HDDS-10986. Publish SBOM artifacts (#6785)

apache · Jun 8, 2024 · 5600cb8 · 5600cb8
1 parent 1c7ccab
commit 5600cb8
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 0 deletions.
diff --git a/hadoop-ozone/dist/dev-support/bin/dist-layout-stitching b/hadoop-ozone/dist/dev-support/bin/dist-layout-stitching
@@ -113,6 +113,9 @@ run cp  -r "${ROOT}/hadoop-ozone/fault-injection-test/network-tests/src/test/blo
 # Optional documentation, could be missing
 cp -r "${ROOT}/hadoop-hdds/docs/target/classes/docs" ./
 
+# BOM is created only when using 'dist' profile
+cp -p "${ROOT}"/target/bom.* ./
+
 #copy byteman helpers
 run cp -r "${ROOT}/dev-support/byteman" "share/ozone/"
 

diff --git a/pom.xml b/pom.xml
@@ -140,6 +140,7 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xs
     <bouncycastle.version>1.78.1</bouncycastle.version>
     <derby.version>10.14.2.0</derby.version>
     <codahale-metrics.version>3.0.2</codahale-metrics.version>
+    <cyclonedx.version>2.8.0</cyclonedx.version>
     <dropwizard-metrics.version>3.2.6</dropwizard-metrics.version>
     <jacoco.version>0.8.12</jacoco.version>
     <javassist.version>3.30.2-GA</javassist.version>
@@ -1577,6 +1578,11 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xs
           <artifactId>download-maven-plugin</artifactId>
           <version>${download-maven-plugin.version}</version>
         </plugin>
+        <plugin>
+          <groupId>org.cyclonedx</groupId>
+          <artifactId>cyclonedx-maven-plugin</artifactId>
+          <version>${cyclonedx.version}</version>
+        </plugin>
       </plugins>
     </pluginManagement>
 
@@ -1834,6 +1840,18 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xs
               </execution>
             </executions>
           </plugin>
+          <plugin>
+            <groupId>org.cyclonedx</groupId>
+            <artifactId>cyclonedx-maven-plugin</artifactId>
+            <executions>
+              <execution>
+                <phase>package</phase>
+                <goals>
+                  <goal>makeAggregateBom</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
         </plugins>
       </build>
     </profile>