diff --git a/cyclonedx-lib/build.xml b/cyclonedx-lib/build.xml index 53a2cde4f..40a95a94f 100644 --- a/cyclonedx-lib/build.xml +++ b/cyclonedx-lib/build.xml @@ -204,7 +204,7 @@ - + @@ -224,7 +224,7 @@ - + @@ -251,8 +251,7 @@ - - + @@ -263,7 +262,7 @@ - + @@ -275,7 +274,7 @@ - + @@ -283,7 +282,7 @@ - + @@ -295,7 +294,7 @@ - + @@ -307,7 +306,7 @@ - + @@ -319,7 +318,7 @@ - + @@ -331,7 +330,7 @@ - + @@ -339,7 +338,7 @@ - + @@ -351,7 +350,7 @@ - + @@ -363,7 +362,7 @@ - + @@ -373,7 +372,7 @@ - + @@ -385,7 +384,7 @@ - + @@ -397,7 +396,7 @@ - + @@ -407,7 +406,7 @@ - + @@ -419,7 +418,7 @@ - + @@ -427,7 +426,7 @@ - + @@ -439,7 +438,7 @@ - + @@ -451,7 +450,7 @@ - + @@ -461,7 +460,7 @@ - + @@ -473,7 +472,7 @@ - + @@ -481,7 +480,7 @@ - + @@ -493,39 +492,35 @@ - + - - - - - - - + + + - + - + - - - - - - - + + + + + - + - + - - - + + + + + - + @@ -533,7 +528,7 @@ - + @@ -543,7 +538,7 @@ - + @@ -559,7 +554,7 @@ - + @@ -567,7 +562,7 @@ - + @@ -579,7 +574,7 @@ - + @@ -591,7 +586,7 @@ - + @@ -603,7 +598,7 @@ - + @@ -615,7 +610,7 @@ - + @@ -623,7 +618,7 @@ - + @@ -635,7 +630,7 @@ - + @@ -647,7 +642,7 @@ - + @@ -657,7 +652,7 @@ - + @@ -669,7 +664,7 @@ - + @@ -681,7 +676,7 @@ - + @@ -691,7 +686,7 @@ - + @@ -703,7 +698,7 @@ - + @@ -711,7 +706,7 @@ - + @@ -723,7 +718,7 @@ - + @@ -735,7 +730,7 @@ - + @@ -745,7 +740,7 @@ - + @@ -757,7 +752,7 @@ - + @@ -765,7 +760,7 @@ - + @@ -777,39 +772,41 @@ - + - - - - - - - + + + - + - + + + - - - - - - - + + + + + - + - - - - - - + + + + @@ -817,7 +814,7 @@ - + @@ -827,7 +824,7 @@ - + diff --git a/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java b/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java index a1f02c0f1..95a915235 100644 --- a/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java +++ b/cyclonedx-lib/src/temurin/sbom/TemurinGenCDXA.java @@ -102,7 +102,8 @@ public static void main(final String[] args) { } } - switch (cmd) { + try { + switch (cmd) { case "createCDXA": // Create a new CDXA json file Bom bom = createCdxa(fileName, attestingOrgName, predicate, targetName, targetUrl, targetHash, affirmationStmt, affirmationWebsite, thirdParty); if (bom != null) { @@ -113,8 +114,20 @@ public static void main(final String[] args) { break; default: - System.out.println("Please enter a command."); + // Echo input command: + for (int i = 0; i < args.length; i++) { + System.out.print(args[i] + " "); + } + System.out.println("\nPlease enter a valid command."); System.exit(1); + } + } catch (Exception e) { + // Echo input command: + for (int i = 0; i < args.length; i++) { + System.out.print(args[i] + " "); + } + System.out.println("\nException: " + e); + System.exit(1); } } diff --git a/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java b/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java index 4533a9c37..d22ae7ba0 100644 --- a/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java +++ b/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java @@ -23,10 +23,10 @@ import org.cyclonedx.model.formulation.Formula; import org.cyclonedx.model.Hash; import org.cyclonedx.model.Metadata; +import org.cyclonedx.model.metadata.ToolInformation; import org.cyclonedx.model.OrganizationalContact; import org.cyclonedx.model.OrganizationalEntity; import org.cyclonedx.model.Property; -import org.cyclonedx.model.Tool; import org.cyclonedx.parsers.JsonParser; import org.cyclonedx.parsers.XmlParser; import org.cyclonedx.Version; @@ -110,10 +110,6 @@ public static void main(final String[] args) { cmd = "addComponentHash"; } else if (args[i].equals("--addComponentProp")) { // Components --> Property: will add name-value. cmd = "addComponentProp"; - } else if (args[i].equals("--addExternalReference")) { - cmd = "addExternalReference"; - } else if (args[i].equals("--addComponentExtRef")) { - cmd = "addComponentExternalReference"; } else if (args[i].equals("--addMetadataTools")) { cmd = "addMetadataTools"; } else if (args[i].equals("--addFormulation")) { // Formulation Component. We can set "name" for Formulation. @@ -126,7 +122,8 @@ public static void main(final String[] args) { verbose = true; } } - switch (cmd) { + try { + switch (cmd) { case "createNewSBOM": // Creates new SBOM Bom bom = createBom(); writeFile(bom, fileName); @@ -182,7 +179,20 @@ public static void main(final String[] args) { break; default: - System.out.println("Please enter a command."); + // Echo input command: + for (int i = 0; i < args.length; i++) { + System.out.print(args[i] + " "); + } + System.out.println("\nPlease enter a valid command."); + System.exit(1); + } + } catch (Exception e) { + // Echo input command: + for (int i = 0; i < args.length; i++) { + System.out.print(args[i] + " "); + } + System.out.println("\nException: " + e); + System.exit(1); } } @@ -196,10 +206,19 @@ static Bom createBom() { return bom; } + // Create Metadata if it doesn't exist + static Metadata getBomMetadata(final Bom bom) { + Metadata metadata = bom.getMetadata(); + if (metadata == null) { + metadata = new Metadata(); + } + return metadata; + } + // Method to store Metadata --> name. static Bom addMetadata(final String fileName) { Bom bom = readFile(fileName); - Metadata meta = new Metadata(); + Metadata meta = getBomMetadata(bom); OrganizationalEntity org = new OrganizationalEntity(); org.setName("Eclipse Foundation"); org.setUrls(Collections.singletonList("https://www.eclipse.org/")); @@ -213,7 +232,7 @@ static Bom addMetadata(final String fileName) { static Bom addMetadataComponent(final String fileName, final String name, final String type, final String version, final String description) { Bom bom = readFile(fileName); - Metadata meta = new Metadata(); + Metadata meta = getBomMetadata(bom); Component comp = new Component(); Component.Type compType = Component.Type.FRAMEWORK; switch (type) { @@ -235,9 +254,8 @@ static Bom addMetadataComponent(final String fileName, final String name, final // Method to store Metadata --> Properties List --> name-values. static Bom addMetadataProperty(final String fileName, final String name, final String value) { Bom bom = readFile(fileName); - Metadata meta = new Metadata(); + Metadata meta = getBomMetadata(bom); Property prop1 = new Property(); - meta = bom.getMetadata(); prop1.setName(name); prop1.setValue(value); meta.addProperty(prop1); @@ -247,12 +265,30 @@ static Bom addMetadataProperty(final String fileName, final String name, final S static Bom addMetadataTools(final String fileName, final String toolName, final String version) { Bom bom = readFile(fileName); - Metadata meta = new Metadata(); - Tool tool = new Tool(); - meta = bom.getMetadata(); + Metadata meta = getBomMetadata(bom); + + // Create Tool Component + Component tool = new Component(); + tool.setType(Component.Type.APPLICATION); tool.setName(toolName); tool.setVersion(version); - meta.addTool(tool); + + // Create ToolInformation if not already + ToolInformation tools = meta.getToolChoice(); + if (tools == null) { + tools = new ToolInformation(); + } + + // Create new components array, add existing to it + List components = tools.getComponents(); + if (components == null) { + components = new LinkedList(); + } + + components.add(tool); + tools.setComponents(components); + meta.setToolChoice(tools); + bom.setMetadata(meta); return bom; } diff --git a/sbin/build.sh b/sbin/build.sh index 8224bae55..edff7f64e 100755 --- a/sbin/build.sh +++ b/sbin/build.sh @@ -934,14 +934,15 @@ getCyclonedxClasspath() { local CYCLONEDB_JAR_DIR="${CYCLONEDB_DIR}/build/jar" - local classpath="${CYCLONEDB_JAR_DIR}/temurin-gen-sbom.jar:${CYCLONEDB_JAR_DIR}/cyclonedx-core-java.jar:${CYCLONEDB_JAR_DIR}/jackson-core.jar:${CYCLONEDB_JAR_DIR}/jackson-dataformat-xml.jar:${CYCLONEDB_JAR_DIR}/jackson-databind.jar:${CYCLONEDB_JAR_DIR}/jackson-annotations.jar:${CYCLONEDB_JAR_DIR}/json-schema-validator.jar:${CYCLONEDB_JAR_DIR}/commons-codec.jar:${CYCLONEDB_JAR_DIR}/commons-io.jar:${CYCLONEDB_JAR_DIR}/github-package-url.jar:${CYCLONEDB_JAR_DIR}/commons-collections4.jar" + local classpath="${CYCLONEDB_JAR_DIR}/temurin-gen-sbom.jar:${CYCLONEDB_JAR_DIR}/cyclonedx-core-java.jar:${CYCLONEDB_JAR_DIR}/jackson-core.jar:${CYCLONEDB_JAR_DIR}/jackson-dataformat-xml.jar:${CYCLONEDB_JAR_DIR}/jackson-databind.jar:${CYCLONEDB_JAR_DIR}/jackson-annotations.jar:${CYCLONEDB_JAR_DIR}/json-schema-validator.jar:${CYCLONEDB_JAR_DIR}/commons-codec.jar:${CYCLONEDB_JAR_DIR}/commons-io.jar:${CYCLONEDB_JAR_DIR}/github-package-url.jar:${CYCLONEDB_JAR_DIR}/commons-collections4.jar:${CYCLONEDB_JAR_DIR}/stax2-api.jar:${CYCLONEDB_JAR_DIR}/woodstox-core.jar:${CYCLONEDB_JAR_DIR}/commons-lang3.jar" if [[ "$OSTYPE" == "cygwin" ]] || [[ "$OSTYPE" == "msys" ]]; then classpath="" for jarfile in "${CYCLONEDB_JAR_DIR}/temurin-gen-sbom.jar" "${CYCLONEDB_JAR_DIR}/cyclonedx-core-java.jar" \ "${CYCLONEDB_JAR_DIR}/jackson-core.jar" "${CYCLONEDB_JAR_DIR}/jackson-dataformat-xml.jar" \ "${CYCLONEDB_JAR_DIR}/jackson-databind.jar" "${CYCLONEDB_JAR_DIR}/jackson-annotations.jar" \ "${CYCLONEDB_JAR_DIR}/json-schema-validator.jar" "${CYCLONEDB_JAR_DIR}/commons-codec.jar" "${CYCLONEDB_JAR_DIR}/commons-io.jar" \ - "${CYCLONEDB_JAR_DIR}/github-package-url.jar" "${CYCLONEDB_JAR_DIR}/commons-collections4.jar"; + "${CYCLONEDB_JAR_DIR}/github-package-url.jar" "${CYCLONEDB_JAR_DIR}/commons-collections4.jar" \ + "${CYCLONEDB_JAR_DIR}/stax2-api.jar" "${CYCLONEDB_JAR_DIR}/woodstox-core.jar" "${CYCLONEDB_JAR_DIR}/commons-lang3.jar"; do classpath+=$(cygpath -w "${jarfile}")";" done @@ -1261,7 +1262,7 @@ addCycloneDXVersions() { JarVersionString=$(grep "${JarName}\.version=" "${JarDepsFile}" | cut -d'=' -f2) if [ -n "${JarVersionString}" ]; then addSBOMFormulationComponentProperty "${javaHome}" "${classpath}" "${sbomJson}" "CycloneDX" "CycloneDX jar versions" "${JarName}.jar" "${JarVersionString}" - elif [ "${JarName}" != "temurin-gen-sbom" ]; then + elif [ "${JarName}" != "temurin-gen-sbom" ] && [ "${JarName}" != "temurin-gen-cdxa" ]; then echo "ERROR: Cannot determine jar version from ${JarDepsFile} for SBOM creation dependency ${JarName}.jar." fi done diff --git a/tooling/validateSBOMcontent.sh b/tooling/validateSBOMcontent.sh index 56e98c6f6..4aff3daa8 100755 --- a/tooling/validateSBOMcontent.sh +++ b/tooling/validateSBOMcontent.sh @@ -22,11 +22,11 @@ SBOMFILE="$1" MAJORVERSION="$2" #FULLVERSION="$3" -GLIBC=$(jq '.metadata.tools[] | select(.name|test("GLIBC")) | .version' "$1" | tr -d \") -GCC=$(jq '.metadata.tools[] | select(.name|test("GCC")) | .version' "$1" | tr -d \") -BOOTJDK=$(jq '.metadata.tools[] | select(.name|test("BOOTJDK")) | .version' "$1" | tr -d \") -ALSA=$(jq '.metadata.tools[] | select(.name|test("ALSA")) | .version' "$1" | tr -d \" | sed -e 's/^.*alsa-lib-//' -e 's/\.tar.bz2//') -FREETYPE=$(jq '.metadata.tools[] | select(.name|test("FreeType")) | .version' "$1" | tr -d \") +GLIBC=$(jq '.metadata.tools.components[] | select(.name|test("GLIBC")) | .version' "$1" | tr -d \") +GCC=$(jq '.metadata.tools.components[] | select(.name|test("GCC")) | .version' "$1" | tr -d \") +BOOTJDK=$(jq '.metadata.tools.components[] | select(.name|test("BOOTJDK")) | .version' "$1" | tr -d \") +ALSA=$(jq '.metadata.tools.components[] | select(.name|test("ALSA")) | .version' "$1" | tr -d \" | sed -e 's/^.*alsa-lib-//' -e 's/\.tar.bz2//') +FREETYPE=$(jq '.metadata.tools.components[] | select(.name|test("FreeType")) | .version' "$1" | tr -d \") COMPILER=$(jq '.components[0].properties[] | select(.name|test("Build Tools Summary")).value' "$SBOMFILE" | sed -e 's/^.*Toolchain: //g' -e 's/\ *\*.*//g') EXPECTED_COMPILER="gcc (GNU Compiler Collection)"