Skip to content

Commit 880e744

Browse files
aloubyanskyaloubyansky
committed
Generate and bundle an SBOM inside artemis-console WAR
1 parent dcb6580 commit 880e744

5 files changed

Lines changed: 78 additions & 1 deletion

File tree

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ artemis-console-extension/artemis-extension/node/**/*
1919
artemis-console-extension/artemis-extension/packages/artemis-console-plugin/node_modules/
2020
artemis-console-extension/artemis-extension/app/node_modules/**/*
2121

22+
# generated SBOM
23+
artemis-console-extension/artemis-extension/bom.cdx.json
24+
2225
# yarn (zero-installs)
2326
artemis-console-extension/artemis-extension/.yarn/install-state.gz
2427
.yarn/**

‎artemis-console-extension/artemis-extension/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "artemis-console-monorepo",
3-
"version": "0",
3+
"version": "0.0.0",
44
"description": "Artemis Console Monorepo",
55
"license": "Apache-2.0",
66
"private": true,

‎artemis-console-extension/pom.xml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,36 @@
7878
<arguments>yarn build</arguments>
7979
</configuration>
8080
</execution>
81+
<!--
82+
Generate a CycloneDX SBOM for all npm dependencies
83+
using the official CycloneDX Yarn plugin. Resolves
84+
licenses from package.json in node_modules.
85+
-->
86+
<execution>
87+
<id>generate-sbom</id>
88+
<goals>
89+
<goal>corepack</goal>
90+
</goals>
91+
<configuration>
92+
<arguments>yarn workspace artemis-console-app dlx @cyclonedx/yarn-plugin-cyclonedx@3.3.3 --spec-version 1.6 --output-file ../bom.cdx.json</arguments>
93+
</configuration>
94+
</execution>
95+
<!--
96+
Enrich the SBOM:
97+
- add SHA-512 hashes from yarn.lock;
98+
- add evidence.identity;
99+
- -prod-only excludes non-production dependencies entirely;
100+
- omitting -prod-only sets scope=excluded for non-prod dependencies.
101+
-->
102+
<execution>
103+
<id>enrich-sbom</id>
104+
<goals>
105+
<goal>corepack</goal>
106+
</goals>
107+
<configuration>
108+
<arguments>yarn dlx @cyberstamp/cdx-npm-enrich@0.1.5 --prod-only bom.cdx.json</arguments>
109+
</configuration>
110+
</execution>
81111
<execution>
82112
<id>yarn test</id>
83113
<goals>
@@ -117,6 +147,12 @@
117147
</includes>
118148
<followSymlinks>false</followSymlinks>
119149
</fileset>
150+
<fileset>
151+
<directory>${basedir}/${extension.path}</directory>
152+
<includes>
153+
<include>bom.cdx.json</include>
154+
</includes>
155+
</fileset>
120156
</filesets>
121157
</configuration>
122158
</plugin>

‎artemis-console-war/pom.xml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,15 @@
7676
<plugin>
7777
<groupId>org.apache.maven.plugins</groupId>
7878
<artifactId>maven-war-plugin</artifactId>
79+
<executions>
80+
<execution>
81+
<id>prepare-war</id>
82+
<phase>prepare-package</phase>
83+
<goals>
84+
<goal>exploded</goal>
85+
</goals>
86+
</execution>
87+
</executions>
7988
<configuration>
8089
<nonFilteredFileExtensions>
8190
<!-- default value contains jpg,jpeg,gif,bmp,png -->
@@ -92,10 +101,36 @@
92101
<include>**/*.*</include>
93102
</includes>
94103
</resource>
104+
<resource>
105+
<filtering>false</filtering>
106+
<directory>${project.build.directory}</directory>
107+
<targetPath>META-INF/sbom</targetPath>
108+
<includes>
109+
<include>bom.cdx.json</include>
110+
</includes>
111+
</resource>
95112
</webResources>
96113
</configuration>
97114
</plugin>
98115

116+
<plugin>
117+
<groupId>dev.cyberstamp.maven.assembly.sbom</groupId>
118+
<artifactId>assembly-sbom-maven-plugin</artifactId>
119+
<version>0.1.1</version>
120+
<executions>
121+
<execution>
122+
<phase>prepare-package</phase>
123+
<goals>
124+
<goal>generate</goal>
125+
</goals>
126+
<configuration>
127+
<externalSboms>${project.basedir}/../artemis-console-extension/artemis-extension/bom.cdx.json</externalSboms>
128+
<outputFile>${project.build.directory}/bom.cdx.json</outputFile>
129+
</configuration>
130+
</execution>
131+
</executions>
132+
</plugin>
133+
99134
<plugin>
100135
<groupId>org.eclipse.jetty.ee11</groupId>
101136
<artifactId>jetty-ee11-maven-plugin</artifactId>

‎pom.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,9 @@
244244
<exclude>**/tsconfig.json</exclude>
245245
<exclude>**/artemis-extension/app/build/**</exclude>
246246
<exclude>**/artemis-extension/packages/artemis-console-plugin/dist/**</exclude>
247+
248+
<!-- Generated SBOM -->
249+
<exclude>**/bom.cdx.json</exclude>
247250
</excludes>
248251
</configuration>
249252
</plugin>

0 commit comments

Comments
 (0)