Adding CycloneDX to generate a Software Bill Of Materials #7915
Conversation
|
I usually do: our use-case involves submitting the sbom to Dependency-Track to monitor dependencies. Alternatively GH provides SBOM download/export for GeoServer at https://github.com/geoserver/geoserver/network/dependencies though that also includes lots of irrelevant things like python and maven deps for building |
| <plugin> | ||
| <groupId>org.cyclonedx</groupId> | ||
| <artifactId>cyclonedx-maven-plugin</artifactId> | ||
| <version>2.8.2</version> |
There was a problem hiding this comment.
Usual feedback of pushing version up to root pom.xml
|
@jodygarnett all I needed was a "one off" sbom generation, but thought to open the PR to gather feedback. I have no block of time allocated to push this further, but happy to keep discussing. In my mind the main question remaining is how to deliver this, should we decide to include it in releases (as said, at the moment, I only needed a one-off SBOM for a GeoServer with a particular set of plugins). The idea to use the GeoServer own REST API (if I understood correctly) sounds weird, although I guess it may be convenient to go and ask a given GeoServer installation for its own SBOM... but we'd have to compute the SBOMS during every build, and add them into the classpath as resources, to pull that off. The calculation seemed to take a while, this PR is just a draft, for something "real" I would have it as part of the release procedure only. |
|
Now that I understand what this is, I think it would be easiest to:
Anyone wishing to do an audit can process the bill of materials for core geoserver, and any extensions they choose to install also. |
|
if/when Maven is used to publish/push artifacts the sbom is attached to the artifact including signature files for integrity eg. <dependency>
<groupId>org.tailormap</groupId>
<artifactId>tailormap-api</artifactId>
<version>11.4.0</version>
<classifier>cyclonedx</classifier>
<type>json</type>
</dependency> |
Experimenting with the CycloneDX plugin to generate a Software Bill Of Materials in said format.
Apparently this is becoming a common request to validate software contents.
Here is an example output tested on GeoServer 2.24.3 with a given set of plugins enabled via profiles, so that you can get an idea:
CycloneDX-Sbom.json
The command to generate it was:
and then grab the results in web/app/target.
This would help supporting the EU Cyber Resilence Act, which among the other things, requires a SBOM structure (I've been told this is already active in Germany). See also this article by OWASP.
I've also noticed software, like PMD, that is adding these SBOM files as part of their release process:
https://github.com/pmd/pmd/releases/tag/pmd_releases%2F7.6.0
Checklist
mainbranch (backports managed later; ignore for branch specific issues).For core and extension modules:
[GEOS-XYZWV] Title of the Jira ticket.