Add cyclonedx-lib build and --create-sbom option

[andrew-m-leonard]

Download the necessary CycloneDX libraries and dependencies, and build a TemurinGenSBOM.java app framework.
Added a new BUILD_ARGS --create-sbom, default is "false", which when set builds the library and invokes TemurinGenSBOM at the end of the build.

CycloneDX and dependent libraries and licenses:
cyclonedx-core-java : v5.0.4 : Apache License, Version 2.0
jackson-core : v2.12.4 : Apache License, Version 2.0
jackson-dataformat-xml : v2.12.4 : Apache License, Version 2.0
jackson-databind : v2.12.4 : Apache License, Version 2.0
jackson-annotations : v2.12.4 : Apache License, Version 2.0
json-schema-validator : v1.0.58 : Apache License, Version 2.0
commons-codec : v1.15 : Apache License, Version 2.0
commons-io : v2.11.0 : Apache License, Version 2.0
github-package-url : v1.4.0 : MIT License

TemurinGenSOM is currently just a dummy implementation, that prints the args and creates a dummy test SBOM.

Signed-off-by: Andrew Leonard [email protected]

[andrew-m-leonard]

run with --create-sbom: https://ci.adoptopenjdk.net/view/work-in-progress/job/andrew-cyclonedx/27/console

20:45:18  TemurinGenSBOM: --create temurin_sbom.json --name "Temurin SBOM" --version "1.2.3" --type "application" --author "Adoptium"
20:45:19  SBOM: {
20:45:19    "bomFormat" : "CycloneDX",
20:45:19    "specVersion" : "1.3",
20:45:19    "version" : 1,
20:45:19    "components" : [
20:45:19      {
20:45:19        "author" : "Adoptium",
20:45:19        "name" : "TestComponent",
20:45:19        "version" : "1.0.0",
20:45:19        "type" : "application"
20:45:19      }
20:45:19    ]
20:45:19  }

[andrew-m-leonard]

run tests

[smlambert]

LGTM (posed a question, but its not meant as a blocking question?)

[andrew-m-leonard]

@smlambert thanks. Did you submit the review comment? I can't see the question?

[sxa]

Thanks - as you said we can revisit if necessary in the future, but I think it is cleaner this way

[smlambert]

Hmm, thought I submitted it, but it was a question on how generic can the class be...
Whether it could be used by those who use our builds scripts as currently nothing in the class would need to be specific to Temurin (are passed in as cmds arg for specific Temurin SBOM) in which case is the Temurin specific name needed?

[andrew-m-leonard]

Hmm, thought I submitted it, but it was a question on how generic can the class be... Whether it could be used by those who use our builds scripts as currently nothing in the class would need to be specific to Temurin (are passed in as cmds arg for specific Temurin SBOM) in which case is the Temurin specific name needed?

@smlambert ah yes, I did wonder about the "name" myself for that reason... kept Temurin in the name as it's in a repo called temurin-build ...