From 011dcc52d155b4ba54a79ca49f57e35db42fbd58 Mon Sep 17 00:00:00 2001 From: Stefan Bodewig Date: Sat, 23 May 2026 18:32:23 +0200 Subject: [PATCH 1/9] add dependencies necessary for ant-antlibs-cyclonedx I've manually copied the antlib jar itself to lib/optional --- fetch.xml | 8 +++++++- lib/libraries.properties | 1 + 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/fetch.xml b/fetch.xml index d223ecb8d1..da05846478 100644 --- a/fetch.xml +++ b/fetch.xml @@ -388,8 +388,14 @@ Set -Ddest=LOCATION on the command line + + + + + javamail,jakartamail,jspc,jai,xz,junit-engine-vintage,junit-engine-jupiter,netrexx,cyclonedx-core-java"/> diff --git a/lib/libraries.properties b/lib/libraries.properties index 15fe1994a5..46351acc70 100644 --- a/lib/libraries.properties +++ b/lib/libraries.properties @@ -42,6 +42,7 @@ bsh.version=2.0b5 commons-net.version=3.10.0 commons-logging.version=1.1 commons-logging-api.version=${commons-logging.version} +cyclonedx-core-java.version=12.2.0 js.version=20.1.0 js-scriptengine.version=${js.version} # Note - When updating the hamcrest version here, make sure to also update the From 080da9854589f41758595bc2aa148190d26121a7 Mon Sep 17 00:00:00 2001 From: Stefan Bodewig Date: Sun, 24 May 2026 10:33:43 +0200 Subject: [PATCH 2/9] start building a few SBOMs --- build.xml | 225 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 220 insertions(+), 5 deletions(-) diff --git a/build.xml b/build.xml index 5fd0edecfb..b66861cbf5 100644 --- a/build.xml +++ b/build.xml @@ -46,7 +46,7 @@ - + @@ -193,7 +193,7 @@ - + @@ -446,7 +446,7 @@ - - + @@ -2020,7 +2020,7 @@ ${antunit.reports} + unless="apache-resolver.present"/> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From d005350a54ccb0263084770477ad3e8cec9b2445 Mon Sep 17 00:00:00 2001 From: Stefan Bodewig Date: Sun, 24 May 2026 11:02:53 +0200 Subject: [PATCH 3/9] I must admit I no longer know why there is ant-junit and ant-junit4 --- build.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/build.xml b/build.xml index b66861cbf5..f46cb8482a 100644 --- a/build.xml +++ b/build.xml @@ -2412,11 +2412,20 @@ ${antunit.reports} + + + + + From a7c8426069b64d91b8c4e13566ac9e1d7d395dbf Mon Sep 17 00:00:00 2001 From: Stefan Bodewig Date: Sun, 24 May 2026 11:03:34 +0200 Subject: [PATCH 4/9] SBOM for ant-testutil.jar --- build.xml | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/build.xml b/build.xml index f46cb8482a..cec142ca33 100644 --- a/build.xml +++ b/build.xml @@ -2277,7 +2277,7 @@ ${antunit.reports} - @@ -2439,6 +2439,34 @@ ${antunit.reports} + + + + + + + + + + + + + + + From ec497cbd8712832ea05fe54c5b8abd50fd8064cd Mon Sep 17 00:00:00 2001 From: Stefan Bodewig Date: Sun, 24 May 2026 13:27:33 +0200 Subject: [PATCH 5/9] a few more sboms --- build.xml | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 72 insertions(+), 6 deletions(-) diff --git a/build.xml b/build.xml index cec142ca33..9ef5062f73 100644 --- a/build.xml +++ b/build.xml @@ -476,10 +476,10 @@ - - - - - - + + + @@ -2420,6 +2420,61 @@ ${antunit.reports} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Date: Sun, 24 May 2026 19:33:06 +0200 Subject: [PATCH 6/9] complete set of SBOMs for all Ant jars --- build.xml | 256 +++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 227 insertions(+), 29 deletions(-) diff --git a/build.xml b/build.xml index 9ef5062f73..1e60a1c35d 100644 --- a/build.xml +++ b/build.xml @@ -440,7 +440,7 @@ - - - - - - - - + + + - + @@ -748,7 +748,7 @@ - + @@ -1984,19 +1984,19 @@ ${antunit.reports} + unless="apache-bsf.present"/> + unless="apache-bsf.present"/> + unless="apache-bsf.present"/> + unless="apache-bsf.present"/> @@ -2469,11 +2469,55 @@ ${antunit.reports} - + + + + + + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Date: Sun, 24 May 2026 19:46:17 +0200 Subject: [PATCH 7/9] add cyclonedx SBOMs to distributions --- build.xml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/build.xml b/build.xml index 1e60a1c35d..b12ad93ee8 100644 --- a/build.xml +++ b/build.xml @@ -1030,7 +1030,7 @@ Create the essential distribution that can run Apache Ant =================================================================== --> - @@ -1415,6 +1415,12 @@ + + + + + + From 6f8f97ec8419de2b7261482b3186d61a84ba04fa Mon Sep 17 00:00:00 2001 From: Stefan Bodewig Date: Sun, 24 May 2026 20:01:12 +0200 Subject: [PATCH 8/9] publish cyclonedx SBOMs --- ReleaseInstructions | 2 +- release/ivy.xml | 104 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 105 insertions(+), 1 deletion(-) diff --git a/ReleaseInstructions b/ReleaseInstructions index f87c65ad5f..b89e642eef 100644 --- a/ReleaseInstructions +++ b/ReleaseInstructions @@ -158,7 +158,7 @@ Note: This document was adapted from the one created in the context of b. Using gpg $ for i in distribution/*/*.zip distribution/*/*.gz distribution/*/*.bz2 distribution/*/*.xz; do gpg --use-agent --detach-sign --armor $i; done - $ for i in java-repository/org/apache/ant/ant*/*/*.jar java-repository/org/apache/ant/ant*/*/*.pom; do gpg --use-agent --detach-sign --armor $i; done + $ for i in java-repository/org/apache/ant/ant*/*/*.jar java-repository/org/apache/ant/ant*/*/*.pom java-repository/org/apache/ant/ant*/*/*-cyclonedx.*; do gpg --use-agent --detach-sign --armor $i; done 11. Convert the part of the WHATSNEW file covering the changes since the last release into HTML for the README file on the diff --git a/release/ivy.xml b/release/ivy.xml index 1b414d9c7a..940f13d4d9 100644 --- a/release/ivy.xml +++ b/release/ivy.xml @@ -31,156 +31,260 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 341256ec333b49f8f482967e2cceedbf37a5a218 Mon Sep 17 00:00:00 2001 From: Stefan Bodewig Date: Mon, 25 May 2026 13:07:42 +0200 Subject: [PATCH 9/9] use gitbox instead of github vor VCS links --- build.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.xml b/build.xml index b12ad93ee8..3d31f3adf8 100644 --- a/build.xml +++ b/build.xml @@ -2264,7 +2264,7 @@ ${antunit.reports} url="https://www.apache.org/security/"/> + url="https://gitbox.apache.org/repos/asf/ant.git"/>