HADOOP-18590. Publish SBOM artifacts #5281
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
cc @steveloughran , @sunchao , @snmvaughan |
cnauroth
approved these changes
Jan 6, 2023
There was a problem hiding this comment.
+1, pending CI.
- Confirmed 2.7.3 is the latest version of the plugin.
- Applied patch locally.
- Ran
mvn -B -T 8 clean install -DskipShade -DskipTests. - Verified presence of cyclonedx.json and cyclonedx.xml files under ~/.m2/repository.
@dongjoon-hyun , thanks for driving this! I'm going to hold off committing until next week in case some of the others you cc'd want to comment.
|
Thank you, @cnauroth ! |
|
Thank you, @sunchao ! |
|
💔 -1 overall
This message was automatically generated. |
|
Apache Yetus(Jenkins) error: unit job seems to pass although it has a |
cnauroth
pushed a commit
that referenced
this pull request
Jan 10, 2023
Signed-off-by: Chris Nauroth <cnauroth@apache.org> (cherry picked from commit 6f99558)
|
I merged this to trunk. I also cherry-picked to branch-3.3 and branch-3.2 after resolving a minor merge conflict. @dongjoon-hyun , thank you for the contribution! @sunchao , thank you for the code review. (Sorry, I forgot to mention you in the |
|
How does this work for shaded things the Hadoop build itself pulls in? |
|
Hi, @steveloughran . Basically, these are SBOM for jars. So, this PR aims to use |
|
FYI, here is Apache ORC 1.8.2 RC1 vote artifact, @steveloughran . |
|
got it. will add to 3.3.5 too as this will be our first release with this |
asfgit
pushed a commit
that referenced
this pull request
Jan 16, 2023
Signed-off-by: Chris Nauroth <cnauroth@apache.org> (cherry picked from commit 6f99558)
|
Thank you, @steveloughran . |
|
ok, verified the artifacts get into the local mvn repo. i do like the xml version BTW, including all the signatures. makes it easier to spot tampering, doesn't it? also highlights how hadoop-common has way too many dependencies. we should see what we can do to prune back stuff, such as my #4996. every jar we cut saves many, many integration problems |
It's great. :)
We already did like the other official Apache artifacts. Please see the official Apache ORC 1.8.2.
https://repo1.maven.org/maven2/org/apache/orc/orc-core/1.8.2/ |
asfgit
pushed a commit
that referenced
this pull request
Feb 23, 2023
Causes HADOOP-18641. cyclonedx maven plugin breaks on recent maven releases This reverts branch-3.3 commit b6fd322.
asfgit
pushed a commit
that referenced
this pull request
Feb 23, 2023
Causes HADOOP-18641. cyclonedx maven plugin breaks on recent maven releases This reverts commit 61f6628.
asfgit
pushed a commit
that referenced
this pull request
Feb 23, 2023
Causes HADOOP-18641. cyclonedx maven plugin breaks on recent maven releases This reverts commit 6f99558.
4 tasks
ferdelyi
pushed a commit
to ferdelyi/hadoop
that referenced
this pull request
May 26, 2023
Causes HADOOP-18641. cyclonedx maven plugin breaks on recent maven releases This reverts commit 6f99558.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of PR
This PR aims to publish SBOM artifacts.
Here is an article to give some context.
Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: CycloneDX, Software Identification (SWID) tag, Software Package Data Exchange® (SPDX).
This PR uses CycloneDX maven plugin, a lightweight software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.
How was this patch tested?
Manually. For example,
hadoop-auth-3.4.0-SNAPSHOT.jarwill havehadoop-auth-3.4.0-SNAPSHOT-cyclonedx.xmlandhadoop-auth-3.4.0-SNAPSHOT-cyclonedx.jsonSBOM files additionally.For code changes:
LICENSE,LICENSE-binary,NOTICE-binaryfiles?