AVRO-3700: Publish Java SBOM artifacts with CycloneDX

[dongjoon-hyun]

What is the purpose of the change

This PR aims to publish SBOM artifacts.

Here is an article to give some context.

• https://www.activestate.com/blog/why-the-us-government-is-mandating-software-bill-of-materials-sbom/

Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: CycloneDX, Software Identification (SWID) tag, Software Package Data Exchange® (SPDX).

This PR uses CycloneDX maven plugin, a lightweight software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.

Verifying this change

Manually verify with the following procedure. avro-1.12.0-SNAPSHOT.jar will have avro-1.12.0-SNAPSHOT-cyclonedx.xml and avro-1.12.0-SNAPSHOT-cyclonedx.json BOM files.

$ mvn install -DskipTests
...
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  02:04 min
[INFO] Finished at: 2023-01-05T10:15:49-08:00
[INFO] ------------------------------------------------------------------------

$ ls -al ~/.m2/repository/org/apache/avro/avro/1.12.0-SNAPSHOT/
total 2184
drwxr-xr-x  9 dongjoon  staff     288 Jan  5 10:14 .
drwxr-xr-x  5 dongjoon  staff     160 Jan  5 10:14 ..
-rw-r--r--  1 dongjoon  staff     302 Jan  5 10:14 _remote.repositories
-rw-r--r--  1 dongjoon  staff   17421 Jan  5 10:14 avro-1.12.0-SNAPSHOT-cyclonedx.json
-rw-r--r--  1 dongjoon  staff   15178 Jan  5 10:14 avro-1.12.0-SNAPSHOT-cyclonedx.xml
-rw-r--r--  1 dongjoon  staff  443402 Jan  5 10:14 avro-1.12.0-SNAPSHOT-tests.jar
-rw-r--r--  1 dongjoon  staff  612699 Jan  5 10:14 avro-1.12.0-SNAPSHOT.jar
-rw-r--r--  1 dongjoon  staff    9510 Jan  5 10:03 avro-1.12.0-SNAPSHOT.pom
-rw-r--r--  1 dongjoon  staff    1329 Jan  5 10:14 maven-metadata-local.xml

Documentation

This is a build-only change.

[dongjoon-hyun]

Could you review this, @dkulp , @iemejia , @martin-g ?

[dongjoon-hyun]

Thank you, @martin-g and @iemejia .

[iemejia]

One question @dongjoon-hyun I am kind of new in the SBOM world but looking around it seems like there are like 3 big standards, any reason to choose the Cyclone one over SPDX (which seems to be the one being pushed by the Linux Foundation)? I am ok with merging this as it is, just curious. Better to have one that none :)

I am also wondering what other Apache projects use. Just from a quick look it seems not even Log4j with all the mess of the last year is publishing their SBOM and there are not recommendations yet from the security group at the ASF

[dongjoon-hyun]

Yes, among those three standards, CycloneDX and SPDX formats are proper for us and Maven plugins exist in the same way.

• https://github.com/CycloneDX/cyclonedx-maven-plugin
• https://github.com/spdx/spdx-maven-plugin

Although this PR delivers CycloneDX-style BOM files first, we may want to add SDPX-style BOM files additionally later. They are not exclusive. The reason why I choose CycloneDX is that it's simpler and focuses on mostly for application security and supply-chain component analysis, @iemejia . This fits my needs first.

[dongjoon-hyun]

For the second question, I also searched some references in ASF foundation, but I could not find any. So, I'm proposing and leading in the following way, @iemejia .

• ORC-1342: Publish SBOM artifacts (Merged, ORC-1342: Publish SBOM artifacts orc#1353)
• AVRO-3700: Publish SBOM artifacts (Approved, This PR, AVRO-3700: Publish Java SBOM artifacts with CycloneDX #2046)
• PARQUET-2224: Publish SBOM artifacts (Open, PARQUET-2224: Publish SBOM artifacts parquet-java#1017)
• SPARK-41893: Publish SBOM artifacts (Merged, [SPARK-41893][BUILD] Publish SBOM artifacts spark#39401)
• FLINK-30578: Publish SBOM artifacts (Open, [FLINK-30578][build] Publish SBOM artifacts flink#21606)

[iemejia]

LGTM

Excellent initiative @dongjoon-hyun! For future ref if someone tumbles into this PR/ticket there is ongoing discussion at the ASF about a possible standard for SBOM so this might evolve/change in the future.
https://cwiki.apache.org/confluence/display/COMDEV/SBOM

[dongjoon-hyun]

Oh, thank you for that info. @iemejia