From 872ab8276f9389214df924850b2de0f46638f9f1 Mon Sep 17 00:00:00 2001 From: Oliver Nocon Date: Fri, 27 Sep 2024 17:26:47 +0200 Subject: [PATCH 1/3] feat: allow creation of SBOM for custom builder --- internal/artifacts/sbom.go | 11 ++++++----- internal/commands/commands.go | 32 ++++++++++++++++++++++++++++++-- 2 files changed, 36 insertions(+), 7 deletions(-) diff --git a/internal/artifacts/sbom.go b/internal/artifacts/sbom.go index 17884bb1..7ccabec9 100644 --- a/internal/artifacts/sbom.go +++ b/internal/artifacts/sbom.go @@ -144,7 +144,8 @@ func cleanEnv(sbomTmpDir string) error { // generateSBomFile - generate all modules sbom and merge in to one, then mv it to sbom target path func generateSBomFile(loc *dir.Loc, mtaObj *mta.MTA, - sbomPath, sbomName, sbomType, sbomSuffix, sbomTmpDir string) error { + sbomPath, sbomName, sbomType, sbomSuffix, sbomTmpDir string, +) error { // (1) generation sbom for modules under sbom tmp dir err := generateSBomFiles(loc, mtaObj, sbomTmpDir, sbomType, sbomSuffix) if err != nil { @@ -257,8 +258,8 @@ func updateSBomMetadataNode(mtaObj *mta.MTA, sbomTmpDir, sbomTmpName string, mod } defer file.Close() - var purl = "pkg:mta/" + mtaObj.ID + "@" + mtaObj.Version - var xmlnsSchema = "http://cyclonedx.org/schema/bom/1.4" + purl := "pkg:mta/" + mtaObj.ID + "@" + mtaObj.Version + xmlnsSchema := "http://cyclonedx.org/schema/bom/1.4" decoder := xml.NewDecoder(file) decoder.Strict = false @@ -373,8 +374,7 @@ func updateSBomMetadataNode(mtaObj *mta.MTA, sbomTmpDir, sbomTmpName string, mod encoder.Flush() content := out.Bytes() content = bytes.Replace(content, []byte("\ufeff"), []byte(""), -1) - err = ioutil.WriteFile(sbomfilepath, content, 0644) - + err = ioutil.WriteFile(sbomfilepath, content, 0o644) if err != nil { return err } @@ -554,6 +554,7 @@ func generateSBomFiles(loc *dir.Loc, mtaObj *mta.MTA, sBomFileTmpDir string, sbo } // if sbomGenCmds is empty, module builder maybe "custom" or unknow builder, skip the module and continue if len(sbomGenCmds) == 0 { + // ToDo: consider braking the build in case no command is available logs.Logger.Infof(genSBomSkipModuleMsg, moduleName) continue } diff --git a/internal/commands/commands.go b/internal/commands/commands.go index 6ef1be97..91e281e9 100644 --- a/internal/commands/commands.go +++ b/internal/commands/commands.go @@ -330,7 +330,8 @@ func moduleCmd(mta *mta.MTA, moduleName string) (*mta.Module, []string, string, // GetModuleSBomGenCommands - get sbom generate command for module // if unknow sbom gen builder or custom builder, empty [][]string and nil error will be return func GetModuleSBomGenCommands(loc *dir.Loc, module *mta.Module, - sbomFileName string, sbomFileType string, sbomFileSuffix string) ([][]string, error) { + sbomFileName string, sbomFileType string, sbomFileSuffix string, +) ([][]string, error) { var cmd string var cmds []string var commandList [][]string @@ -358,7 +359,33 @@ func GetModuleSBomGenCommands(loc *dir.Loc, module *mta.Module, "-DincludeRuntimeScope=true -DincludeSystemScope=true -DincludeTestScope=false -DincludeLicenseText=false " + "-DoutputFormat=" + sbomFileType + " -DoutputName=" + sbomFileName + ".bom" cmds = append(cmds, cmd) + // allow custom creation of an SBOM for e.g. a custom builder case "custom": + // first check if custom SBOM creation commands are provided + customSbomGenCmds, ok := module.BuildParams["sbom-create-commands"].([]string) + // in case no custom commands are provided use standard way of creating SBOM + if !ok || (ok && len(customSbomGenCmds) == 0) { + switch module.Type { + case "nodejs": + cmd = "npm install" + cmds = append(cmds, cmd) + cmd = "npx " + cyclonedx_npm + "@" + cyclonedx_npm_version + " --output-format " + strings.ToUpper(sbomFileType) + " --spec-version " + cyclonedx_npm_schema_version + " --output-file " + sbomFileName + sbomFileSuffix + cmds = append(cmds, cmd) + case "java": + cmd = "mvn org.cyclonedx:cyclonedx-maven-plugin:2.7.5:makeAggregateBom " + + "-DschemaVersion=1.4 -DincludeBomSerialNumber=true -DincludeCompileScope=true " + + "-DincludeRuntimeScope=true -DincludeSystemScope=true -DincludeTestScope=false -DincludeLicenseText=false " + + "-DoutputFormat=" + sbomFileType + " -DoutputName=" + sbomFileName + ".bom" + cmds = append(cmds, cmd) + } + // in case custom SBOM creation commands are provided use them + } else { + // replace fileName placeholder ${sbom-file-name} which is to be provided in the custom SBOM creation commands + for i := range customSbomGenCmds { + customSbomGenCmds[i] = strings.ReplaceAll(customSbomGenCmds[i], "${sbom-file-name}", sbomFileName+sbomFileSuffix) + } + cmds = append(cmds, customSbomGenCmds...) + } default: } @@ -373,7 +400,8 @@ func GetModuleSBomGenCommands(loc *dir.Loc, module *mta.Module, // GetSBomsMergeCommand - generate merge sbom file command under sbom tmp dir // if empty sbomFileNames, return empty commandList, nil error func GetSBomsMergeCommand(loc *dir.Loc, cyclonedx_cli string, mtaObj *mta.MTA, sbomTmpDir string, sbomFileNames []string, - sbomName, sbomType, sbomSuffix string) ([][]string, error) { + sbomName, sbomType, sbomSuffix string, +) ([][]string, error) { var cmd string var cmds []string var commandList [][]string From bd8a1da81b7612d6745d018643f1553ba8629956 Mon Sep 17 00:00:00 2001 From: Oliver Nocon <33484802+OliverNocon@users.noreply.github.com> Date: Wed, 16 Oct 2024 14:33:24 +0200 Subject: [PATCH 2/3] fix typo in comment --- internal/artifacts/sbom.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/artifacts/sbom.go b/internal/artifacts/sbom.go index c027f821..6128eaee 100644 --- a/internal/artifacts/sbom.go +++ b/internal/artifacts/sbom.go @@ -458,7 +458,7 @@ func generateSBomFiles(loc *dir.Loc, mtaObj *mta.MTA, sBomFileTmpDir string, sbo } // if sbomGenCmds is empty, module builder maybe "custom" or unknow builder, skip the module and continue if len(sbomGenCmds) == 0 { - // ToDo: consider braking the build in case no command is available + // ToDo: consider braeking the build in case no command is available logs.Logger.Infof(genSBomSkipModuleMsg, moduleName) continue } From cc262d64c94551702080ffb9ed1e1467727d35a0 Mon Sep 17 00:00:00 2001 From: Oliver Nocon <33484802+OliverNocon@users.noreply.github.com> Date: Wed, 16 Oct 2024 14:34:31 +0200 Subject: [PATCH 3/3] fiy typo in comment --- internal/artifacts/sbom.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/artifacts/sbom.go b/internal/artifacts/sbom.go index 6128eaee..ca1da6fe 100644 --- a/internal/artifacts/sbom.go +++ b/internal/artifacts/sbom.go @@ -458,7 +458,7 @@ func generateSBomFiles(loc *dir.Loc, mtaObj *mta.MTA, sBomFileTmpDir string, sbo } // if sbomGenCmds is empty, module builder maybe "custom" or unknow builder, skip the module and continue if len(sbomGenCmds) == 0 { - // ToDo: consider braeking the build in case no command is available + // ToDo: consider breaking the build in case no command is available logs.Logger.Infof(genSBomSkipModuleMsg, moduleName) continue }