From 93842b7b3ebb09497a90c9c6cbee1e2ba7e17e0d Mon Sep 17 00:00:00 2001 From: redcatbaer Date: Fri, 29 May 2026 20:16:25 +0200 Subject: [PATCH 1/8] #527: SPDX SBOM first part. --- doc/developer_guide.md | 10 ++++++++++ parent/pom.xml | 27 +++++++++++++++++++++++++-- 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/doc/developer_guide.md b/doc/developer_guide.md index ea69b416e..baf19ce2f 100644 --- a/doc/developer_guide.md +++ b/doc/developer_guide.md @@ -237,6 +237,16 @@ This project is configured to produce exactly the same artifacts each time when The build will use the last Git commit timestamp as timestamp for files in `.jar` archives. +## SBOM + +The Project generates and [SPDX](https://spdx.dev/) SBOM using the [SPDX Maven Plugin](https://github.com/spdx/spdx-maven-plugin). + +You can create the SBOM with the following command in the `product` module: + +```sh +mvn spdx:createSPDX +``` + ## Creating a Release **NOTE**: This currently only works for release version numbers, not SNAPSHOT versions. diff --git a/parent/pom.xml b/parent/pom.xml index 166ea445b..4e47f828e 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -24,7 +24,7 @@ - GNU General Public License v3.0 + GPL-3.0-only https://www.gnu.org/licenses/gpl-3.0.html repo @@ -528,7 +528,7 @@ 2.21.0 - + org.apache.maven.plugins maven-deploy-plugin 3.1.4 @@ -536,6 +536,29 @@ true + + org.spdx + spdx-maven-plugin + 1.0.3 + + + build-spdx + + createSPDX + + + + + build + false + GPL-3.0-only + GPL-3.0-only + Copyright (c) itsallcode.org + GPL-3.0-only + GPL-3.0-only + Copyright (c) itsallcode.org + + From 8833bc9e110be32506d5b3f65cf25c7ea38d1b8d Mon Sep 17 00:00:00 2001 From: redcatbaer Date: Sat, 13 Jun 2026 09:59:09 +0200 Subject: [PATCH 2/8] #527: Added descriptions to all packages in the individual POM files. --- api/pom.xml | 1 + core/pom.xml | 1 + doc/changes/changes_4.6.0.md | 11 ++++++++-- exporter/common/pom.xml | 1 + exporter/specobject/pom.xml | 1 + importer/lightweightmarkup/pom.xml | 1 + importer/markdown/pom.xml | 1 + importer/restructuredtext/pom.xml | 1 + importer/specobject/pom.xml | 1 + importer/tag/pom.xml | 1 + importer/xmlparser/pom.xml | 1 + importer/zip/pom.xml | 1 + openfasttrace-mc-deployable-parent/pom.xml | 2 +- parent/pom.xml | 20 +++++++++-------- pom.xml | 24 +++++++++++++++++++++ product/pom.xml | 25 ++++++++++++++++++++++ reporter/aspec/pom.xml | 1 + reporter/html/pom.xml | 1 + reporter/plaintext/pom.xml | 1 + testutil/pom.xml | 1 + 20 files changed, 85 insertions(+), 12 deletions(-) diff --git a/api/pom.xml b/api/pom.xml index e0ee86158..9d7d0c135 100644 --- a/api/pom.xml +++ b/api/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-api OpenFastTrace API + Public API of OpenFastTrace ../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/core/pom.xml b/core/pom.xml index 4f8b3a5ba..265d929f1 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-core OpenFastTrace Core + OpenFastTrace core logic (specification items, linking and base modules for importers, exporters and reporters) ../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/doc/changes/changes_4.6.0.md b/doc/changes/changes_4.6.0.md index 4368a932a..aec07c805 100644 --- a/doc/changes/changes_4.6.0.md +++ b/doc/changes/changes_4.6.0.md @@ -4,8 +4,15 @@ Code name: ?? ## Summary -We moved some GitHub action permissions from workflow-level to job-level. +We moved some GitHub action permissions from workflow-level to job-level and fixed a number of Sonar findings that we accumulated with Sonar introducing new rules. + +And, we now create an SPDX SBOM. ## Security -* # \ No newline at end of file +* # + +## Refactoring + +* #527: Introduced SPDX SBOM +* #536: Fixed a large number of Sonar findings that came with new sonar rules. \ No newline at end of file diff --git a/exporter/common/pom.xml b/exporter/common/pom.xml index 52b9e58ab..5ad9570be 100644 --- a/exporter/common/pom.xml +++ b/exporter/common/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-exporter-common OpenFastTrace Exporters Utils + Common logic for OpenFastTrace exporters ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/exporter/specobject/pom.xml b/exporter/specobject/pom.xml index 39b207620..55ae0d012 100644 --- a/exporter/specobject/pom.xml +++ b/exporter/specobject/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-exporter-specobject OpenFastTrace Specobject Exporter + Specobject (ReqM2 exchange format) exporter ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/importer/lightweightmarkup/pom.xml b/importer/lightweightmarkup/pom.xml index 37fe269b7..d8357d2a1 100644 --- a/importer/lightweightmarkup/pom.xml +++ b/importer/lightweightmarkup/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-importer-lightweightmarkup OpenFastTrace Lightweight Markup Importer Base + Base module for OpenFastTrace importers based on lightweight markup languages (e.g., Markdown and RST) ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/importer/markdown/pom.xml b/importer/markdown/pom.xml index 42c96065c..3fb410fdf 100644 --- a/importer/markdown/pom.xml +++ b/importer/markdown/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-importer-markdown OpenFastTrace Markdown Importer + Importer for OpenFastTrace specification items embedded into Markdown text ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/importer/restructuredtext/pom.xml b/importer/restructuredtext/pom.xml index 4f66ed9de..db3c182d1 100644 --- a/importer/restructuredtext/pom.xml +++ b/importer/restructuredtext/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-importer-restructuredtext OpenFastTrace reStructuredText Importer + Importer for OpenFastTrace specification items embedded into reStructuredText (RST) ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/importer/specobject/pom.xml b/importer/specobject/pom.xml index 91dbab265..fe079d7a9 100644 --- a/importer/specobject/pom.xml +++ b/importer/specobject/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-importer-specobject OpenFastTrace Specobject Importer + Importer for OpenFastTrace specification items from Specobject (ReqM2 format) ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/importer/tag/pom.xml b/importer/tag/pom.xml index 165ed1187..3649d98da 100644 --- a/importer/tag/pom.xml +++ b/importer/tag/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-importer-tag OpenFastTrace Tag Importer + Importer for OpenFastTrace specification items embedded source code marker tags ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/importer/xmlparser/pom.xml b/importer/xmlparser/pom.xml index b87231910..9a2ac7860 100644 --- a/importer/xmlparser/pom.xml +++ b/importer/xmlparser/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-importer-xmlparser OpenFastTrace Common XML Parser + Importer for OpenFastTrace specification items embedded into XML ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/importer/zip/pom.xml b/importer/zip/pom.xml index c82ff9295..95055477d 100644 --- a/importer/zip/pom.xml +++ b/importer/zip/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-importer-zip OpenFastTrace Zip Importer + Recursive importer for OpenFastTrace specification items in ZIP archives ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/openfasttrace-mc-deployable-parent/pom.xml b/openfasttrace-mc-deployable-parent/pom.xml index 4de7d681f..0d12e0dfe 100644 --- a/openfasttrace-mc-deployable-parent/pom.xml +++ b/openfasttrace-mc-deployable-parent/pom.xml @@ -16,6 +16,7 @@ It is maintained separately from the main parent POM for the following reasons: openfasttrace-mc-deployable-parent ${revision} OpenFastTrace Parent for modules deployed to Maven Central + Maven-central-specific deployment module for OpenFastTrace pom ../parent/pom.xml @@ -23,7 +24,6 @@ It is maintained separately from the main parent POM for the following reasons: openfasttrace-parent ${revision} - Free requirement tracking suite https://github.com/itsallcode/openfasttrace false diff --git a/parent/pom.xml b/parent/pom.xml index 38c99d47d..f83811cf5 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -7,10 +7,9 @@ ${revision} OpenFastTrace Parent pom - Free requirement tracking suite https://github.com/itsallcode/openfasttrace - 4.5.0 + 4.6.0 17 6.1.0-M1 6.1.0 @@ -21,11 +20,13 @@ ${reproducible.build.timestamp} -Duser.language=en false + GPL-3.0-only + Copyright (c) itsallcode.org GPL-3.0-only - https://www.gnu.org/licenses/gpl-3.0.html + https://spdx.org/licenses/GPL-3.0-only.html repo @@ -551,12 +552,13 @@ build false - GPL-3.0-only - GPL-3.0-only - Copyright (c) itsallcode.org - GPL-3.0-only - GPL-3.0-only - Copyright (c) itsallcode.org + ${spdx.license} + ${spdx.license} + ${spdx.copyright} + false + ${spdx.license} + ${spdx.license} + ${spdx.copyright} diff --git a/pom.xml b/pom.xml index 813a87ffb..b5c0e563d 100644 --- a/pom.xml +++ b/pom.xml @@ -47,6 +47,30 @@ true + + org.spdx + spdx-maven-plugin + 1.0.3 + + + aggregate-spdx + + aggregateSPDX + + + + + build + false + GPL-3.0-only + GPL-3.0-only + Copyright (c) itsallcode.org + false + GPL-3.0-only + GPL-3.0-only + Copyright (c) itsallcode.org + + diff --git a/product/pom.xml b/product/pom.xml index 58214bd1f..b40e78c1e 100644 --- a/product/pom.xml +++ b/product/pom.xml @@ -3,6 +3,7 @@ 4.0.0 openfasttrace OpenFastTrace Product + OpenFastTrace aggregated library (includes all official base modules) ../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace @@ -133,6 +134,30 @@ + + org.spdx + spdx-maven-plugin + 1.0.3 + + + aggregate-spdx + + aggregateSPDX + + + + + build + false + ${spdx.license} + ${spdx.license} + ${spdx.copyright} + false + ${spdx.license} + ${spdx.license} + ${spdx.copyright} + + diff --git a/reporter/aspec/pom.xml b/reporter/aspec/pom.xml index f47a75f32..809640648 100644 --- a/reporter/aspec/pom.xml +++ b/reporter/aspec/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-reporter-aspec OpenFastTrace augmented specobject Reporter + Report an OpenFastTrace requirement trace as Augmented Specobject (ReqM2 format) ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/reporter/html/pom.xml b/reporter/html/pom.xml index 288f2a61c..dc4a7711d 100644 --- a/reporter/html/pom.xml +++ b/reporter/html/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-reporter-html OpenFastTrace HTML Reporter + Generate HTML report from an OpenFastTrace requirement trace ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/reporter/plaintext/pom.xml b/reporter/plaintext/pom.xml index a0719c1dc..fefd12840 100644 --- a/reporter/plaintext/pom.xml +++ b/reporter/plaintext/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-reporter-plaintext OpenFastTrace Plaintext Reporter + Generate plain text report from an OpenFastTrace requirement trace ../../openfasttrace-mc-deployable-parent/pom.xml org.itsallcode.openfasttrace diff --git a/testutil/pom.xml b/testutil/pom.xml index 9f5f12f3a..9d1a0536d 100644 --- a/testutil/pom.xml +++ b/testutil/pom.xml @@ -4,6 +4,7 @@ 4.0.0 openfasttrace-testutil OpenFastTrace Test utilities + Shared test utilities used in multiple OpenFastTrace modules jar ../parent/pom.xml From 878c8eae95976c6cde64a64835e31ecb97918f71 Mon Sep 17 00:00:00 2001 From: redcatbaer Date: Sat, 13 Jun 2026 11:22:33 +0200 Subject: [PATCH 3/8] #527: Got a minimal SPDX SBOM that looks correct. --- .github/workflows/build.yml | 15 +++++++ doc/developer_guide.md | 13 ++++-- parent/pom.xml | 6 +++ product/pom.xml | 89 +++++++++++++++++++++++++++++++++++++ 4 files changed, 120 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 47e21b384..91b29b562 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -88,6 +88,21 @@ jobs: !product/target/openfasttrace-*-sources.jar if-no-files-found: error + - name: Generate SPDX SBOM + if: ${{ env.DEFAULT_OS == matrix.os && env.DEFAULT_JAVA == matrix.java }} + run: | + mvn --batch-mode -pl product spdx:createSPDX \ + -Dossindex.skip=true \ + -Djava.version=${{ matrix.java }} + + - name: Upload SPDX SBOM + uses: actions/upload-artifact@v7 + if: ${{ env.DEFAULT_OS == matrix.os && env.DEFAULT_JAVA == matrix.java }} + with: + name: openfasttrace-spdx + path: product/target/site/*.spdx.json + if-no-files-found: error + - name: Run self-trace run: ./oft-self-trace.sh diff --git a/doc/developer_guide.md b/doc/developer_guide.md index baf19ce2f..69dff4f42 100644 --- a/doc/developer_guide.md +++ b/doc/developer_guide.md @@ -241,12 +241,19 @@ The build will use the last Git commit timestamp as timestamp for files in `.jar The Project generates and [SPDX](https://spdx.dev/) SBOM using the [SPDX Maven Plugin](https://github.com/spdx/spdx-maven-plugin). -You can create the SBOM with the following command in the `product` module: +The build order is very important when creating the SBOM. Since the plugin tries to extract the metadata of the submodules from POM files of installed Maven packages, those POM files need to be in the local Maven cache first. We don't want to download them during the build, since the latest ones are on the local machine. That means, we build the modules, install them in the local Maven cache and then create the SBOM. -```sh -mvn spdx:createSPDX + +You can create the SBOM with the following sequence of Maven commands module: + +```shell +mvn install +mvn -pl product spdx:createSPDX ``` +> [!IMPORTANT] +> OFT does not include 3rd-party packages in the production JAR. The JRE we depend on is a runtime dependency on the machine OFT is executed. Therefore our SBOM only contains the OFT modules. We also did not include the test packages because they are not relevant for OFT users. + ## Creating a Release **NOTE**: This currently only works for release version numbers, not SNAPSHOT versions. diff --git a/parent/pom.xml b/parent/pom.xml index f83811cf5..d49ba192a 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -547,6 +547,9 @@ createSPDX + + none + @@ -559,6 +562,9 @@ ${spdx.license} ${spdx.license} ${spdx.copyright} + true + false + false diff --git a/product/pom.xml b/product/pom.xml index b40e78c1e..e044916ae 100644 --- a/product/pom.xml +++ b/product/pom.xml @@ -156,6 +156,95 @@ ${spdx.license} ${spdx.license} ${spdx.copyright} + + + + both + org.itsallcode.openfasttrace + openfasttrace-api + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-core + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-exporter-common + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-exporter-specobject + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-importer-lightweightmarkup + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-importer-markdown + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-importer-restructuredtext + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-importer-specobject + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-importer-tag + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-importer-xmlparser + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-importer-zip + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-reporter-aspec + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-reporter-html + GPL-3.0-only + + + both + org.itsallcode.openfasttrace + openfasttrace-reporter-plaintext + GPL-3.0-only + + From 82a8391d32ecfaff49baf64bec908c3614c681db Mon Sep 17 00:00:00 2001 From: redcatbaer Date: Sun, 14 Jun 2026 09:28:33 +0200 Subject: [PATCH 4/8] #527: Added security policy. --- SECURITY.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..efffbf0cb --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,13 @@ +# Security Policy + +## Reporting a Vulnerability + +We are very grateful for any security reports and see them as a valuable way to improve the quality and reliability of our codebase. As a non-profit open-source project, we appreciate the time and effort the community puts into helping us keep OpenFastTrace secure. + +Please note that we do not offer bug bounties. + +To report a vulnerability, please use the [GitHub Security Advisory reporting feature](https://github.com/itsallcode/openfasttrace/security/advisories/new) or contact the maintainers directly. We strive to address all security concerns in a timely and professional manner. + +## Software Bill of Materials (SBOM) + +To enhance transparency and security, SPDX SBOMs (Software Bill of Materials) are included with the GitHub releases starting from version 4.6.0. These files provide a comprehensive list of all components and dependencies used in the project. From ccecf16226c8b04932c200bef0912fc37a3d318d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20B=C3=A4r?= Date: Sun, 14 Jun 2026 16:44:08 +0200 Subject: [PATCH 5/8] Apply suggestions from code review Co-authored-by: Christoph Pirkl <4711730+kaklakariada@users.noreply.github.com> --- doc/changes/changes_4.6.0.md | 2 +- doc/developer_guide.md | 2 +- parent/pom.xml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/changes/changes_4.6.0.md b/doc/changes/changes_4.6.0.md index aec07c805..e573dd6ab 100644 --- a/doc/changes/changes_4.6.0.md +++ b/doc/changes/changes_4.6.0.md @@ -6,7 +6,7 @@ Code name: ?? We moved some GitHub action permissions from workflow-level to job-level and fixed a number of Sonar findings that we accumulated with Sonar introducing new rules. -And, we now create an SPDX SBOM. +And, we now create an SPDX SBOM. You can find the SBOM of the product JAR attached to all new GitHub releases. ## Security diff --git a/doc/developer_guide.md b/doc/developer_guide.md index 69dff4f42..a7e6f734b 100644 --- a/doc/developer_guide.md +++ b/doc/developer_guide.md @@ -241,7 +241,7 @@ The build will use the last Git commit timestamp as timestamp for files in `.jar The Project generates and [SPDX](https://spdx.dev/) SBOM using the [SPDX Maven Plugin](https://github.com/spdx/spdx-maven-plugin). -The build order is very important when creating the SBOM. Since the plugin tries to extract the metadata of the submodules from POM files of installed Maven packages, those POM files need to be in the local Maven cache first. We don't want to download them during the build, since the latest ones are on the local machine. That means, we build the modules, install them in the local Maven cache and then create the SBOM. +The build order is very important when creating the SBOM. Since the plugin tries to extract the metadata of the submodules from POM files of installed Maven packages, those POM files need to be in the local Maven repository first. We don't want to download them during the build, since the latest ones are on the local machine. That means, we build the modules, install them in the local Maven cache and then create the SBOM. You can create the SBOM with the following sequence of Maven commands module: diff --git a/parent/pom.xml b/parent/pom.xml index d49ba192a..e66514f15 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -564,7 +564,7 @@ ${spdx.copyright} true false - false + true From fd9a5e3d33940c46d96a93aaf6a1091264b73fc2 Mon Sep 17 00:00:00 2001 From: redcatbaer Date: Sat, 22 Aug 2026 10:30:57 +0200 Subject: [PATCH 6/8] #527: Fixed SBOM findings. --- .github/workflows/build.yml | 13 ++--- .github/workflows/github_release.sh | 32 +++++++----- SECURITY.md | 2 +- doc/changes/changes_4.10.0.md | 17 +++++++ doc/changes/changes_4.6.0.md | 4 +- doc/developer_guide.md | 8 ++- parent/pom.xml | 7 ++- product/pom.xml | 9 +--- .../itsallcode/openfasttrace/SpdxSbomIT.java | 51 +++++++++++++++++++ 9 files changed, 100 insertions(+), 43 deletions(-) create mode 100644 doc/changes/changes_4.10.0.md create mode 100644 product/src/test/java/org/itsallcode/openfasttrace/SpdxSbomIT.java diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 91b29b562..769b35812 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -35,7 +35,7 @@ jobs: DEFAULT_OS: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -88,19 +88,12 @@ jobs: !product/target/openfasttrace-*-sources.jar if-no-files-found: error - - name: Generate SPDX SBOM - if: ${{ env.DEFAULT_OS == matrix.os && env.DEFAULT_JAVA == matrix.java }} - run: | - mvn --batch-mode -pl product spdx:createSPDX \ - -Dossindex.skip=true \ - -Djava.version=${{ matrix.java }} - - name: Upload SPDX SBOM uses: actions/upload-artifact@v7 if: ${{ env.DEFAULT_OS == matrix.os && env.DEFAULT_JAVA == matrix.java }} with: name: openfasttrace-spdx - path: product/target/site/*.spdx.json + path: product/target/site/*.spdx3.json if-no-files-found: error - name: Run self-trace @@ -123,7 +116,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false - uses: actions/setup-java@v5 diff --git a/.github/workflows/github_release.sh b/.github/workflows/github_release.sh index 36b812042..d11b994c3 100755 --- a/.github/workflows/github_release.sh +++ b/.github/workflows/github_release.sh @@ -13,18 +13,21 @@ project_version=$(grep "" "$pom_file" | sed --regexp-extended 's/\s* "$checksum_file_name" -readonly checksum_file_path="$file_dir/$checksum_file_name" -cd "$base_dir" +readonly sbom_path="$base_dir/product/target/site/org.itsallcode.openfasttrace_openfasttrace-${project_version}.spdx3.json" + +calculate_checksum() { + local file_path="$1" + local checksum_file_path="${file_path}.sha256" + readonly file_path checksum_file_path + echo "Calculate sha256sum for file '$file_path'" + (cd "$(dirname "$file_path")" && sha256sum "$(basename "$file_path")") > "$checksum_file_path" +} + +calculate_checksum "$artifact_path" +readonly artifact_checksum_path="${artifact_path}.sha256" +calculate_checksum "$sbom_path" +readonly sbom_checksum_path="${sbom_path}.sha256" # Create GitHub release @@ -39,8 +42,11 @@ echo "Git tag : $tag" echo "Title : $title" echo "Changes file : $changes_file" echo "Artifact file: $artifact_path" -echo "Checksum file: $checksum_file_path" +echo "Checksum file: $artifact_checksum_path" +echo "SBOM file : $sbom_path" +echo "Checksum file: $sbom_checksum_path" -release_url=$(gh release create --latest --title "$title" --notes "$notes" --target main "$tag" "$artifact_path" "$checksum_file_path") +release_url=$(gh release create --latest --title "$title" --notes "$notes" --target main "$tag" \ + "$artifact_path" "$artifact_checksum_path" "$sbom_path" "$sbom_checksum_path") readonly release_url echo "Release URL: $release_url" diff --git a/SECURITY.md b/SECURITY.md index efffbf0cb..e857daf05 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -10,4 +10,4 @@ To report a vulnerability, please use the [GitHub Security Advisory reporting fe ## Software Bill of Materials (SBOM) -To enhance transparency and security, SPDX SBOMs (Software Bill of Materials) are included with the GitHub releases starting from version 4.6.0. These files provide a comprehensive list of all components and dependencies used in the project. +Starting with version 4.10.0, each GitHub release includes an SPDX Software Bill of Materials (SBOM) for the OpenFastTrace product JAR and a SHA-256 checksum for the SBOM. diff --git a/doc/changes/changes_4.10.0.md b/doc/changes/changes_4.10.0.md new file mode 100644 index 000000000..527263391 --- /dev/null +++ b/doc/changes/changes_4.10.0.md @@ -0,0 +1,17 @@ +# OpenFastTrace 4.10.0, released 2026-08-?? + +Code name: Lifecycle Information and SPDX3 SBOM + +## Summary + +The project lifecycle documentation now describes planned deprecations and removals in OFT 5.0.0, including migration guidance for the SpecObject format and short coverage tags. + +We also publish the SPDX3 SBOM with the release now. + +## Feature + +* #542: CI and release now contain SPDX version 3 SBOM. + +## Documentation + +* #579: Documented planned deprecations and removals. diff --git a/doc/changes/changes_4.6.0.md b/doc/changes/changes_4.6.0.md index e573dd6ab..6f8926090 100644 --- a/doc/changes/changes_4.6.0.md +++ b/doc/changes/changes_4.6.0.md @@ -6,7 +6,7 @@ Code name: ?? We moved some GitHub action permissions from workflow-level to job-level and fixed a number of Sonar findings that we accumulated with Sonar introducing new rules. -And, we now create an SPDX SBOM. You can find the SBOM of the product JAR attached to all new GitHub releases. +We now attach an SPDX SBOM for the product JAR and its SHA-256 checksum to each GitHub release. ## Security @@ -15,4 +15,4 @@ And, we now create an SPDX SBOM. You can find the SBOM of the product JAR attach ## Refactoring * #527: Introduced SPDX SBOM -* #536: Fixed a large number of Sonar findings that came with new sonar rules. \ No newline at end of file +* #536: Fixed a large number of Sonar findings that came with new sonar rules. diff --git a/doc/developer_guide.md b/doc/developer_guide.md index a7e6f734b..9a77298c8 100644 --- a/doc/developer_guide.md +++ b/doc/developer_guide.md @@ -239,16 +239,14 @@ The build will use the last Git commit timestamp as timestamp for files in `.jar ## SBOM -The Project generates and [SPDX](https://spdx.dev/) SBOM using the [SPDX Maven Plugin](https://github.com/spdx/spdx-maven-plugin). +The project generates an [SPDX](https://spdx.dev/) SBOM using the [SPDX Maven Plugin](https://github.com/spdx/spdx-maven-plugin). -The build order is very important when creating the SBOM. Since the plugin tries to extract the metadata of the submodules from POM files of installed Maven packages, those POM files need to be in the local Maven repository first. We don't want to download them during the build, since the latest ones are on the local machine. That means, we build the modules, install them in the local Maven cache and then create the SBOM. +The SPDX plugin runs during Maven's `verify` phase. It creates the module SBOMs before aggregating them into the product SBOM. - -You can create the SBOM with the following sequence of Maven commands module: +Build and install OFT and create the SBOM with a single command: ```shell mvn install -mvn -pl product spdx:createSPDX ``` > [!IMPORTANT] diff --git a/parent/pom.xml b/parent/pom.xml index e66514f15..07ebd919e 100644 --- a/parent/pom.xml +++ b/parent/pom.xml @@ -547,14 +547,13 @@ createSPDX - - none - + package + ${project.reporting.outputDirectory}/${project.groupId}_${project.artifactId}-${project.version}.spdx3.json build - false + JSON-LD ${spdx.license} ${spdx.license} ${spdx.copyright} diff --git a/product/pom.xml b/product/pom.xml index e044916ae..1d6ad4522 100644 --- a/product/pom.xml +++ b/product/pom.xml @@ -138,16 +138,9 @@ org.spdx spdx-maven-plugin 1.0.3 - - - aggregate-spdx - - aggregateSPDX - - - build + JSON-LD false ${spdx.license} ${spdx.license} diff --git a/product/src/test/java/org/itsallcode/openfasttrace/SpdxSbomIT.java b/product/src/test/java/org/itsallcode/openfasttrace/SpdxSbomIT.java new file mode 100644 index 000000000..734cc913b --- /dev/null +++ b/product/src/test/java/org/itsallcode/openfasttrace/SpdxSbomIT.java @@ -0,0 +1,51 @@ +package org.itsallcode.openfasttrace; + +import static org.hamcrest.MatcherAssert.assertThat; +import static org.hamcrest.Matchers.containsString; +import static org.hamcrest.Matchers.hasSize; +import static org.hamcrest.Matchers.matchesPattern; +import static org.hamcrest.Matchers.not; +import static org.junit.jupiter.api.Assertions.assertAll; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.List; +import java.util.stream.Stream; + +import org.junit.jupiter.api.Test; + +class SpdxSbomIT +{ + private static final Path SPDX_OUTPUT_DIRECTORY = Path.of("target", "site"); + private static final String SPDX_3_CONTEXT_PATTERN = + "(?s).*\"@context\"\\s*:\\s*\"https://spdx.org/rdf/3\\.[^\"]+/spdx-context.jsonld\".*"; + + @Test + void generatedSbomDescribesOpenFastTraceProduct() throws IOException + { + final List generatedSboms = findGeneratedSboms(); + assertThat("generated product SBOMs", generatedSboms, hasSize(1)); + + final String sbom = Files.readString(generatedSboms.get(0)); + + assertAll( + () -> assertThat("SPDX 3 JSON-LD context", sbom, + matchesPattern(SPDX_3_CONTEXT_PATTERN)), + () -> assertThat("SPDX document", sbom, containsString("\"type\" : \"SpdxDocument\"")), + () -> assertThat("software SBOM", sbom, containsString("\"type\" : \"software_Sbom\"")), + () -> assertThat("product identity", sbom, containsString("\"name\" : \"OpenFastTrace Product\"")), + () -> assertThat("API module", sbom, containsString("\"name\" : \"OpenFastTrace API\"")), + () -> assertThat("core module", sbom, containsString("\"name\" : \"OpenFastTrace Core\"")), + () -> assertThat("JUnit test dependency", sbom, not(containsString("JUnit"))), + () -> assertThat("Maven build plugin", sbom, not(containsString("maven-compiler-plugin")))); + } + + private List findGeneratedSboms() throws IOException + { + try (Stream files = Files.list(SPDX_OUTPUT_DIRECTORY)) + { + return files.filter(file -> file.getFileName().toString().endsWith(".spdx3.json")).toList(); + } + } +} From 4329ebe56c85b9a9b03594f12b4daffaa56dc66c Mon Sep 17 00:00:00 2001 From: redcatbaer Date: Sat, 22 Aug 2026 10:34:51 +0200 Subject: [PATCH 7/8] #527: Improved phrasing. --- .github/workflows/github_release.sh | 6 +++--- doc/changes/changes_4.10.0.md | 4 ++-- doc/developer_guide.md | 8 ++++---- .../java/org/itsallcode/openfasttrace/SpdxSbomIT.java | 5 +++-- 4 files changed, 12 insertions(+), 11 deletions(-) diff --git a/.github/workflows/github_release.sh b/.github/workflows/github_release.sh index d11b994c3..3a700c07e 100755 --- a/.github/workflows/github_release.sh +++ b/.github/workflows/github_release.sh @@ -20,7 +20,7 @@ calculate_checksum() { local file_path="$1" local checksum_file_path="${file_path}.sha256" readonly file_path checksum_file_path - echo "Calculate sha256sum for file '$file_path'" + echo "Calculating SHA-256 checksum for '$file_path'" (cd "$(dirname "$file_path")" && sha256sum "$(basename "$file_path")") > "$checksum_file_path" } @@ -42,9 +42,9 @@ echo "Git tag : $tag" echo "Title : $title" echo "Changes file : $changes_file" echo "Artifact file: $artifact_path" -echo "Checksum file: $artifact_checksum_path" +echo "Artifact checksum: $artifact_checksum_path" echo "SBOM file : $sbom_path" -echo "Checksum file: $sbom_checksum_path" +echo "SBOM checksum: $sbom_checksum_path" release_url=$(gh release create --latest --title "$title" --notes "$notes" --target main "$tag" \ "$artifact_path" "$artifact_checksum_path" "$sbom_path" "$sbom_checksum_path") diff --git a/doc/changes/changes_4.10.0.md b/doc/changes/changes_4.10.0.md index 527263391..5124479fe 100644 --- a/doc/changes/changes_4.10.0.md +++ b/doc/changes/changes_4.10.0.md @@ -6,11 +6,11 @@ Code name: Lifecycle Information and SPDX3 SBOM The project lifecycle documentation now describes planned deprecations and removals in OFT 5.0.0, including migration guidance for the SpecObject format and short coverage tags. -We also publish the SPDX3 SBOM with the release now. +Each release now includes an SPDX 3 SBOM for the product JAR and a SHA-256 checksum for the SBOM. ## Feature -* #542: CI and release now contain SPDX version 3 SBOM. +* #542: CI and releases now provide an SPDX 3 SBOM. ## Documentation diff --git a/doc/developer_guide.md b/doc/developer_guide.md index 9a77298c8..714d64f19 100644 --- a/doc/developer_guide.md +++ b/doc/developer_guide.md @@ -241,16 +241,16 @@ The build will use the last Git commit timestamp as timestamp for files in `.jar The project generates an [SPDX](https://spdx.dev/) SBOM using the [SPDX Maven Plugin](https://github.com/spdx/spdx-maven-plugin). -The SPDX plugin runs during Maven's `verify` phase. It creates the module SBOMs before aggregating them into the product SBOM. +The SPDX plugin runs during Maven's `package` phase and creates an SBOM for each Maven module. The product SBOM describes the product and its production dependencies. -Build and install OFT and create the SBOM with a single command: +Build OFT and create the SBOMs with a single command: ```shell -mvn install +mvn package ``` > [!IMPORTANT] -> OFT does not include 3rd-party packages in the production JAR. The JRE we depend on is a runtime dependency on the machine OFT is executed. Therefore our SBOM only contains the OFT modules. We also did not include the test packages because they are not relevant for OFT users. +> OFT does not include third-party packages in the production JAR. The JRE is provided by the machine on which OFT runs. Therefore, the product SBOM contains only OFT modules. Test dependencies are excluded because they are not relevant to OFT users. ## Creating a Release diff --git a/product/src/test/java/org/itsallcode/openfasttrace/SpdxSbomIT.java b/product/src/test/java/org/itsallcode/openfasttrace/SpdxSbomIT.java index 734cc913b..1012a21d7 100644 --- a/product/src/test/java/org/itsallcode/openfasttrace/SpdxSbomIT.java +++ b/product/src/test/java/org/itsallcode/openfasttrace/SpdxSbomIT.java @@ -37,8 +37,9 @@ void generatedSbomDescribesOpenFastTraceProduct() throws IOException () -> assertThat("product identity", sbom, containsString("\"name\" : \"OpenFastTrace Product\"")), () -> assertThat("API module", sbom, containsString("\"name\" : \"OpenFastTrace API\"")), () -> assertThat("core module", sbom, containsString("\"name\" : \"OpenFastTrace Core\"")), - () -> assertThat("JUnit test dependency", sbom, not(containsString("JUnit"))), - () -> assertThat("Maven build plugin", sbom, not(containsString("maven-compiler-plugin")))); + () -> assertThat("absence of JUnit test dependencies", sbom, not(containsString("JUnit"))), + () -> assertThat("absence of Maven build plugins", sbom, + not(containsString("maven-compiler-plugin")))); } private List findGeneratedSboms() throws IOException From c6939ba3361739786d2aa6e641a6babb0dcc211d Mon Sep 17 00:00:00 2001 From: redcatbaer Date: Sat, 22 Aug 2026 11:03:20 +0200 Subject: [PATCH 8/8] #527: Fixed version number expectation. --- .../core/serviceloader/ServiceLoaderFactoryIT.java | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/product/src/test/java/org/itsallcode/openfasttrace/core/serviceloader/ServiceLoaderFactoryIT.java b/product/src/test/java/org/itsallcode/openfasttrace/core/serviceloader/ServiceLoaderFactoryIT.java index 8de5e2bca..5fcad73f3 100644 --- a/product/src/test/java/org/itsallcode/openfasttrace/core/serviceloader/ServiceLoaderFactoryIT.java +++ b/product/src/test/java/org/itsallcode/openfasttrace/core/serviceloader/ServiceLoaderFactoryIT.java @@ -10,6 +10,7 @@ import java.util.List; import java.util.Optional; import java.util.regex.Pattern; +import java.util.stream.Stream; import org.itsallcode.openfasttrace.api.report.ReporterFactory; import org.junit.jupiter.api.Test; @@ -31,7 +32,7 @@ class ServiceLoaderFactoryIT void loadServiceFromWrongJar() throws IOException { preparePlugin(Path.of("../reporter/plaintext/target"), - Pattern.compile("openfasttrace-reporter-plaintext-\\d\\.\\d\\.\\d\\-javadoc.jar")); + Pattern.compile("openfasttrace-reporter-plaintext-\\d+\\.\\d+\\.\\d+-javadoc.jar")); try (Loader loader = createLoader()) { final List service = loader.load().toList(); @@ -48,7 +49,7 @@ private Loader createLoader() void loadServiceFromJar() throws IOException { preparePlugin(Path.of("../reporter/plaintext/target"), - Pattern.compile("openfasttrace-reporter-plaintext-\\d\\.\\d\\.\\d\\.jar")); + Pattern.compile("openfasttrace-reporter-plaintext-\\d+\\.\\d+\\.\\d+\\.jar")); try (Loader loader = createLoader()) { final List services = loader.load().toList(); @@ -76,8 +77,10 @@ private void preparePlugin(final Path targetDir, final Pattern filePattern) thro private Optional findMatchingFile(final Path dir, final Pattern filePattern) throws IOException { - return Files.list(dir).filter(file -> filePattern.matcher(file.getFileName().toString()).matches()) - .findFirst(); + try(final Stream files = Files.list(dir)) { + return files.filter(file -> filePattern.matcher(file.getFileName().toString()).matches()) + .findFirst(); + } } private void preparePlugin(final Path pluginJar) throws IOException