refactoring/527_spdx-sbom

.github/workflows/build.yml

@@ -91,6 +91,14 @@ jobs:
             !product/target/openfasttrace-*-sources.jar
           if-no-files-found: error
 
+      - name: Upload SPDX SBOM
+        uses: actions/upload-artifact@v7
+        if: ${{ env.DEFAULT_OS == matrix.os && env.DEFAULT_JAVA == matrix.java }}
+        with:
+          name: openfasttrace-spdx
+          path: product/target/site/*.spdx3.json
+          if-no-files-found: error
+
       - name: Run self-trace
         run: ./oft-self-trace.sh
 

.github/workflows/github_release.sh

@@ -13,18 +13,21 @@ project_version=$(grep "<revision>" "$pom_file" | sed --regexp-extended 's/\s*<r
 readonly project_version
 echo "Read project version '$project_version' from $pom_file"
 
-# Calculate checksum
 readonly artifact_path="$base_dir/product/target/openfasttrace-${project_version}.jar"
-echo "Calculate sha256sum for file '$artifact_path'"
-file_dir="$(dirname "$artifact_path")"
-readonly file_dir
-file_name=$(basename "$artifact_path")
-readonly file_name
-cd "$file_dir"
-readonly checksum_file_name="${file_name}.sha256"
-sha256sum "$file_name" > "$checksum_file_name"
-readonly checksum_file_path="$file_dir/$checksum_file_name"
-cd "$base_dir"
+readonly sbom_path="$base_dir/product/target/site/org.itsallcode.openfasttrace_openfasttrace-${project_version}.spdx3.json"
+
+calculate_checksum() {
+    local file_path="$1"
+    local checksum_file_path="${file_path}.sha256"
+    readonly file_path checksum_file_path
+    echo "Calculating SHA-256 checksum for '$file_path'"
+    (cd "$(dirname "$file_path")" && sha256sum "$(basename "$file_path")") > "$checksum_file_path"
+}
+
+calculate_checksum "$artifact_path"
+readonly artifact_checksum_path="${artifact_path}.sha256"
+calculate_checksum "$sbom_path"
+readonly sbom_checksum_path="${sbom_path}.sha256"
 
 
 # Create GitHub release
@@ -39,8 +42,11 @@ echo "Git tag      : $tag"
 echo "Title        : $title"
 echo "Changes file : $changes_file"
 echo "Artifact file: $artifact_path"
-echo "Checksum file: $checksum_file_path"
+echo "Artifact checksum: $artifact_checksum_path"
+echo "SBOM file    : $sbom_path"
+echo "SBOM checksum: $sbom_checksum_path"
 
-release_url=$(gh release create --latest --title "$title" --notes "$notes" --target main "$tag" "$artifact_path" "$checksum_file_path")
+release_url=$(gh release create --latest --title "$title" --notes "$notes" --target main "$tag" \
+    "$artifact_path" "$artifact_checksum_path" "$sbom_path" "$sbom_checksum_path")
 readonly release_url
 echo "Release URL: $release_url"

SECURITY.md

@@ -15,3 +15,7 @@ If you discover a potential security issue, please report it privately via [GitH
 - **Disclose** the details publicly once a fix is available and users have had time to update.
 
 While we don't offer bug bounties, we'd be happy to publicly acknowledge your contribution in the advisory.
+
+## Software Bill of Materials (SBOM)
+
+Starting with version 4.10.0, each GitHub release includes an SPDX Software Bill of Materials (SBOM) for the OpenFastTrace product JAR and a SHA-256 checksum for the SBOM.

api/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-api</artifactId>
     <name>OpenFastTrace API</name>
+    <description>Public API of OpenFastTrace</description>
     <parent>
         <relativePath>../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

core/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-core</artifactId>
     <name>OpenFastTrace Core</name>
+    <description>OpenFastTrace core logic (specification items, linking and base modules for importers, exporters and reporters)</description>
     <parent>
         <relativePath>../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

doc/changes/changes_4.10.0.md

@@ -0,0 +1,17 @@
+# OpenFastTrace 4.10.0, released 2026-08-??
+
+Code name: Lifecycle Information and SPDX3 SBOM
+
+## Summary
+
+The project lifecycle documentation now describes planned deprecations and removals in OFT 5.0.0, including migration guidance for the SpecObject format and short coverage tags.
+
+Each release now includes an SPDX 3 SBOM for the product JAR and a SHA-256 checksum for the SBOM.
+
+## Feature
+
+* #542: CI and releases now provide an SPDX 3 SBOM.
+
+## Documentation
+
+* #579: Documented planned deprecations and removals.

doc/developer_guide.md

@@ -237,6 +237,21 @@ This project is configured to produce exactly the same artifacts each time when
 
 The build will use the last Git commit timestamp as timestamp for files in `.jar` archives.
 
+## SBOM
+
+The project generates an [SPDX](https://spdx.dev/) SBOM using the [SPDX Maven Plugin](https://github.com/spdx/spdx-maven-plugin).
+
+The SPDX plugin runs during Maven's `package` phase and creates an SBOM for each Maven module. The product SBOM describes the product and its production dependencies.
+
+Build OFT and create the SBOMs with a single command:
+
+```shell
+mvn package
+```
+
+> [!IMPORTANT]
+> OFT does not include third-party packages in the production JAR. The JRE is provided by the machine on which OFT runs. Therefore, the product SBOM contains only OFT modules. Test dependencies are excluded because they are not relevant to OFT users.
+
 ## Creating a Release
 
 **NOTE**: This currently only works for release version numbers, not SNAPSHOT versions.

exporter/common/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-exporter-common</artifactId>
     <name>OpenFastTrace Exporters Utils</name>
+    <description>Common logic for OpenFastTrace exporters</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

exporter/specobject/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-exporter-specobject</artifactId>
     <name>OpenFastTrace Specobject Exporter</name>
+    <description>Specobject (ReqM2 exchange format) exporter</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

importer/lightweightmarkup/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-importer-lightweightmarkup</artifactId>
     <name>OpenFastTrace Lightweight Markup Importer Base</name>
+    <description>Base module for OpenFastTrace importers based on lightweight markup languages (e.g., Markdown and RST)</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

importer/markdown/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-importer-markdown</artifactId>
     <name>OpenFastTrace Markdown Importer</name>
+    <description>Importer for OpenFastTrace specification items embedded into Markdown text</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

importer/restructuredtext/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-importer-restructuredtext</artifactId>
     <name>OpenFastTrace reStructuredText Importer</name>
+    <description>Importer for OpenFastTrace specification items embedded into reStructuredText (RST)</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

importer/specobject/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-importer-specobject</artifactId>
     <name>OpenFastTrace Specobject Importer</name>
+    <description>Importer for OpenFastTrace specification items from Specobject (ReqM2 format)</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

importer/tag/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-importer-tag</artifactId>
     <name>OpenFastTrace Tag Importer</name>
+    <description>Importer for OpenFastTrace specification items embedded source code marker tags</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

importer/xmlparser/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-importer-xmlparser</artifactId>
     <name>OpenFastTrace Common XML Parser</name>
+    <description>Importer for OpenFastTrace specification items embedded into XML</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

importer/zip/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-importer-zip</artifactId>
     <name>OpenFastTrace Zip Importer</name>
+    <description>Recursive importer for OpenFastTrace specification items in ZIP archives</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

openfasttrace-mc-deployable-parent/pom.xml

@@ -16,14 +16,14 @@ It is maintained separately from the main parent POM for the following reasons:
     <artifactId>openfasttrace-mc-deployable-parent</artifactId>
     <version>${revision}</version>
     <name>OpenFastTrace Parent for modules deployed to Maven Central</name>
+    <description>Maven-central-specific deployment module for OpenFastTrace</description>
     <packaging>pom</packaging>
     <parent>
         <relativePath>../parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>
         <artifactId>openfasttrace-parent</artifactId>
         <version>${revision}</version>
     </parent>
-    <description>Free requirement tracking suite</description>
     <url>https://github.com/itsallcode/openfasttrace</url>
     <properties>
         <centralPublishingSkipPublishing>false</centralPublishingSkipPublishing>

parent/pom.xml

@@ -7,10 +7,9 @@
     <version>${revision}</version>
     <name>OpenFastTrace Parent</name>
     <packaging>pom</packaging>
-    <description>Free requirement tracking suite</description>
     <url>https://github.com/itsallcode/openfasttrace</url>
     <properties>
-        <revision>4.9.0</revision>
+        <revision>4.10.0</revision>
         <java.version>17</java.version>
         <junit.version>6.1.0-M1</junit.version>
         <junit.version>6.1.2</junit.version>
@@ -21,11 +20,13 @@
         <project.build.outputTimestamp>${reproducible.build.timestamp}</project.build.outputTimestamp>
         <test.args>-Duser.language=en</test.args>
         <ossindex.skip>false</ossindex.skip>
+        <spdx.license>GPL-3.0-only</spdx.license>
+        <spdx.copyright>Copyright (c) itsallcode.org</spdx.copyright>
     </properties>
     <licenses>
         <license>
-            <name>GNU General Public License v3.0</name>
-            <url>https://www.gnu.org/licenses/gpl-3.0.html</url>
+            <name>GPL-3.0-only</name>
+            <url>https://spdx.org/licenses/GPL-3.0-only.html</url>
             <distribution>repo</distribution>
         </license>
     </licenses>
@@ -539,14 +540,43 @@
                 <version>2.21.0</version>
             </plugin>
             <plugin>
-                <!-- Deployment of this module not required -->
+                <!-- Deployment of this module is not required -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-deploy-plugin</artifactId>
                 <version>3.1.4</version>
                 <configuration>
                     <skip>true</skip>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.spdx</groupId>
+                <artifactId>spdx-maven-plugin</artifactId>
+                <version>1.0.3</version>
+                <executions>
+                    <execution>
+                        <id>build-spdx</id>
+                        <goals>
+                            <goal>createSPDX</goal>
+                        </goals>
+                        <phase>package</phase>
+                    </execution>
+                </executions>
+                <configuration>
+                    <spdxFile>${project.reporting.outputDirectory}/${project.groupId}_${project.artifactId}-${project.version}.spdx3.json</spdxFile>
+                    <sbomType>build</sbomType>
+                    <outputFormat>JSON-LD</outputFormat>
+                    <licenseDeclared>${spdx.license}</licenseDeclared>
+                    <licenseConcluded>${spdx.license}</licenseConcluded>
+                    <copyrightText>${spdx.copyright}</copyrightText>
+                    <createExternalRefs>false</createExternalRefs>
+                    <defaultFileConcludedLicense>${spdx.license}</defaultFileConcludedLicense>
+                    <defaultLicenseInformationInFile>${spdx.license}</defaultLicenseInformationInFile>
+                    <defaultFileCopyright>${spdx.copyright}</defaultFileCopyright>
+                    <includeCompileScope>true</includeCompileScope>
+                    <includeTestScope>false</includeTestScope>
+                    <includeTransitiveDependencies>true</includeTransitiveDependencies>
+                </configuration>
+            </plugin>
         </plugins>
         <pluginManagement>
             <plugins>

pom.xml

@@ -49,6 +49,30 @@
                 </configuration>
             </plugin>
             <plugin>
+                <groupId>org.spdx</groupId>
+                <artifactId>spdx-maven-plugin</artifactId>
+                <version>1.0.3</version>
+                <executions>
+                    <execution>
+                        <id>aggregate-spdx</id>
+                        <goals>
+                            <goal>aggregateSPDX</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <sbomType>build</sbomType>
+                    <includeTestScope>false</includeTestScope>
+                    <licenseDeclared>GPL-3.0-only</licenseDeclared>
+                    <licenseConcluded>GPL-3.0-only</licenseConcluded>
+                    <copyrightText>Copyright (c) itsallcode.org</copyrightText>
+                    <createExternalRefs>false</createExternalRefs>
+                    <defaultFileConcludedLicense>GPL-3.0-only</defaultFileConcludedLicense>
+                    <defaultLicenseInformationInFile>GPL-3.0-only</defaultLicenseInformationInFile>
+                    <defaultFileCopyright>Copyright (c) itsallcode.org</defaultFileCopyright>
+                </configuration>
+          </plugin>
+          <plugin>
                 <groupId>org.sonarsource.scanner.maven</groupId>
                 <artifactId>sonar-maven-plugin</artifactId>
                 <version>5.7.0.6970</version>