Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FLINK-30578][build] Publish SBOM artifacts #21606

Merged
merged 1 commit into from
Jan 9, 2023

Conversation

dongjoon-hyun
Copy link
Member

@dongjoon-hyun dongjoon-hyun commented Jan 6, 2023

What is the purpose of the change

This PR aims to publish SBOM artifacts.

Here is an article to give some context.

Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: CycloneDX, Software Identification (SWID) tag, Software Package Data Exchange® (SPDX).

This PR uses CycloneDX maven plugin, a lightweight software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.

Brief change log

  • Add cyclonedx-maven-plugin plugin

Verifying this change

Each jar file will have two corresponding files, xxx-cyclonedx.xml and xxx-cyclonedx.json, like the following.

$ mvn install -DskipTests
...
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 15:31 min
[INFO] Finished at: 2023-01-05T16:51:10-08:00
[INFO] Final Memory: 537M/3856M
[INFO] ------------------------------------------------------------------------

$ ls -al ~/.m2/repository/org/apache/flink/flink-core/1.17-SNAPSHOT/
total 7176
drwxr-xr-x  9 dongjoon  staff      288 Jan  5 14:56 .
drwxr-xr-x  5 dongjoon  staff      160 Jan  5 14:56 ..
-rw-r--r--  1 dongjoon  staff      315 Jan  5 14:56 _remote.repositories
-rw-r--r--  1 dongjoon  staff    33566 Jan  5 14:56 flink-core-1.17-SNAPSHOT-cyclonedx.json
-rw-r--r--  1 dongjoon  staff    29527 Jan  5 14:56 flink-core-1.17-SNAPSHOT-cyclonedx.xml
-rw-r--r--  1 dongjoon  staff  1775935 Jan  5 14:56 flink-core-1.17-SNAPSHOT-tests.jar
-rw-r--r--  1 dongjoon  staff  1804660 Jan  5 14:56 flink-core-1.17-SNAPSHOT.jar
-rw-r--r--  1 dongjoon  staff    10071 Jan  5 14:56 flink-core-1.17-SNAPSHOT.pom
-rw-r--r--  1 dongjoon  staff     1324 Jan  5 14:56 maven-metadata-local.xml

Does this pull request potentially affect one of the following parts:

  • Dependencies (does it add or upgrade a dependency): Yes, but it's plugin dependency.
  • The public API, i.e., is any changed class annotated with @Public(Evolving): No
  • The serializers: No
  • The runtime per-record code paths (performance sensitive): No
  • Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: No
  • The S3 file system connector: No

Documentation

  • Does this pull request introduce a new feature? No
  • If yes, how is the feature documented? N/A

@flinkbot
Copy link
Collaborator

flinkbot commented Jan 6, 2023

CI report:

Bot commands The @flinkbot bot supports the following commands:
  • @flinkbot run azure re-run the last Azure build

@dongjoon-hyun dongjoon-hyun marked this pull request as draft January 6, 2023 00:33
@dongjoon-hyun dongjoon-hyun marked this pull request as ready for review January 6, 2023 00:52
@dongjoon-hyun
Copy link
Member Author

cc @gyfora , @mbalassi , @morhidi, @gaborgsomogyi

@mbalassi mbalassi self-assigned this Jan 6, 2023
@mbalassi mbalassi self-requested a review January 8, 2023 21:37
Copy link
Contributor

@mbalassi mbalassi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @dongjoon-hyun. Just to make sure that I understand correctly do these BOM files get automatically published on maven deploy?

@mbalassi mbalassi merged commit 9bb6500 into apache:master Jan 9, 2023
@dongjoon-hyun
Copy link
Member Author

Thank you for merging, @mbalassi !

@dongjoon-hyun dongjoon-hyun deleted the FLINK-30578 branch January 9, 2023 23:18
@mbalassi
Copy link
Contributor

Thanks, @dongjoon-hyun. Works like a charm:
https://repository.apache.org/content/repositories/snapshots/org/apache/flink/flink-core/1.17-SNAPSHOT/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants