Add build-attestation target

This PR was moved from apache/commons-build-plugin#417

It adds a goal to generate a [SLSA](https://slsa.dev/) build attestation and attaches it to the build as a file with the `.intoto.json` extension.

The attestation records the following information about the build environment:

- The Java version used (vendor, version string)
- The Maven version used
- The `gitTree` hash of the unpacked Java distribution
- The `gitTree` hash of the unpacked Maven distribution

Author: ppkarwasz

checkstyle.xml

@@ -185,7 +185,7 @@
     <module name="UpperEll" />
     <module name="ImportOrder">
       <property name="option" value="top"/>
-      <property name="groups" value="java,javax,org"/>
+      <property name="groups" value="java,javax"/>
       <property name="ordered" value="true"/>
       <property name="separated" value="true"/>
     </module>

fb-excludes.xml

@@ -18,6 +18,11 @@
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="https://github.com/spotbugs/filter/3.0.0 https://raw.githubusercontent.com/spotbugs/spotbugs/3.1.0/spotbugs/etc/findbugsfilter.xsd">
 
+  <!-- Mutable objects are not passed to untrusted methods, so we exclude these checks -->
+  <Match>
+    <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2" />
+  </Match>
+
   <!-- Omit junit tests -->
   <Match>
     <Class name="~.*\.*Test.*"/>

pom.xml

@@ -113,6 +113,9 @@
     <!-- Until Maven plugins used here don't fail the Moditect plugin -->
     <moditect.skip>true</moditect.skip>
     <japicmp.skip>true</japicmp.skip>
+    <!-- Dependency versions -->
+    <commons.jackson.version>2.21.1</commons.jackson.version>
+    <commons.jackson.annotations.version>2.21</commons.jackson.annotations.version>
   </properties>
   <dependencies>
     <dependency>
@@ -151,6 +154,18 @@
       <artifactId>maven-scm-api</artifactId>
       <version>${maven-scm.version}</version>
     </dependency>
+    <dependency>
+      <groupId>org.apache.maven.scm</groupId>
+      <artifactId>maven-scm-manager-plexus</artifactId>
+      <version>${maven-scm.version}</version>
+      <scope>compile</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.maven.scm</groupId>
+      <artifactId>maven-scm-provider-gitexe</artifactId>
+      <version>${maven-scm.version}</version>
+      <scope>runtime</scope>
+    </dependency>
     <dependency>
       <groupId>org.apache.maven.scm</groupId>
       <artifactId>maven-scm-provider-svnexe</artifactId>
@@ -171,6 +186,22 @@
       <artifactId>commons-compress</artifactId>
       <version>1.28.0</version>
     </dependency>
+    <dependency>
+      <groupId>com.fasterxml.jackson.core</groupId>
+      <artifactId>jackson-databind</artifactId>
+      <version>${commons.jackson.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>com.fasterxml.jackson.core</groupId>
+      <artifactId>jackson-annotations</artifactId>
+      <version>${commons.jackson.annotations.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>com.fasterxml.jackson.datatype</groupId>
+      <artifactId>jackson-datatype-jsr310</artifactId>
+      <version>${commons.jackson.version}</version>
+      <scope>runtime</scope>
+    </dependency>
     <dependency>
       <groupId>org.apache.maven.plugin-testing</groupId>
       <artifactId>maven-plugin-testing-harness</artifactId>
@@ -188,11 +219,28 @@
       <artifactId>junit-jupiter</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>net.javacrumbs.json-unit</groupId>
+      <artifactId>json-unit-assertj</artifactId>
+      <version>2.40.1</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-api</artifactId>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>org.junit.vintage</groupId>
       <artifactId>junit-vintage-engine</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.mockito</groupId>
+      <artifactId>mockito-core</artifactId>
+      <version>4.11.0</version>
+      <scope>test</scope>
+    </dependency>
     <!--  A bit of jar-hell requires this to come last. -->
     <dependency>
       <groupId>org.apache.maven</groupId>

src/main/java/org/apache/commons/release/plugin/internal/ArtifactUtils.java

@@ -0,0 +1,110 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.release.plugin.internal;
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.commons.codec.digest.DigestUtils;
+import org.apache.commons.release.plugin.slsa.v1_2.ResourceDescriptor;
+import org.apache.maven.artifact.Artifact;
+import org.apache.maven.plugin.MojoExecutionException;
+
+/**
+ * Utilities to convert {@link Artifact} from and to other types.
+ */
+public final class ArtifactUtils {
+
+    private ArtifactUtils() {
+        // prevent instantiation
+    }
+
+    /**
+     * Returns the conventional filename for the given artifact.
+     *
+     * @param artifact A Maven artifact.
+     * @return A filename.
+     */
+    public static String getFileName(Artifact artifact) {
+        return getFileName(artifact, artifact.getArtifactHandler().getExtension());
+    }
+
+    /**
+     * Returns the filename for the given artifact with a changed extension.
+     *
+     * @param artifact A Maven artifact.
+     * @param extension The file name extension.
+     * @return A filename.
+     */
+    public static String getFileName(Artifact artifact, String extension) {
+        StringBuilder fileName = new StringBuilder();
+        fileName.append(artifact.getArtifactId()).append("-").append(artifact.getVersion());
+        if (artifact.getClassifier() != null) {
+            fileName.append("-").append(artifact.getClassifier());
+        }
+        fileName.append(".").append(extension);
+        return fileName.toString();
+    }
+
+    /**
+     * Returns the Package URL corresponding to this artifact.
+     *
+     * @param artifact A maven artifact.
+     * @return A PURL for the given artifact.
+     */
+    public static String getPackageUrl(Artifact artifact) {
+        StringBuilder sb = new StringBuilder();
+        sb.append("pkg:maven/").append(artifact.getGroupId()).append("/").append(artifact.getArtifactId()).append("@").append(artifact.getVersion())
+                .append("?");
+        String classifier = artifact.getClassifier();
+        if (classifier != null) {
+            sb.append("classifier=").append(classifier).append("&");
+        }
+        sb.append("type=").append(artifact.getType());
+        return sb.toString();
+    }
+
+    private static Map<String, String> getChecksums(Artifact artifact) throws IOException {
+        Map<String, String> checksums = new HashMap<>();
+        DigestUtils digest = new DigestUtils(DigestUtils.getSha256Digest());
+        String sha256sum = digest.digestAsHex(artifact.getFile());
+        checksums.put("sha256", sha256sum);
+        return checksums;
+    }
+
+    /**
+     * Converts a Maven artifact to a SLSA {@link ResourceDescriptor}.
+     *
+     * @param artifact A Maven artifact.
+     * @return A SLSA resource descriptor.
+     * @throws MojoExecutionException If an I/O error occurs retrieving the artifact.
+     */
+    public static ResourceDescriptor toResourceDescriptor(Artifact artifact) throws MojoExecutionException {
+        ResourceDescriptor descriptor = new ResourceDescriptor();
+        descriptor.setName(getFileName(artifact));
+        descriptor.setUri(getPackageUrl(artifact));
+        if (artifact.getFile() != null) {
+            try {
+                descriptor.setDigest(getChecksums(artifact));
+            } catch (IOException e) {
+                throw new MojoExecutionException("Unable to compute hash for artifact file: " + artifact.getFile(), e);
+            }
+        }
+        return descriptor;
+    }
+}

src/main/java/org/apache/commons/release/plugin/internal/BuildToolDescriptors.java

@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.release.plugin.internal;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import org.apache.commons.release.plugin.slsa.v1_2.ResourceDescriptor;
+
+/**
+ * Factory methods for {@link ResourceDescriptor} instances representing build-tool dependencies.
+ */
+public final class BuildToolDescriptors {
+
+    private BuildToolDescriptors() {
+        // no instantiation
+    }
+
+    /**
+     * Creates a {@link ResourceDescriptor} for the JDK used during the build.
+     *
+     * @param javaHome path to the JDK home directory (value of the {@code java.home} system property)
+     * @return a descriptor with digest and annotations populated from system properties
+     * @throws IOException if hashing the JDK directory fails
+     */
+    public static ResourceDescriptor jvm(Path javaHome) throws IOException {
+        ResourceDescriptor descriptor = new ResourceDescriptor();
+        descriptor.setName("JDK");
+        Map<String, String> digest = new HashMap<>();
+        digest.put("gitTree", GitUtils.gitTree(javaHome));
+        descriptor.setDigest(digest);
+        String[] propertyNames = {"java.version", "java.vendor", "java.vendor.version", "java.vm.name", "java.vm.version", "java.vm.vendor",
+                "java.runtime.name", "java.runtime.version", "java.specification.version"};
+        Map<String, Object> annotations = new HashMap<>();
+        for (String prop : propertyNames) {
+            annotations.put(prop.substring("java.".length()), System.getProperty(prop));
+        }
+        descriptor.setAnnotations(annotations);
+        return descriptor;
+    }
+
+    /**
+     * Creates a {@link ResourceDescriptor} for the Maven installation used during the build.
+     *
+     * @param version   Maven version string
+     * @param mavenHome path to the Maven home directory
+     * @return a descriptor for the Maven installation
+     * @throws IOException if hashing the Maven home directory fails
+     */
+    public static ResourceDescriptor maven(String version, Path mavenHome) throws IOException {
+        ResourceDescriptor descriptor = new ResourceDescriptor();
+        descriptor.setName("Maven");
+        descriptor.setUri("pkg:maven/org.apache.maven/apache-maven@" + version);
+        Map<String, String> digest = new HashMap<>();
+        digest.put("gitTree", GitUtils.gitTree(mavenHome));
+        descriptor.setDigest(digest);
+        Properties buildProps = new Properties();
+        try (InputStream in = BuildToolDescriptors.class.getResourceAsStream("/org/apache/maven/messages/build.properties")) {
+            if (in != null) {
+                buildProps.load(in);
+            }
+        }
+        if (!buildProps.isEmpty()) {
+            Map<String, Object> annotations = new HashMap<>();
+            buildProps.forEach((key, value) -> annotations.put((String) key, value));
+            descriptor.setAnnotations(annotations);
+        }
+        return descriptor;
+    }
+}