Skip to content

Commit 546dfbf

Browse files
ppkarwaszppkarwasz
committed
Add SLSA data models
Adds SLSA data models annotated with Jackson annotation for serialization/deserialization to JSON.
1 parent f52aaad commit 546dfbf

12 files changed

Lines changed: 1390 additions & 0 deletions

File tree

‎fb-excludes.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,12 @@
1818
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
1919
xsi:schemaLocation="https://github.com/spotbugs/filter/3.0.0 https://raw.githubusercontent.com/spotbugs/spotbugs/3.1.0/spotbugs/etc/findbugsfilter.xsd">
2020

21+
<!-- SLSA provenance data models are short-lived DTOs serialized to JSON; defensive copying adds no safety. -->
22+
<Match>
23+
<Package name="org.apache.commons.release.plugin.slsa.v1_2" />
24+
<Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2" />
25+
</Match>
26+
2127
<!-- Omit junit tests -->
2228
<Match>
2329
<Class name="~.*\.*Test.*"/>

‎pom.xml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,20 @@
102102
<!-- Until Maven plugins used here don't fail the Moditect plugin -->
103103
<moditect.skip>true</moditect.skip>
104104
<japicmp.skip>true</japicmp.skip>
105+
<!-- Dependency versions -->
106+
<commons.jackson.version>2.21.2</commons.jackson.version>
105107
</properties>
108+
<dependencyManagement>
109+
<dependencies>
110+
<dependency>
111+
<groupId>com.fasterxml.jackson</groupId>
112+
<artifactId>jackson-bom</artifactId>
113+
<version>${commons.jackson.version}</version>
114+
<type>pom</type>
115+
<scope>import</scope>
116+
</dependency>
117+
</dependencies>
118+
</dependencyManagement>
106119
<dependencies>
107120
<dependency>
108121
<groupId>org.apache.commons</groupId>
@@ -160,6 +173,10 @@
160173
<artifactId>commons-compress</artifactId>
161174
<version>1.28.0</version>
162175
</dependency>
176+
<dependency>
177+
<groupId>com.fasterxml.jackson.core</groupId>
178+
<artifactId>jackson-annotations</artifactId>
179+
</dependency>
163180
<dependency>
164181
<groupId>org.apache.maven.plugin-testing</groupId>
165182
<artifactId>maven-plugin-testing-harness</artifactId>

‎src/main/java/org/apache/commons/release/plugin/slsa/v1_2/BuildDefinition.java‎

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,187 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* https://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package org.apache.commons.release.plugin.slsa.v1_2;
18+
19+
import java.util.HashMap;
20+
import java.util.List;
21+
import java.util.Map;
22+
import java.util.Objects;
23+
24+
import com.fasterxml.jackson.annotation.JsonProperty;
25+
26+
/**
27+
* Inputs that define the build: the build type, external and internal parameters, and resolved dependencies.
28+
*
29+
* <p>Specifies everything that influenced the build output. Together with {@link RunDetails}, it forms the complete
30+
* {@link Provenance} record.</p>
31+
*
32+
* @see <a href="https://slsa.dev/spec/v1.2">SLSA v1.2 Specification</a>
33+
*/
34+
public class BuildDefinition {
35+
36+
/**
37+
* URI indicating what type of build was performed.
38+
*/
39+
@JsonProperty("buildType")
40+
private String buildType = "https://commons.apache.org/proper/commons-release-plugin/slsa/v0.1.0";
41+
42+
/**
43+
* Inputs passed to the build.
44+
*/
45+
@JsonProperty("externalParameters")
46+
private Map<String, Object> externalParameters = new HashMap<>();
47+
48+
/**
49+
* Parameters set by the build platform.
50+
*/
51+
@JsonProperty("internalParameters")
52+
private Map<String, Object> internalParameters = new HashMap<>();
53+
54+
/**
55+
* Artifacts the build depends on, specified by URI and digest.
56+
*/
57+
@JsonProperty("resolvedDependencies")
58+
private List<ResourceDescriptor> resolvedDependencies;
59+
60+
/**
61+
* Creates a new BuildDefinition instance with the default build type.
62+
*/
63+
public BuildDefinition() {
64+
}
65+
66+
/**
67+
* Creates a new BuildDefinition with the given build type and external parameters.
68+
*
69+
* @param buildType URI indicating what type of build was performed
70+
* @param externalParameters inputs passed to the build
71+
*/
72+
public BuildDefinition(String buildType, Map<String, Object> externalParameters) {
73+
this.buildType = buildType;
74+
this.externalParameters = externalParameters;
75+
}
76+
77+
@Override
78+
public boolean equals(Object o) {
79+
if (this == o) {
80+
return true;
81+
}
82+
if (o == null || getClass() != o.getClass()) {
83+
return false;
84+
}
85+
BuildDefinition that = (BuildDefinition) o;
86+
return Objects.equals(buildType, that.buildType) && Objects.equals(externalParameters, that.externalParameters) && Objects.equals(internalParameters,
87+
that.internalParameters) && Objects.equals(resolvedDependencies, that.resolvedDependencies);
88+
}
89+
90+
/**
91+
* Gets the URI indicating what type of build was performed.
92+
*
93+
* <p>Determines the meaning of {@code externalParameters} and {@code internalParameters}.</p>
94+
*
95+
* @return the build type URI
96+
*/
97+
public String getBuildType() {
98+
return buildType;
99+
}
100+
101+
/**
102+
* Gets the inputs passed to the build, such as command-line arguments or environment variables.
103+
*
104+
* @return the external parameters map, or {@code null} if not set
105+
*/
106+
public Map<String, Object> getExternalParameters() {
107+
return externalParameters;
108+
}
109+
110+
/**
111+
* Gets the artifacts the build depends on, such as sources, dependencies, build tools, and base images,
112+
* specified by URI and digest.
113+
*
114+
* @return the internal parameters map, or {@code null} if not set
115+
*/
116+
public Map<String, Object> getInternalParameters() {
117+
return internalParameters;
118+
}
119+
120+
/**
121+
* Gets the materials that influenced the build.
122+
*
123+
* <p>Considered incomplete unless resolved materials are present.</p>
124+
*
125+
* @return the list of resolved dependencies, or {@code null} if not set
126+
*/
127+
public List<ResourceDescriptor> getResolvedDependencies() {
128+
return resolvedDependencies;
129+
}
130+
131+
@Override
132+
public int hashCode() {
133+
return Objects.hash(buildType, externalParameters, internalParameters, resolvedDependencies);
134+
}
135+
136+
/**
137+
* Sets the URI indicating what type of build was performed.
138+
*
139+
* @param buildType the build type URI
140+
* @return this for chaining
141+
*/
142+
public BuildDefinition setBuildType(String buildType) {
143+
this.buildType = buildType;
144+
return this;
145+
}
146+
147+
/**
148+
* Sets the inputs passed to the build.
149+
*
150+
* @param externalParameters the external parameters map
151+
* @return this for chaining
152+
*/
153+
public BuildDefinition setExternalParameters(Map<String, Object> externalParameters) {
154+
this.externalParameters = externalParameters;
155+
return this;
156+
}
157+
158+
/**
159+
* Sets the artifacts the build depends on.
160+
*
161+
* @param internalParameters the internal parameters map
162+
* @return this for chaining
163+
*/
164+
public BuildDefinition setInternalParameters(Map<String, Object> internalParameters) {
165+
this.internalParameters = internalParameters;
166+
return this;
167+
}
168+
169+
/**
170+
* Sets the materials that influenced the build.
171+
*
172+
* @param resolvedDependencies the list of resolved dependencies
173+
* @return this for chaining
174+
*/
175+
public BuildDefinition setResolvedDependencies(List<ResourceDescriptor> resolvedDependencies) {
176+
this.resolvedDependencies = resolvedDependencies;
177+
return this;
178+
}
179+
180+
@Override
181+
public String toString() {
182+
return "BuildDefinition{buildType='" + buildType + '\''
183+
+ ", externalParameters=" + externalParameters
184+
+ ", internalParameters=" + internalParameters
185+
+ ", resolvedDependencies=" + resolvedDependencies + '}';
186+
}
187+
}

‎src/main/java/org/apache/commons/release/plugin/slsa/v1_2/BuildMetadata.java‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* https://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package org.apache.commons.release.plugin.slsa.v1_2;
18+
19+
import java.time.OffsetDateTime;
20+
import java.util.Objects;
21+
22+
import com.fasterxml.jackson.annotation.JsonFormat;
23+
import com.fasterxml.jackson.annotation.JsonInclude;
24+
import com.fasterxml.jackson.annotation.JsonProperty;
25+
26+
/**
27+
* Metadata about a build invocation: its identifier and start and finish timestamps.
28+
*
29+
* @see <a href="https://slsa.dev/spec/v1.2">SLSA v1.2 Specification</a>
30+
*/
31+
@JsonInclude(JsonInclude.Include.NON_NULL)
32+
public class BuildMetadata {
33+
34+
/** Timestamp when the build completed. */
35+
@JsonFormat(shape = JsonFormat.Shape.STRING, pattern = "yyyy-MM-dd'T'HH:mm:ss'Z'")
36+
@JsonProperty("finishedOn")
37+
private OffsetDateTime finishedOn;
38+
/** Identifier for this build invocation. */
39+
@JsonProperty("invocationId")
40+
private String invocationId;
41+
/** Timestamp when the build started. */
42+
@JsonFormat(shape = JsonFormat.Shape.STRING, pattern = "yyyy-MM-dd'T'HH:mm:ss'Z'")
43+
@JsonProperty("startedOn")
44+
private OffsetDateTime startedOn;
45+
46+
/** Creates a new BuildMetadata instance. */
47+
public BuildMetadata() {
48+
}
49+
50+
/**
51+
* Creates a new BuildMetadata instance with all fields set.
52+
*
53+
* @param invocationId identifier for this build invocation
54+
* @param startedOn timestamp when the build started
55+
* @param finishedOn timestamp when the build completed
56+
*/
57+
public BuildMetadata(String invocationId, OffsetDateTime startedOn, OffsetDateTime finishedOn) {
58+
this.invocationId = invocationId;
59+
this.startedOn = startedOn;
60+
this.finishedOn = finishedOn;
61+
}
62+
63+
@Override
64+
public boolean equals(Object o) {
65+
if (!(o instanceof BuildMetadata)) {
66+
return false;
67+
}
68+
BuildMetadata that = (BuildMetadata) o;
69+
return Objects.equals(invocationId, that.invocationId) && Objects.equals(startedOn, that.startedOn) && Objects.equals(finishedOn, that.finishedOn);
70+
}
71+
72+
/**
73+
* Gets the timestamp of when the build completed, serialized as RFC 3339 in UTC ({@code "Z"} suffix).
74+
*
75+
* @return the completion timestamp, or {@code null} if not set
76+
*/
77+
public OffsetDateTime getFinishedOn() {
78+
return finishedOn;
79+
}
80+
81+
/**
82+
* Gets the identifier for this build invocation.
83+
*
84+
* @return the invocation identifier, or {@code null} if not set
85+
*/
86+
public String getInvocationId() {
87+
return invocationId;
88+
}
89+
90+
/**
91+
* Gets the timestamp of when the build started, serialized as RFC 3339 in UTC ({@code "Z"} suffix).
92+
*
93+
* @return the start timestamp, or {@code null} if not set
94+
*/
95+
public OffsetDateTime getStartedOn() {
96+
return startedOn;
97+
}
98+
99+
@Override
100+
public int hashCode() {
101+
return Objects.hash(invocationId, startedOn, finishedOn);
102+
}
103+
104+
/**
105+
* Sets the timestamp of when the build completed.
106+
*
107+
* @param finishedOn the completion timestamp
108+
* @return this for chaining
109+
*/
110+
public BuildMetadata setFinishedOn(OffsetDateTime finishedOn) {
111+
this.finishedOn = finishedOn;
112+
return this;
113+
}
114+
115+
/**
116+
* Sets the identifier for this build invocation.
117+
*
118+
* @param invocationId the invocation identifier
119+
* @return this for chaining
120+
*/
121+
public BuildMetadata setInvocationId(String invocationId) {
122+
this.invocationId = invocationId;
123+
return this;
124+
}
125+
126+
/**
127+
* Sets the timestamp of when the build started.
128+
*
129+
* @param startedOn the start timestamp
130+
* @return this for chaining
131+
*/
132+
public BuildMetadata setStartedOn(OffsetDateTime startedOn) {
133+
this.startedOn = startedOn;
134+
return this;
135+
}
136+
137+
@Override
138+
public String toString() {
139+
return "BuildMetadata{invocationId='" + invocationId + "', startedOn=" + startedOn + ", finishedOn=" + finishedOn + '}';
140+
}
141+
}

0 commit comments

Comments
 (0)