ - + @@ -427,7 +427,7 @@ - + @@ -439,7 +439,7 @@ - + @@ -451,7 +451,7 @@ - + @@ -461,7 +461,7 @@ - + @@ -473,7 +473,7 @@ - + @@ -481,7 +481,7 @@ - + @@ -493,39 +493,35 @@ - + - - - - - - - + + + - + - + - - - - - - - + + + + + - + - + - - - + + + + + - + @@ -533,7 +529,7 @@ - + @@ -543,7 +539,7 @@ - + @@ -559,7 +555,7 @@ - + @@ -567,7 +563,7 @@ - + @@ -579,7 +575,7 @@ - + @@ -591,7 +587,7 @@ - + @@ -603,7 +599,7 @@ - + @@ -615,7 +611,7 @@ - + @@ -623,7 +619,7 @@ - + @@ -635,7 +631,7 @@ - + @@ -647,7 +643,7 @@ - + @@ -657,7 +653,7 @@ - + @@ -669,7 +665,7 @@ - + @@ -681,7 +677,7 @@ - + @@ -691,7 +687,7 @@ - + @@ -703,7 +699,7 @@ - + @@ -711,7 +707,7 @@ - + @@ -723,7 +719,7 @@ - + @@ -735,7 +731,7 @@ - + @@ -745,7 +741,7 @@ - + @@ -757,7 +753,7 @@ - + @@ -765,7 +761,7 @@ - + @@ -777,39 +773,37 @@ - + - - - - - - - + + + - + - + + + - - - - - - - + + + + + - + - + - - - + + + + + - + @@ -817,7 +811,7 @@ - + @@ -827,7 +821,7 @@ - + diff --git a/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java b/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java index a1f02c0f1..7cf3d17a9 100644 --- a/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java +++ b/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java @@ -102,7 +102,8 @@ public static void main(final String[] args) { } } - switch (cmd) { + try { + switch (cmd) { case "createCDXA": // Create a new CDXA json file Bom bom = createCdxa(fileName, attestingOrgName, predicate, targetName, targetUrl, targetHash, affirmationStmt, affirmationWebsite, thirdParty); if (bom != null) { @@ -113,8 +114,20 @@ public static void main(final String[] args) { break; default: - System.out.println("Please enter a command."); + // Echo input command: + for (int i = 0; i < args.length; i++) { + System.out.print(args[i] + " "); + } + System.out.println("\nPlease enter a valid command."); System.exit(1); + } + } catch(Exception e) { + // Echo input command: + for (int i = 0; i < args.length; i++) { + System.out.print(args[i] + " "); + } + System.out.println("\nException: "+e); + System.exit(1); } } diff --git a/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java b/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java index 4533a9c37..496c1268d 100644 --- a/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java +++ b/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java @@ -23,6 +23,7 @@ import org.cyclonedx.model.formulation.Formula; import org.cyclonedx.model.Hash; import org.cyclonedx.model.Metadata; +import org.cyclonedx.model.metadata.ToolInformation; import org.cyclonedx.model.OrganizationalContact; import org.cyclonedx.model.OrganizationalEntity; import org.cyclonedx.model.Property; @@ -110,10 +111,6 @@ public static void main(final String[] args) { cmd = "addComponentHash"; } else if (args[i].equals("--addComponentProp")) { // Components --> Property: will add name-value. cmd = "addComponentProp"; - } else if (args[i].equals("--addExternalReference")) { - cmd = "addExternalReference"; - } else if (args[i].equals("--addComponentExtRef")) { - cmd = "addComponentExternalReference"; } else if (args[i].equals("--addMetadataTools")) { cmd = "addMetadataTools"; } else if (args[i].equals("--addFormulation")) { // Formulation Component. We can set "name" for Formulation. @@ -126,7 +123,8 @@ public static void main(final String[] args) { verbose = true; } } - switch (cmd) { + try { + switch (cmd) { case "createNewSBOM": // Creates new SBOM Bom bom = createBom(); writeFile(bom, fileName); @@ -182,7 +180,21 @@ public static void main(final String[] args) { break; default: - System.out.println("Please enter a command."); + // Echo input command: + for (int i = 0; i < args.length; i++) { + System.out.print(args[i] + " "); + } + System.out.println("\nPlease enter a valid command."); + System.exit(1); + } + } catch(Exception e) { + // Echo input command: + for (int i = 0; i < args.length; i++) { + System.out.print(args[i] + " "); + } + System.out.println("\nException: "+e); +e.printStackTrace(); + System.exit(1); } } @@ -196,10 +208,19 @@ static Bom createBom() { return bom; } + // Create Metadata if it doesn't exist + static Metadata getBomMetadata(Bom bom) { + Metadata metadata = bom.getMetadata(); + if (metadata == null) { + metadata = new Metadata(); + } + return metadata; + } + // Method to store Metadata --> name. static Bom addMetadata(final String fileName) { Bom bom = readFile(fileName); - Metadata meta = new Metadata(); + Metadata meta = getBomMetadata(bom); OrganizationalEntity org = new OrganizationalEntity(); org.setName("Eclipse Foundation"); org.setUrls(Collections.singletonList("https://www.eclipse.org/")); @@ -213,7 +234,7 @@ static Bom addMetadata(final String fileName) { static Bom addMetadataComponent(final String fileName, final String name, final String type, final String version, final String description) { Bom bom = readFile(fileName); - Metadata meta = new Metadata(); + Metadata meta = getBomMetadata(bom); Component comp = new Component(); Component.Type compType = Component.Type.FRAMEWORK; switch (type) { @@ -235,9 +256,8 @@ static Bom addMetadataComponent(final String fileName, final String name, final // Method to store Metadata --> Properties List --> name-values. static Bom addMetadataProperty(final String fileName, final String name, final String value) { Bom bom = readFile(fileName); - Metadata meta = new Metadata(); + Metadata meta = getBomMetadata(bom); Property prop1 = new Property(); - meta = bom.getMetadata(); prop1.setName(name); prop1.setValue(value); meta.addProperty(prop1); @@ -247,12 +267,30 @@ static Bom addMetadataProperty(final String fileName, final String name, final S static Bom addMetadataTools(final String fileName, final String toolName, final String version) { Bom bom = readFile(fileName); - Metadata meta = new Metadata(); - Tool tool = new Tool(); - meta = bom.getMetadata(); + Metadata meta = getBomMetadata(bom); + + // Create Tool Component + Component tool = new Component(); + tool.setType(Component.Type.APPLICATION); tool.setName(toolName); tool.setVersion(version); - meta.addTool(tool); + + // Create ToolInformation if not already + ToolInformation tools = meta.getToolChoice(); + if (tools == null) { + tools = new ToolInformation(); + } + + // Create new components array, add existing to it + List components = tools.getComponents(); + if (components == null) { + components = new LinkedList(); + } + + components.add(tool); + tools.setComponents(components); + meta.setToolChoice(tools); + bom.setMetadata(meta); return bom; } diff --git a/sbin/build.sh b/sbin/build.sh index bb956218c..9120e2121 100755 --- a/sbin/build.sh +++ b/sbin/build.sh @@ -1256,7 +1256,7 @@ addCycloneDXVersions() { JarVersionString=$(grep "${JarName}\.version=" "${JarDepsFile}" | cut -d'=' -f2) if [ -n "${JarVersionString}" ]; then addSBOMFormulationComponentProperty "${javaHome}" "${classpath}" "${sbomXml}" "CycloneDX" "CycloneDX jar versions" "${JarName}.jar" "${JarVersionString}" - elif [ "${JarName}" != "temurin-gen-sbom" ]; then + elif [ "${JarName}" != "temurin-gen-sbom" ] && [ "${JarName}" != "temurin-gen-cdxa" ]; then echo "ERROR: Cannot determine jar version from ${JarDepsFile} for SBOM creation dependency ${JarName}.jar." fi done