-
Notifications
You must be signed in to change notification settings - Fork 60
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Improve Native Image SBOM Generation
- Loading branch information
Showing
9 changed files
with
1,067 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
86 changes: 86 additions & 0 deletions
86
native-maven-plugin/src/main/java/org/graalvm/buildtools/maven/sbom/ArtifactAdapter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| /* | ||
| * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved. | ||
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. | ||
| * | ||
| * The Universal Permissive License (UPL), Version 1.0 | ||
| * | ||
| * Subject to the condition set forth below, permission is hereby granted to any | ||
| * person obtaining a copy of this software, associated documentation and/or | ||
| * data (collectively the "Software"), free of charge and under any and all | ||
| * copyright rights in the Software, and any and all patent rights owned or | ||
| * freely licensable by each licensor hereunder covering either (i) the | ||
| * unmodified Software as contributed to or provided by such licensor, or (ii) | ||
| * the Larger Works (as defined below), to deal in both | ||
| * | ||
| * (a) the Software, and | ||
| * | ||
| * (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if | ||
| * one is included with the Software each a "Larger Work" to which the Software | ||
| * is contributed by such licensors), | ||
| * | ||
| * without restriction, including without limitation the rights to copy, create | ||
| * derivative works of, display, perform, and distribute the Software and make, | ||
| * use, sell, offer for sale, import, export, have made, and have sold the | ||
| * Software and the Larger Work(s), and to sublicense the foregoing rights on | ||
| * either these or other terms. | ||
| * | ||
| * This license is subject to the following condition: | ||
| * | ||
| * The above copyright notice and either this complete permission notice or at a | ||
| * minimum a reference to the UPL must be included in all copies or substantial | ||
| * portions of the Software. | ||
| * | ||
| * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | ||
| * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | ||
| * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | ||
| * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | ||
| * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | ||
| * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | ||
| * SOFTWARE. | ||
| */ | ||
| package org.graalvm.buildtools.maven.sbom; | ||
|
|
||
| import java.net.URI; | ||
| import java.util.HashSet; | ||
| import java.util.Set; | ||
|
|
||
| /** | ||
| * Data container that: (I) is an adapter between {@link org.apache.maven.artifact.Artifact} and | ||
| * {@link org.eclipse.aether.artifact.Artifact}; and (II) adds fields for the augmented component fields. | ||
| */ | ||
| final class ArtifactAdapter { | ||
| final String groupId; | ||
| final String artifactId; | ||
| final String version; | ||
| URI jarPath; | ||
| Set<String> packageNames; | ||
| boolean prunable = true; | ||
|
|
||
| ArtifactAdapter(String groupId, String artifactId, String version) { | ||
| this.groupId = groupId; | ||
| this.artifactId = artifactId; | ||
| this.version = version; | ||
| this.packageNames = new HashSet<>(); | ||
| } | ||
|
|
||
| static ArtifactAdapter fromMavenArtifact(org.apache.maven.artifact.Artifact artifact) { | ||
| return new ArtifactAdapter(artifact.getGroupId(), artifact.getArtifactId(), artifact.getVersion()); | ||
| } | ||
|
|
||
| static ArtifactAdapter fromEclipseArtifact(org.eclipse.aether.artifact.Artifact artifact) { | ||
| return new ArtifactAdapter(artifact.getGroupId(), artifact.getArtifactId(), artifact.getVersion()); | ||
| } | ||
|
|
||
| void setJarPath(URI jarPath) { | ||
| this.jarPath = jarPath; | ||
| } | ||
|
|
||
| void setPackageNames(Set<String> packageNames) { | ||
| this.packageNames = packageNames; | ||
| } | ||
|
|
||
| boolean equals(org.apache.maven.artifact.Artifact otherArtifact) { | ||
| return otherArtifact.getGroupId().equals(groupId) && otherArtifact.getArtifactId().equals(artifactId) && | ||
| otherArtifact.getVersion().equals(version); | ||
| } | ||
| } |
129 changes: 129 additions & 0 deletions
129
...plugin/src/main/java/org/graalvm/buildtools/maven/sbom/ArtifactToPackageNameResolver.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,129 @@ | ||
| /* | ||
| * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved. | ||
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. | ||
| * | ||
| * The Universal Permissive License (UPL), Version 1.0 | ||
| * | ||
| * Subject to the condition set forth below, permission is hereby granted to any | ||
| * person obtaining a copy of this software, associated documentation and/or | ||
| * data (collectively the "Software"), free of charge and under any and all | ||
| * copyright rights in the Software, and any and all patent rights owned or | ||
| * freely licensable by each licensor hereunder covering either (i) the | ||
| * unmodified Software as contributed to or provided by such licensor, or (ii) | ||
| * the Larger Works (as defined below), to deal in both | ||
| * | ||
| * (a) the Software, and | ||
| * | ||
| * (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if | ||
| * one is included with the Software each a "Larger Work" to which the Software | ||
| * is contributed by such licensors), | ||
| * | ||
| * without restriction, including without limitation the rights to copy, create | ||
| * derivative works of, display, perform, and distribute the Software and make, | ||
| * use, sell, offer for sale, import, export, have made, and have sold the | ||
| * Software and the Larger Work(s), and to sublicense the foregoing rights on | ||
| * either these or other terms. | ||
| * | ||
| * This license is subject to the following condition: | ||
| * | ||
| * The above copyright notice and either this complete permission notice or at a | ||
| * minimum a reference to the UPL must be included in all copies or substantial | ||
| * portions of the Software. | ||
| * | ||
| * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | ||
| * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | ||
| * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | ||
| * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | ||
| * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | ||
| * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | ||
| * SOFTWARE. | ||
| */ | ||
| package org.graalvm.buildtools.maven.sbom; | ||
|
|
||
| import org.apache.maven.artifact.Artifact; | ||
| import org.apache.maven.project.MavenProject; | ||
| import org.eclipse.aether.RepositorySystem; | ||
| import org.eclipse.aether.RepositorySystemSession; | ||
| import org.eclipse.aether.artifact.DefaultArtifact; | ||
| import org.eclipse.aether.repository.RemoteRepository; | ||
| import org.eclipse.aether.resolution.ArtifactRequest; | ||
| import org.eclipse.aether.resolution.ArtifactResolutionException; | ||
| import org.eclipse.aether.resolution.ArtifactResult; | ||
|
|
||
| import java.io.File; | ||
| import java.io.IOException; | ||
| import java.nio.file.Path; | ||
| import java.util.*; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| final class ArtifactToPackageNameResolver { | ||
| private final MavenProject mavenProject; | ||
| private final RepositorySystem repositorySystem; | ||
| private final RepositorySystemSession repositorySystemSession; | ||
| private final List<RemoteRepository> remoteRepositories; | ||
| private final ShadedPackageNameResolver shadedPackageNameResolver; | ||
|
|
||
| ArtifactToPackageNameResolver(MavenProject mavenProject, RepositorySystem repositorySystem, RepositorySystemSession repositorySystemSession, String mainClass) { | ||
| this.mavenProject = mavenProject; | ||
| this.repositorySystem = repositorySystem; | ||
| this.repositorySystemSession = repositorySystemSession; | ||
| this.remoteRepositories = mavenProject.getRemoteProjectRepositories(); | ||
| this.shadedPackageNameResolver = new ShadedPackageNameResolver(mavenProject, mainClass); | ||
| } | ||
|
|
||
| Set<ArtifactAdapter> getArtifactPackageMappings() throws Exception { | ||
| Set<ArtifactAdapter> artifactsWithPackageNameMappings = new HashSet<>(); | ||
| List<Artifact> artifacts = new ArrayList<>(mavenProject.getArtifacts()); | ||
| /* Purposefully add the project artifact last. This is important for the resolution of shaded jars. */ | ||
| artifacts.add(mavenProject.getArtifact()); | ||
| for (Artifact artifact : artifacts) { | ||
| Optional<ArtifactAdapter> optionalArtifact = resolvePackageNamesFromArtifact(artifact); | ||
| optionalArtifact.ifPresent(artifactsWithPackageNameMappings::add); | ||
| } | ||
|
|
||
| Set<ArtifactAdapter> dependencies = artifactsWithPackageNameMappings.stream() | ||
| .filter(v -> !v.equals(mavenProject.getArtifact())) | ||
| .collect(Collectors.toSet()); | ||
| ShadedPackageNameResolver.markShadedDependencies(dependencies); | ||
| return artifactsWithPackageNameMappings; | ||
| } | ||
|
|
||
| private Optional<ArtifactAdapter> resolvePackageNamesFromArtifact(Artifact artifact) throws ArtifactResolutionException, IOException { | ||
| File artifactFile = artifact.getFile(); | ||
| if (artifactFile != null && artifactFile.exists()) { | ||
| return resolvePackageNamesFromArtifactFile(artifactFile, ArtifactAdapter.fromMavenArtifact(artifact)); | ||
| } else { | ||
| DefaultArtifact sourceArtifact = new DefaultArtifact( | ||
| artifact.getGroupId(), artifact.getArtifactId(), "sources", "jar", artifact.getVersion() | ||
| ); | ||
| ArtifactRequest request = new ArtifactRequest() | ||
| .setArtifact(sourceArtifact) | ||
| .setRepositories(remoteRepositories); | ||
|
|
||
| ArtifactResult result = repositorySystem.resolveArtifact(repositorySystemSession, request); | ||
| if (result != null && result.getArtifact() != null && result.getArtifact().getFile() != null) { | ||
| File sourceFile = result.getArtifact().getFile(); | ||
| return resolvePackageNamesFromArtifactFile(sourceFile, ArtifactAdapter.fromEclipseArtifact(result.getArtifact())); | ||
| } | ||
| return Optional.empty(); | ||
| } | ||
| } | ||
|
|
||
| private Optional<ArtifactAdapter> resolvePackageNamesFromArtifactFile(File artifactFile, ArtifactAdapter artifact) throws IOException { | ||
| if (!artifactFile.exists()) { | ||
| return Optional.empty(); | ||
| } | ||
|
|
||
| Path sourcePath = artifactFile.toPath(); | ||
| if (artifactFile.isDirectory()) { | ||
| Set<String> packageNames = FileWalkerUtility.walkFileTreeAndCollectPackageNames(artifactFile.toPath()).orElse(Set.of()); | ||
| artifact.setPackageNames(packageNames); | ||
| return Optional.of(artifact); | ||
| } else if (artifactFile.getName().endsWith(".jar")) { | ||
| return shadedPackageNameResolver.resolvePackageNamesFromPossiblyShadedJar(sourcePath, artifact); | ||
| } else { | ||
| System.out.println("⚠️ Artifact file is neither a directory nor jar. File: " + sourcePath); | ||
| return Optional.empty(); | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.