Initial prototype for generating a CycloneDX SBOM from a p2 repository

.gitignore

@@ -0,0 +1,5 @@
+target/
+bin/
+*~
+testarea/
+build.log

.project

@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>org.eclipse.cbi.p2repo.sbom.root</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+	</buildSpec>
+	<natures>
+	</natures>
+	<filteredResources>
+		<filter>
+			<id>1703280530766</id>
+			<name></name>
+			<type>10</type>
+			<matcher>
+				<id>org.eclipse.ui.ide.multiFilter</id>
+				<arguments>1.0-name-matches-false-false-target</arguments>
+			</matcher>
+		</filter>
+		<filter>
+			<id>1703280530767</id>
+			<name></name>
+			<type>30</type>
+			<matcher>
+				<id>org.eclipse.ui.ide.multiFilter</id>
+				<arguments>1.0-projectRelativePath-matches-false-true-(features|plugins|products|releng|tests)/.*/.*</arguments>
+			</matcher>
+		</filter>
+	</filteredResources>
+</projectDescription>

.settings/org.eclipse.core.resources.prefs

@@ -0,0 +1,2 @@
+eclipse.preferences.version=1
+encoding/<project>=UTF-8

CODE_OF_CONDUCT.md

@@ -0,0 +1,51 @@
+# Community Code of Conduct
+
+Project obeys latest version of the Eclipse Community Code of Conduct, available at https://www.eclipse.org/org/documents/Community_Code_of_Conduct.php
+
+Here is a copy of current version as this document was created
+
+**Version 1.2  
+August 19, 2020**
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as community members, contributors, committers, and project leaders pledge to make participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+*   Using welcoming and inclusive language
+*   Being respectful of differing viewpoints and experiences
+*   Gracefully accepting constructive criticism
+*   Focusing on what is best for the community
+*   Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+*   The use of sexualized language or imagery and unwelcome sexual attention or advances
+*   Trolling, insulting/derogatory comments, and personal or political attacks
+*   Public or private harassment
+*   Publishing others' private information, such as a physical or electronic address, without explicit permission
+*   Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+With the support of the Eclipse Foundation staff (the “Staff”), project committers and leaders are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project committers and leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all project spaces, and it also applies when an individual is representing the Eclipse Foundation project or its community in public spaces. Examples of representing a project or community include posting via an official social media account, or acting as a project representative at an online or offline event. Representation of a project may be further defined and clarified by project committers, leaders, or the EMO.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the Staff at codeofconduct@eclipse.org. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The Staff is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+
+Project committers or leaders who do not follow the Code of Conduct in good faith may face temporary or permanent repercussions as determined by the Staff.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org) , version 1.4, available at [https://www.contributor-covenant.org/version/1/4/code-of-conduct.html](https://www.contributor-covenant.org/version/1/4/code-of-conduct/)
+

CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# Contributing to the <img src="https://raw.githubusercontent.com/eclipse-cbi/p2repo-aggregator/main/cbi.svg" style="width: 1em;"/> p2 SBOM Generator
+
+Thanks for your interest in this project.
+
+## Project description
+
+The Eclipse Common Build Infrastructure (CBI) combines technologies and best-practices for building Eclipse Software.
+
+* https://projects.eclipse.org/projects/technology.cbi
+
+## Setting Up a Development Environment
+
+You can set up a pre-configured IDE for the development of the p2 SBOM Generator projects using the following link.
+
+[![Create Eclipse Development Environment for the p2 SBOM Generator](https://download.eclipse.org/oomph/www/setups/svg/p2_SBOM.svg)](https://www.eclipse.org/setups/installer/?url=https://raw.githubusercontent.com/merks/p2repo-sbom/main/releng/org.eclipse.cbi.p2repo.sbom.releng.parent/setup/P2RepositorySBOMConfiguration.setup&show=true "Click to open Eclipse-Installer Auto Launch or drag onto your running installer's title area")
+
+## Developer resources
+
+Information regarding source code management, builds, coding standards, and more.
+
+* https://projects.eclipse.org/projects/technology.cbi/developer
+
+This project uses *GitHub issues* on the respective repositories to track ongoing development and issues.
+
+Be sure to search for existing issues before you create another one.
+Contributions are always welcome!
+
+## Eclipse Development Process
+
+This Eclipse Foundation open project is governed by the Eclipse Foundation Development Process and operates under the terms of the Eclipse IP Policy.
+
+## Eclipse Contributor Agreement
+
+Before your contribution can be accepted by the project team contributors must electronically sign the Eclipse Contributor Agreement (ECA).
+
+* http://www.eclipse.org/legal/ECA.php
+
+For more information, please see the Eclipse Committer Handbook:
+
+*  https://www.eclipse.org/projects/handbook/#resources-commit
+
+## Contact
+
+Contact the project developers via the project's *dev* list.
+
+* mailto:cbi-dev@eclipse.org 

Jenkinsfile

@@ -0,0 +1,138 @@
+pipeline {
+  agent { label 'migration' }
+
+   options {
+    buildDiscarder(logRotator(numToKeepStr: '10'))
+    disableConcurrentBuilds()
+    skipDefaultCheckout true
+  }
+
+  tools {
+    maven 'apache-maven-latest'
+    jdk 'temurin-jdk17-latest'
+  }
+
+  environment {
+    PUBLISH_LOCATION = 'cbi/updates/p2-sbom'
+    GITHUB_REPO = 'merks/p2repo-sbom'
+  }
+
+  parameters {
+    choice(
+      name: 'BUILD_TYPE',
+      choices: ['nightly', 'milestone', 'release'],
+      description: '''
+        Choose the type of build.
+        Note that a release build will not promote the build, but rather will promote the most recent milestone build.
+        '''
+    )
+
+    booleanParam(
+      name: 'PROMOTE',
+      defaultValue: false,
+      description: 'Whether to promote the build to the download server.'
+    )
+
+    booleanParam(
+      name: 'ARCHIVE',
+      defaultValue: false,
+      description: 'Whether to archive the workspace.'
+    )
+  }
+
+  stages {
+    stage('Display Parameters') {
+      steps {
+        echo "BUILD_TYPE=${params.BUILD_TYPE}"
+        echo "PROMOTE=${params.PROMOTE}"
+        echo "ARCHIVE=${params.ARCHIVE}"
+        script {
+          env.PROMOTE = params.PROMOTE
+          env.BUILD_TYPE = params.BUILD_TYPE
+        }
+      }
+    }
+
+    stage('Git Checkout') {
+      steps {
+        script {
+          def gitVariables = checkout(
+            poll: false,
+            scm: [
+              $class: 'GitSCM',
+              branches: [[name: '*/main']],
+              doGenerateSubmoduleConfigurations: false,
+              extensions: [[$class: 'RelativeTargetDirectory', relativeTargetDir: 'p2repo-sbom']],
+              submoduleCfg: [],
+              userRemoteConfigs: [[url: "https://github.com/${GITHUB_REPO}.git"]]
+            ]
+          )
+
+          echo "$gitVariables"
+          env.GIT_COMMIT = gitVariables.GIT_COMMIT
+        }
+      }
+    }
+
+    stage('Build Tools and Products') {
+      steps {
+        sshagent(['projects-storage.eclipse.org-bot-ssh']) {
+          dir('p2repo-sbom/releng/org.eclipse.cbi.p2repo.sbom.releng.parent') {
+            sh '''
+              pwd
+              if [[ $PROMOTE == false ]]; then
+                promotion_argument='-Dorg.eclipse.justj.p2.manager.args='
+              fi
+              mvn \
+                --no-transfer-progress\
+                $promotion_argument \
+                -Dorg.eclipse.storage.user=genie.cbi \
+                -Dorg.eclipse.justj.p2.manager.build.url=$JOB_URL \
+                -Dorg.eclipse.download.location.relative=$PUBLISH_LOCATION \
+                -Dorg.eclipse.justj.p2.manager.relative= \
+                -Dbuild.type=$BUILD_TYPE \
+                -Dgit.commit=$GIT_COMMIT \
+                -Dbuild.id=$BUILD_NUMBER \
+                -DskipTests=false \
+                -Peclipse-sign \
+                -Ppromote \
+                clean \
+                verify
+              '''
+          }
+        }
+      }
+    }
+
+    stage('Archive Results') {
+      when {
+        expression {
+          params.ARCHIVE
+        }
+      }
+      steps {
+        archiveArtifacts 'p2repo-sbom/**'
+      }
+    }
+  }
+
+  post {
+    failure {
+      mail to: 'ed.merks@gmail.com',
+      subject: "[CBI p2 SBOM] Build Failure ${currentBuild.fullDisplayName}",
+      mimeType: 'text/html',
+      body: "Project: ${env.JOB_NAME}<br/>Build Number: ${env.BUILD_NUMBER}<br/>Build URL: ${env.BUILD_URL}<br/>Console: ${env.BUILD_URL}/console"
+    }
+
+    fixed {
+      mail to: 'ed.merks@gmail.com',
+      subject: "[CBI p2 SBOM] Back to normal ${currentBuild.fullDisplayName}",
+      mimeType: 'text/html',
+      body: "Project: ${env.JOB_NAME}<br/>Build Number: ${env.BUILD_NUMBER}<br/>Build URL: ${env.BUILD_URL}<br/>Console: ${env.BUILD_URL}/console"
+    }
+
+    cleanup {
+      deleteDir()
+    }
+  }
+}

NOTICE.md

@@ -0,0 +1,35 @@
+# Notices for Eclipse Common Build Infrastructure
+
+This content is produced and maintained by the Eclipse Common Build Infrastructure project.
+
+* Project home: https://projects.eclipse.org/projects/technology.cbi
+
+## Trademarks
+
+Eclipse Common Build Infrastructure, and Common Build Infrastructure are trademarks of the Eclipse Foundation.
+
+## Copyright
+
+All content is the property of the respective authors or their employers.
+For more information regarding authorship of content, please consult the listed source code repository commit logs.
+
+## Declared Project Licenses
+
+This program and the accompanying materials are made available under the terms of the Eclipse Public License 2.0:
+* https://www.eclipse.org/org/documents/epl-2.0/EPL-2.0.html.
+
+SPDX-License-Identifier: EPL-2.0
+
+## Source Code
+
+The project maintains the following code repositories:
+* https://projects.eclipse.org/projects/technology.cbi/developer
+
+## Third-party Content
+
+This project leverages third party content.
+
+## Cryptography
+
+Content may contain encryption software.
+The country in which you are currently may have restrictions on the import, possession, and use, and/or re-export to another country, of encryption software. BEFORE using any encryption software, please check the country's laws, regulations and policies concerning the import, possession, or use, and re-export of encryption software, to see if this is permitted. 

README.md

@@ -1,2 +1,9 @@
-# p2repo-sbom
-Infrastructure from generating an CycloneDX SBOM 
+<img src="https://raw.githubusercontent.com/eclipse-cbi/p2repo-aggregator/main/cbi.svg" width="10%">
+
+# p2 SBOM Generator
+
+Infrastructure for generating a CycloneDX SBOM from a p2 repository.
+
+# Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).

SECURITY.md

@@ -0,0 +1,3 @@
+# How To Report a Vulnerability
+
+See https://github.com/eclipse-platform/.github/blob/main/SECURITY.md

features/org.eclipse.cbi.p2repo.sbom.cli.product.feature/.project

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>org.eclipse.cbi.p2repo.sbom.cli.product.feature</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.pde.FeatureBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.eclipse.pde.FeatureNature</nature>
+	</natures>
+	<filteredResources>
+		<filter>
+			<id>1637246629608</id>
+			<name></name>
+			<type>10</type>
+			<matcher>
+				<id>org.eclipse.ui.ide.multiFilter</id>
+				<arguments>1.0-name-matches-false-false-target</arguments>
+			</matcher>
+		</filter>
+	</filteredResources>
+</projectDescription>

features/org.eclipse.cbi.p2repo.sbom.cli.product.feature/.settings/org.eclipse.core.resources.prefs

@@ -0,0 +1,2 @@
+eclipse.preferences.version=1
+encoding/<project>=UTF-8

features/org.eclipse.cbi.p2repo.sbom.cli.product.feature/build.properties

@@ -0,0 +1,3 @@
+bin.includes = feature.xml,\
+               feature.properties
+src.includes = pom.xml

features/org.eclipse.cbi.p2repo.sbom.cli.product.feature/feature.properties

@@ -0,0 +1,17 @@
+# Copyright (c) 2023 Eclipse contributors and others.
+# 
+# This program and the accompanying materials
+# are made available under the terms of the Eclipse Public License 2.0
+# which accompanies this distribution, and is available at
+# https://www.eclipse.org/legal/epl-2.0/
+# 
+# SPDX-License-Identifier: EPL-2.0
+
+featureName=CBI p2 SBOM Product Feature
+
+# "description" property - description of the feature
+description=The feature that defines the CBI p2 SBOM product.
+
+providerName=Eclipse CBI
+
+copyright=Copyright (c) 2023 Eclipse contributors and others.