diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts index c30345f0072..4899caf8b59 100644 --- a/buildSrc/build.gradle.kts +++ b/buildSrc/build.gradle.kts @@ -96,6 +96,8 @@ dependencies { implementation("com.gradle.publish:plugin-publish-plugin:1.0.0") implementation("org.jetbrains.dokka:dokka-gradle-plugin:1.8.10") + implementation("org.spdx:spdx-gradle-plugin:0.1.0-dev-5") + implementation("com.jakewharton.dex:dex-member-list:4.1.1") implementation("gradle.plugin.com.github.johnrengelman:shadow:${rootProject.extra["versions.shadow"]}") { diff --git a/buildSrc/src/main/kotlin/sbom.kt b/buildSrc/src/main/kotlin/sbom.kt new file mode 100644 index 00000000000..8730a5b259b --- /dev/null +++ b/buildSrc/src/main/kotlin/sbom.kt @@ -0,0 +1,55 @@ +import org.gradle.api.Project +import org.gradle.api.publish.PublishingExtension +import org.gradle.api.publish.maven.MavenPublication +import org.gradle.kotlin.dsl.apply +import org.gradle.kotlin.dsl.configure +import org.gradle.kotlin.dsl.findByType +import org.spdx.sbom.gradle.SpdxSbomExtension +import org.spdx.sbom.gradle.SpdxSbomPlugin +import plugins.mainPublicationName +import java.util.* + +/* + * Copyright 2010-2023 JetBrains s.r.o. and Kotlin Programming Language contributors. + * Use of this source code is governed by the Apache 2.0 license that can be found in the license/LICENSE.txt file. + */ + +fun Project.configureSbom(gradleConfigurations: Iterable = setOf("runtimeClasspath")) { + val project = this + apply() + + configure { + targets.create(project.name) { + configurations.set(gradleConfigurations) + scm { + tool.set("git") + uri.set("https://github.com/JetBrains/kotlin.git") + revision.set("v${project.version}") + } + + // adjust properties of the document + document { + name.set("SpdxDoc for ${project.name}") + // NOTE: The URI does not have to be accessible. It is only intended to provide a unique ID. + // In many cases, the URI will point to a Web accessible document, but this should not be assumed to be the case. + namespace.set("https://www.jetbrains.com/spdxdocs/${UUID.randomUUID()}") + creator.set("Organization: JetBrains s.r.o.") + packageSupplier.set("Organization: JetBrains s.r.o.") + } + } + } + + configurations.maybeCreate("sbom") + val sbomFile = layout.buildDirectory.file("spdx/${project.name}.spdx.json") + val sbomArtifact = artifacts.add("sbom", sbomFile.get().asFile) { + type = "sbom" + extension = "spdx.json" + builtBy("spdxSbom") + } + val publication = extensions.findByType() + ?.publications + ?.findByName(mainPublicationName) as MavenPublication? + publication?.apply { + artifact(sbomArtifact) + } +} diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 65ed34a5aa7..3e8e40ecbe9 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -144,6 +144,12 @@ + + + + + + @@ -720,6 +726,12 @@ + + + + + + @@ -774,6 +786,12 @@ + + + + + + @@ -834,6 +852,12 @@ + + + + + + @@ -862,6 +886,18 @@ + + + + + + + + + + + + @@ -934,6 +970,12 @@ + + + + + + @@ -956,6 +998,12 @@ + + + + + + @@ -1154,6 +1202,12 @@ + + + + + + @@ -1252,6 +1306,12 @@ + + + + + + @@ -1284,6 +1344,12 @@ + + + + + + @@ -4579,12 +4645,30 @@ + + + + + + + + + + + + + + + + + + @@ -4643,6 +4727,12 @@ + + + + + + @@ -4687,6 +4777,12 @@ + + + + + + @@ -4709,6 +4805,12 @@ + + + + + + @@ -4767,6 +4869,12 @@ + + + + + + @@ -4817,6 +4925,12 @@ + + + + + + @@ -4835,6 +4949,12 @@ + + + + + + @@ -4931,6 +5051,12 @@ + + + + + + @@ -4955,6 +5081,12 @@ + + + + + + @@ -4979,6 +5111,12 @@ + + + + + + @@ -4997,6 +5135,12 @@ + + + + + + @@ -5021,6 +5165,12 @@ + + + + + + @@ -5057,12 +5207,24 @@ + + + + + + + + + + + + @@ -5087,6 +5249,12 @@ + + + + + + @@ -5135,6 +5303,12 @@ + + + + + + @@ -6005,6 +6179,12 @@ + + + + + + @@ -8039,6 +8219,12 @@ + + + + + + @@ -8903,6 +9089,12 @@ + + + + + + @@ -8949,6 +9141,24 @@ + + + + + + + + + + + + + + + + + + @@ -9005,6 +9215,12 @@ + + + + + + diff --git a/libraries/commonConfiguration.gradle b/libraries/commonConfiguration.gradle index c5c453aa06a..1f425e05194 100644 --- a/libraries/commonConfiguration.gradle +++ b/libraries/commonConfiguration.gradle @@ -56,6 +56,10 @@ ext.configurePublishing = { Project project, configure = { } -> } } +ext.configureSbom = { Project project, Iterable gradleConfigurations = ["runtimeClasspath"] -> + SbomKt.configureSbom(project, gradleConfigurations) +} + ext.configureFrontendIr = { Project project -> project.tasks.withType(KotlinCompile.class) { task -> task.kotlinOptions {