refactoring/527_spdx-sbom by redcatbear · Pull Request #542 · itsallcode/openfasttrace

redcatbear · 2026-06-13T09:23:18Z

This PR adds SPDX 3 Software Bills of Materials (SBOMs) to the OpenFastTrace build and release process.

Improvements

Generate SPDX 3 SBOMs in JSON-LD format during Maven's package phase.
Use the .spdx3.json extension for every generated module SBOM.
Generate the product SBOM from the product's production dependency graph, so it describes the distributed OpenFastTrace modules without leaking test dependencies or build plugins from the Maven reactor.
Add a robust integration test that verifies:
- exactly one product SBOM is generated;
- the document uses an SPDX 3 JSON-LD context and represents a software SBOM;
- the product, API, and core modules are present;
- JUnit test dependencies and Maven build plugins are absent.
Upload the product SBOM as a GitHub Actions artifact on regular CI builds, making it available for inspection without creating a release.
Attach the product SBOM and its SHA-256 checksum to GitHub releases as separate release artifacts.
Keep the product JAR and its SHA-256 checksum as separate release artifacts.
Fail CI and release creation when an expected artifact is missing.
Document SBOM generation for developers and explain SBOM availability in the security policy and release notes.

Closes #527.

kaklakariada · 2026-06-14T13:40:28Z

+      - name: Upload SPDX SBOM
+        uses: actions/upload-artifact@v7
+        if: ${{ env.DEFAULT_OS == matrix.os && env.DEFAULT_JAVA == matrix.java }}
+        with:
+          name: openfasttrace-spdx
+          path: product/target/site/*.spdx.json
+          if-no-files-found: error


👍
Also generate this in the release workflow, calculate checksum and attach it with the checksum to the GitHub release (see shell script).

kaklakariada · 2026-06-14T13:42:07Z

+      - name: Generate SPDX SBOM
+        if: ${{ env.DEFAULT_OS == matrix.os && env.DEFAULT_JAVA == matrix.java }}
+        run: |
+          mvn --batch-mode -pl product spdx:createSPDX \
+              -Dossindex.skip=true \
+              -Djava.version=${{ matrix.java }}


Would it be possible to run the plugin with mvn install? Then you don't need a separate build step.

kaklakariada · 2026-06-14T13:49:54Z

+                    <!-- The following section is unfortunately necessary because the Maven SPDX plugin has problems
+                         with OFT's multi-module project
+                    -->
+                    <licenseOverwrites>


We really need to find a workaround for this ;)

kaklakariada · 2026-06-14T13:51:23Z

+                <configuration>
+                    <sbomType>build</sbomType>
+                    <includeTestScope>false</includeTestScope>
+                    <licenseDeclared>GPL-3.0-only</licenseDeclared>
+                    <licenseConcluded>GPL-3.0-only</licenseConcluded>
+                    <copyrightText>Copyright (c) itsallcode.org</copyrightText>
+                    <createExternalRefs>false</createExternalRefs>
+                    <defaultFileConcludedLicense>GPL-3.0-only</defaultFileConcludedLicense>
+                    <defaultLicenseInformationInFile>GPL-3.0-only</defaultLicenseInformationInFile>
+                    <defaultFileCopyright>Copyright (c) itsallcode.org</defaultFileCopyright>
+                </configuration>
+            </plugin>


Duplicated in parent pom. Is this really necessary as the root is only an aggregator pom without code?

Co-authored-by: Christoph Pirkl <4711730+kaklakariada@users.noreply.github.com>

sonarqubecloud · 2026-06-14T14:47:27Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

This PR introduces initial SPDX SBOM generation for OpenFastTrace using the SPDX Maven Plugin, and updates module metadata/documentation to support publishing/consumption expectations around SBOMs and licensing.

Changes:

Add SPDX SBOM generation via org.spdx:spdx-maven-plugin (module + aggregation) and upload SBOM artifacts in CI.
Add/standardize Maven module <description> metadata and SPDX-aligned license metadata.
Update documentation/release notes and add SECURITY.md, alongside a version bump to 4.6.0.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`pom.xml`	Adds SPDX plugin configuration at the root (aggregation goal + basic SPDX metadata).
`parent/pom.xml`	Bumps revision to `4.6.0`, introduces SPDX metadata properties, updates license metadata, and adds SPDX plugin configuration for modules.
`product/pom.xml`	Configures SPDX aggregation for the product build, including license overwrites for OFT modules.
`.github/workflows/build.yml`	Generates and uploads an SPDX SBOM artifact as part of CI.
`SECURITY.md`	Adds a security policy and SBOM disclosure statement.
`doc/developer_guide.md`	Documents how to generate the SBOM locally (build/install then `spdx:createSPDX`).
`doc/changes/changes_4.6.0.md`	Mentions SBOM availability in the 4.6.0 changelog summary/refactoring notes.
`openfasttrace-mc-deployable-parent/pom.xml`	Adds a description for the Maven Central deployable parent POM.
`api/pom.xml`	Adds module description metadata.
`core/pom.xml`	Adds module description metadata.
`testutil/pom.xml`	Adds module description metadata.
`exporter/common/pom.xml`	Adds module description metadata.
`exporter/specobject/pom.xml`	Adds module description metadata.
`importer/lightweightmarkup/pom.xml`	Adds module description metadata.
`importer/markdown/pom.xml`	Adds module description metadata.
`importer/restructuredtext/pom.xml`	Adds module description metadata.
`importer/specobject/pom.xml`	Adds module description metadata.
`importer/tag/pom.xml`	Adds module description metadata.
`importer/xmlparser/pom.xml`	Adds module description metadata.
`importer/zip/pom.xml`	Adds module description metadata.
`reporter/aspec/pom.xml`	Adds module description metadata.
`reporter/html/pom.xml`	Adds module description metadata.
`reporter/plaintext/pom.xml`	Adds module description metadata.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+                <executions>
+                    <execution>
+                        <id>build-spdx</id>
+                        <goals>
+                            <goal>createSPDX</goal>
+                        </goals>
+                        <phase>
+                            none
+                        </phase>
+                    </execution>
+                </executions>


+
+## Software Bill of Materials (SBOM)
+
+To enhance transparency and security, SPDX SBOMs (Software Bill of Materials) are included with the GitHub releases starting from version 4.6.0. These files provide a comprehensive list of all components and dependencies used in the project.


-We moved some GitHub action permissions from workflow-level to job-level.
+We moved some GitHub action permissions from workflow-level to job-level and fixed a number of Sonar findings that we accumulated with Sonar introducing new rules.
+
+And, we now create an SPDX SBOM. You can find the SBOM of the product JAR attached to all new GitHub releases.


…refactoring/527_spdx-sbom

sonarqubecloud · 2026-08-22T09:07:03Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

redcatbear added 4 commits May 29, 2026 20:16

#527: SPDX SBOM first part.

93842b7

Merge branch 'main' into refactoring/527_spdx-sbom

8c282a4

#527: Added descriptions to all packages in the individual POM files.

8833bc9

#527: Got a minimal SPDX SBOM that looks correct.

878c8ea

redcatbear requested a review from kaklakariada June 13, 2026 09:23

redcatbear self-assigned this Jun 13, 2026

redcatbear added the documentation User guides, turorials, specifications label Jun 13, 2026

#527: Added security policy.

82a8391

kaklakariada requested changes Jun 14, 2026

View reviewed changes

Apply suggestions from code review

ccecf16

Co-authored-by: Christoph Pirkl <4711730+kaklakariada@users.noreply.github.com>

kaklakariada approved these changes Jun 15, 2026

View reviewed changes

kaklakariada requested a review from Copilot July 1, 2026 17:30

Copilot started reviewing on behalf of kaklakariada July 1, 2026 17:30 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

redcatbear added 5 commits August 22, 2026 10:30

#527: Fixed SBOM findings.

fd9a5e3

#527: Improved phrasing.

4329ebe

Merge branch 'main' into refactoring/527_spdx-sbom

01adc7a

#527: Fixed version number expectation.

c6939ba

Merge remote-tracking branch 'origin/refactoring/527_spdx-sbom' into …

ee081b6

…refactoring/527_spdx-sbom

redcatbear merged commit 5628aef into main Aug 22, 2026
12 checks passed

redcatbear deleted the refactoring/527_spdx-sbom branch August 22, 2026 09:10

Navigation Menu

Uh oh!

refactoring/527_spdx-sbom - #542

refactoring/527_spdx-sbom#542
redcatbear merged 11 commits into
mainfrom
refactoring/527_spdx-sbom

redcatbear commented Jun 13, 2026 •

edited

Loading

Uh oh!

kaklakariada Jun 14, 2026

Uh oh!

Uh oh!

kaklakariada Jun 14, 2026

Uh oh!

Uh oh!

Uh oh!

kaklakariada Jun 14, 2026

Uh oh!

kaklakariada Jun 14, 2026

Uh oh!

sonarqubecloud Bot commented Jun 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Aug 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		## Software Bill of Materials (SBOM)

		To enhance transparency and security, SPDX SBOMs (Software Bill of Materials) are included with the GitHub releases starting from version 4.6.0. These files provide a comprehensive list of all components and dependencies used in the project.

Uh oh!

Conversation

redcatbear commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Improvements

Uh oh!

kaklakariada Jun 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kaklakariada Jun 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kaklakariada Jun 14, 2026

Choose a reason for hiding this comment

Uh oh!

kaklakariada Jun 14, 2026

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Jun 14, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Aug 22, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

redcatbear commented Jun 13, 2026 •

edited

Loading