Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(UI/REST): CycloneDX SBOM Importer & Exporter #2015

Merged
merged 1 commit into from Jun 28, 2023
Merged

feat(UI/REST): CycloneDX SBOM Importer & Exporter #2015

merged 1 commit into from Jun 28, 2023

Conversation

akapti
Copy link
Contributor

@akapti akapti commented Jun 23, 2023 •
edited

Please provide a summary of your changes here.

This feature enables the possibility to import and export a CycloneDx SBOM to and from SW360 respectively.

Issue: #1146

Suggest Reviewer

@ag4ums @smrutis1

How To Test?

  • Both XML and JSON format of CycloneDX SBOM is supported for import and export.

$\textcolor{yellow}{\text{IMPORT:}}$

  • Importing a CycloneDx SBOM will create Components and Releases in SW360 Project as per the list of Components present in SBOM.
  • For successful import, SBOM file will be linked to the Project as attachment of type SBOM.
  • For successful import, SBOM import status file with name SBOM-FILE-NAME_ImportStatus_Creation-Date-Time.json containing import relevant information like Components count, Release count, Components with missing name or version etc.
  • Import can be performed from Project Home page or Project Details page.
  • Import / Export can be controlled based on user role using the property sbom.import.export.access.usergroup in sw360.properties file. Default value is USER.
  • $\textcolor{cyan}{\text{Import from Project Home page:}}$
    • An SBOM should be imported from Project Home page if you want to create a new Project based on Component present in metadata tag of SBOM and link all the Components to the newly created Project.
    • Import will fail if there is already an existing Project with same name and version as Component present in SBOM metadata tag.
    • Any user should be able to import SBOM from Project Home page.
  • $\textcolor{cyan}{\text{Import from Project Details page:}}$
    • An SBOM should be imported from Project Details page if you want to update the existing Project with new or updated Components from SBOM.
    • Import will fail if existing Project name and version is not the same as Component present in SBOM metadata tag.
    • Only user with write access to Project should be able to import an SBOM from Project Home page.

$\textcolor{yellow}{\text{EXPORT:}}$

  • Export can be performed from Project Details page only.
  • Export SBOM button will be shown if and only if there is at least one directly linked Release or sub-Project.
  • Exporting will create a CycloneDx SBOM from Components and Releases present in SW360 Project.
  • By default only directly linked Releases of the Project are included while exporting an SBOM.
  • To include Releases of Sub-Projects in the exported SBOM, user should check the Include releases from sub-projects in exported sbom? checkbox.
  • Linked Release of a Release will always be ignored while exporting SBOM.

$\textcolor{yellow}{\text{REST API:}}$

  • Currently REST API for only importing an SBOM is available in this PR.
  • REST API for exporting the SBOM will be a added later as a part of different PR.

$\textcolor{yellow}{\text{SCREENSHOT:}}$

  • PROJECT HOME PAGE:
    image
    image
    image

  • PROJECT DETAILS PAGE:
    image
    image
    image
    image

Checklist

Must:

  • All related issues are referenced in commit messages and in PR

Signed-off-by: afsahsyeda afsah.syeda@siemens-healhtineers.com
Signed-off-by: akapti abdul.kapti@siemens-healthineers.com

@akapti akapti added needs code review needs general test This is general testing, meaning that there is no org specific issue to check for needs special test Opposed to general testing, this requires dedicated check at some party's deployment labels Jun 23, 2023
@akapti akapti added this to Preparing in Pull Request Board via automation Jun 23, 2023
@akapti akapti moved this from Preparing to Ready for review in Pull Request Board Jun 23, 2023
@akapti akapti added this to the General Improvements milestone Jun 23, 2023
@akapti akapti linked an issue Jun 23, 2023 that may be closed by this pull request
Support for Consuming CycloneDX BOM #1146
Closed
@akapti akapti force-pushed the feat/CycloneDxBOM-Import-Export-1146 branch 7 times, most recently from 01d47e1 to c9ec5a0 Compare June 27, 2023 10:47
smrutis1
smrutis1 requested changes Jun 27, 2023
View reviewed changes
Copy link
Contributor

@smrutis1 smrutis1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting some minor changes

backend/src-common/src/main/java/org/eclipse/sw360/cyclonedx/CycloneDxBOMExporter.java Outdated Show resolved Hide resolved
libraries/datahandler/src/main/java/org/eclipse/sw360/datahandler/common/SW360Utils.java Outdated
public static String getSW360Version() {
MavenXpp3Reader reader = new MavenXpp3Reader();
try (InputStreamReader iStreamReader = new InputStreamReader(
SW360Utils.class.getResourceAsStream("/META-INF/maven/org.eclipse.sw360/datahandler/pom.xml"))) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kindly try to remove the hard-coded path

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have made in configurable via sw360.properties : datahandler.pom.file.path

...ce-server/src/main/java/org/eclipse/sw360/rest/resourceserver/project/ProjectController.java Outdated Show resolved Hide resolved
@akapti akapti force-pushed the feat/CycloneDxBOM-Import-Export-1146 branch from c9ec5a0 to 9beded0 Compare June 27, 2023 14:52
@ag4ums ag4ums removed needs general test This is general testing, meaning that there is no org specific issue to check for needs special test Opposed to general testing, this requires dedicated check at some party's deployment labels Jun 28, 2023
ag4ums
ag4ums approved these changes Jun 28, 2023
View reviewed changes
Copy link
Contributor

@ag4ums ag4ums left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

import and export is working fine

feat(UI/REST): CycloneDX SBOM Importer & Exporter
1bf1576 
Signed-off-by: afsahsyeda <afsah.syeda@siemens-healhtineers.com>
Signed-off-by: akapti <abdul.kapti@siemens-healthineers.com>
@akapti akapti force-pushed the feat/CycloneDxBOM-Import-Export-1146 branch from 9beded0 to 1bf1576 Compare June 28, 2023 10:14
smrutis1
smrutis1 approved these changes Jun 28, 2023
View reviewed changes
Copy link
Contributor

@smrutis1 smrutis1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code looks good

@akapti akapti moved this from Ready for review to Reviewer Approved in Pull Request Board Jun 28, 2023
@akapti akapti added ready ready to merge and removed needs code review labels Jun 28, 2023
@ag4ums ag4ums merged commit ed8ce98 into eclipse-sw360:main Jun 28, 2023
1 of 2 checks passed
@tienlee tienlee mentioned this pull request Jul 4, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ag4ums ag4ums ag4ums approved these changes

@smrutis1 smrutis1 smrutis1 approved these changes

Assignees
No one assigned
Labels
ready ready to merge
Projects
Pull Request Board
  
Reviewer Approved
Milestone
General Improvements
Development

Successfully merging this pull request may close these issues.

Support for Consuming CycloneDX BOM
3 participants
@akapti @ag4ums @smrutis1