JSTEP-14: Generate, publish SBOMs for Jackson components

[cowtowncoder]

I created https://github.com/FasterXML/jackson-future-ideas/wiki/JSTEP-14 to propose publishing SBOM artifacts for (all) Jackson components.

Mechanism itself looks simple, using cyclonedx-maven-plugin Maven plug-in as part of build process; attaching artifacts so they will also be published to Maven Central.
(note: this is one of 2 existing SBOM standards; seemingly more mature).

WDYT? One practical question is just Maven "classifier" to use -- we probably want to follow de facto standard whatever it is (default of "cyclonedx" may not be it).

EDIT: Initial choice for classifer: sbom-cyclonedx.

[cowtowncoder]

/cc @JooHyukKim @pjfanning @yawkat @k163377 @sdeleuze @stevenschlansker

[pjfanning]

I already publish a cyclonedx SBOM for jackson-module-scala.
Example:

• https://repo1.maven.org/maven2/com/fasterxml/jackson/module/jackson-module-scala_2.13/2.19.0/jackson-module-scala_2.13-2.19.0-cyclonedx.xml
• https://repo1.maven.org/maven2/tools/jackson/module/jackson-module-scala_2.13/3.0.0-rc3/jackson-module-scala_2.13-3.0.0-rc3-cyclonedx.xml

[cowtowncoder]

Ok so that is using the default classifier (cyclonedx). Well, we have until 2.20.0 or 3.0.0 whichever is to be published first, to decide.

[pjfanning]

there is a spdx sbom format so it is common to include cyclonedx in the file name to differentiate

[cowtowncoder]

I know, not suggesting plain "sbom", but there are multiple alternating proposals. Starting with sbom-cyclonedx, just need to decide before 20.0.0 or 3.0.0 gets released (defaulting added in jackson-base)

[cowtowncoder]

Relevant example(s):

• neo4j/neo4j-jdbc@d631b45#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8

Classifier used: sbom-cyclonedx we could use that.

[mhalbritter]

Here's another datapoint from the Spring Boot project. The spring-boot-starter-parent contains plugin management for the cyclonedx-maven-plugin. It's configured this way:

<plugin>
	<groupId>org.cyclonedx</groupId>
	<artifactId>cyclonedx-maven-plugin</artifactId>
	<executions>
		<execution>
			<phase>generate-resources</phase>
			<goals>
				<goal>makeAggregateBom</goal>
			</goals>
			<configuration>
				<projectType>application</projectType>
				<outputDirectory>${project.build.outputDirectory}/META-INF/sbom</outputDirectory>
				<outputFormat>json</outputFormat>
				<outputName>application.cdx</outputName>
			</configuration>
		</execution>
	</executions>
</plugin>

This might not be 100% applicable to you, as you have a library while users typically create a Spring Boot application. That's why, by default, we name it application.cdx.json.

If you use the SBOM feature from native-image, the SBOM is created under META-INF/native-image/sbom.json.

[cowtowncoder]

Thank you for sharing!

Right, it is possible expected sbom artifact, naming, differs a bit b/w libraries and web apps.

[cowtowncoder]

All repos updated now: since "classifier" comes from parent pom (jackson-base from jackson-bom repo), changing it would be easy; only needs to be changed in one place.

[cowtowncoder]

Publishing worked in 3.0.0-rc4, but broken in 3.0.0-rc5 due to changes (somehow) wrt Sonatype Central publishing: artifacts are generated but not uploaded, it seems.

[pjfanning]

I don't think that Sonatype Central is the issue. The jackson-module-scala build uses sbt as opposed to maven and its SBOMs are still being published after switch to Sonatype Central. https://repo1.maven.org/maven2/com/fasterxml/jackson/module/jackson-module-scala_2.13/2.20.0/

Maybe the issue is with the maven plugin for Sonatype Central?

[cowtowncoder]

@pjfanning Right, I meant to say something in the publishing process and most likely staging plugin (defaults or configuration). For some reason artifacts not attached like sources or javadocs.

Also good to know Sonatype Central itself is fine taking artifacts.

[cowtowncoder]

NOTE: publishing fixed (via FasterXML/jackson-databind#5361) for 2.21 and 3.1.