diff --git a/buildSrc/build.gradle.kts b/buildSrc/build.gradle.kts index ee330ca84c9..df012fd6f1d 100644 --- a/buildSrc/build.gradle.kts +++ b/buildSrc/build.gradle.kts @@ -39,6 +39,10 @@ gradlePlugin { id = "jps-compatible" implementationClass = "org.jetbrains.kotlin.pill.JpsCompatiblePlugin" } + register("kotlin-build-publishing") { + id = "kotlin-build-publishing" + implementationClass = "plugins.KotlinBuildPublishingPlugin" + } } } diff --git a/buildSrc/src/main/kotlin/artifacts.kt b/buildSrc/src/main/kotlin/artifacts.kt index e4ccc581fb6..f507fd34d01 100644 --- a/buildSrc/src/main/kotlin/artifacts.kt +++ b/buildSrc/src/main/kotlin/artifacts.kt @@ -380,7 +380,7 @@ fun Project.publishTestJar(projects: List, excludedPaths: List) } } - publish() + publish(sbom = false) val jar: Jar by tasks diff --git a/buildSrc/src/main/kotlin/sbom.kt b/buildSrc/src/main/kotlin/sbom.kt index e7cc4cd84af..5782b452429 100644 --- a/buildSrc/src/main/kotlin/sbom.kt +++ b/buildSrc/src/main/kotlin/sbom.kt @@ -1,25 +1,31 @@ -import org.gradle.api.Project -import org.gradle.api.artifacts.PublishArtifact -import org.gradle.kotlin.dsl.apply -import org.gradle.kotlin.dsl.configure -import org.spdx.sbom.gradle.SpdxSbomExtension -import org.spdx.sbom.gradle.SpdxSbomPlugin -import java.util.* - /* * Copyright 2010-2023 JetBrains s.r.o. and Kotlin Programming Language contributors. * Use of this source code is governed by the Apache 2.0 license that can be found in the license/LICENSE.txt file. */ +import org.gradle.api.Project +import org.gradle.api.publish.PublishingExtension +import org.gradle.api.publish.maven.MavenPublication +import org.gradle.api.tasks.TaskProvider +import org.gradle.kotlin.dsl.* +import org.spdx.sbom.gradle.SpdxSbomExtension +import org.spdx.sbom.gradle.SpdxSbomPlugin +import org.spdx.sbom.gradle.SpdxSbomTask +import plugins.mainPublicationName +import java.util.* + + fun Project.configureSbom( - moduleName: String = this.name, - gradleConfigurations: Iterable = setOf("runtimeClasspath"), -): PublishArtifact { + target: String? = null, + documentName: String? = null, + gradleConfigurations: Iterable = setOf("runtimeClasspath") +): TaskProvider { val project = this + val targetName = target ?: "${mainPublicationName}Publication" apply() configure { - targets.create(moduleName) { + targets.create(targetName) { configurations.set(gradleConfigurations) scm { tool.set("git") @@ -29,7 +35,7 @@ fun Project.configureSbom( // adjust properties of the document document { - this.name.set("SpdxDoc for $moduleName") + name.set(documentName ?: project.name) // NOTE: The URI does not have to be accessible. It is only intended to provide a unique ID. // In many cases, the URI will point to a Web accessible document, but this should not be assumed to be the case. namespace.set("https://www.jetbrains.com/spdxdocs/${UUID.randomUUID()}") @@ -39,17 +45,26 @@ fun Project.configureSbom( } } - val sbomCfg = configurations.maybeCreate("sbomFor$moduleName").apply { + val spdxSbomTask = tasks.named("spdxSbomFor$targetName") + val sbomFile = spdxSbomTask.map { it.outputDirectory.file("$targetName.spdx.json") } + + val sbomCfg = configurations.maybeCreate("sbomFor$targetName").apply { isCanBeResolved = false isCanBeConsumed = true } - val sbomFile = layout.buildDirectory.file("spdx/$moduleName.spdx.json") - val sbomArtifact = artifacts.add(sbomCfg.name, sbomFile.get().asFile) { + + val sbomArtifact = artifacts.add(sbomCfg.name, sbomFile) { type = "sbom" extension = "spdx.json" - val capitalizedModuleName = - moduleName.replaceFirstChar { if (it.isLowerCase()) it.titlecase(Locale.getDefault()) else it.toString() } - builtBy("spdxSbomFor$capitalizedModuleName") + builtBy(spdxSbomTask) } - return sbomArtifact + + if (target == null) { + pluginManager.withPlugin("kotlin-build-publishing") { + val mainPublication = the().publications[mainPublicationName] as MavenPublication + mainPublication.artifact(sbomArtifact) + } + } + + return spdxSbomTask } diff --git a/libraries/commonConfiguration.gradle b/libraries/commonConfiguration.gradle index baf60313fcd..919f0c5dde1 100644 --- a/libraries/commonConfiguration.gradle +++ b/libraries/commonConfiguration.gradle @@ -56,8 +56,8 @@ ext.configurePublishing = { Project project, configure = { } -> } } -ext.configureSbom = { Project project, String moduleName = project.name, Iterable gradleConfigurations = ["runtimeClasspath"] -> - SbomKt.configureSbom(project, moduleName, gradleConfigurations) +ext.configureSbom = { Project project, String target = null, String documentTitle = null, Iterable gradleConfigurations = ["runtimeClasspath"] -> + SbomKt.configureSbom(project, target, documentTitle, gradleConfigurations) } ext.configureFrontendIr = { Project project -> diff --git a/libraries/stdlib/common/build.gradle b/libraries/stdlib/common/build.gradle index 8ca2c66891b..d17c65464c6 100644 --- a/libraries/stdlib/common/build.gradle +++ b/libraries/stdlib/common/build.gradle @@ -2,10 +2,8 @@ description = 'Kotlin Common Standard Library' apply plugin: 'kotlin-platform-common' -def sbom = configureSbom(project) -configurePublishing(project, { - artifact(sbom) -}) +configureSbom(project) +configurePublishing(project) JvmToolchain.updateJvmTarget(project, "1.8") diff --git a/libraries/stdlib/jdk7/build.gradle b/libraries/stdlib/jdk7/build.gradle index f2d2624b3e4..a50e0de1889 100644 --- a/libraries/stdlib/jdk7/build.gradle +++ b/libraries/stdlib/jdk7/build.gradle @@ -4,10 +4,8 @@ apply plugin: 'kotlin' JvmToolchain.configureJvmToolchain(project, JdkMajorVersion.JDK_1_8) -def sbom = configureSbom(project) -configurePublishing(project, { - artifact(sbom) -}) +configureSbom(project) +configurePublishing(project) configureSourcesJar() configureJavadocJar() diff --git a/libraries/stdlib/jdk8/build.gradle b/libraries/stdlib/jdk8/build.gradle index ea1b5b62c11..20f7f9f75d3 100644 --- a/libraries/stdlib/jdk8/build.gradle +++ b/libraries/stdlib/jdk8/build.gradle @@ -2,10 +2,8 @@ description = 'Kotlin Standard Library JDK 8 extension' apply plugin: 'kotlin' -def sbom = configureSbom(project) -configurePublishing(project, { - artifact(sbom) -}) +configureSbom(project) +configurePublishing(project) configureSourcesJar() configureJavadocJar() diff --git a/libraries/stdlib/jvm/build.gradle b/libraries/stdlib/jvm/build.gradle index e0a98a29e6b..d09c3bfbf2c 100644 --- a/libraries/stdlib/jvm/build.gradle +++ b/libraries/stdlib/jvm/build.gradle @@ -6,10 +6,8 @@ archivesBaseName = 'kotlin-stdlib' JvmToolchain.configureJvmToolchain(project, JdkMajorVersion.JDK_1_8) -def sbom = configureSbom(project) -configurePublishing(project, { - artifact(sbom) -}) +configureSbom(project) +configurePublishing(project) configureJavadocJar() configureSourcesJar() diff --git a/prepare/compiler/build.gradle.kts b/prepare/compiler/build.gradle.kts index beee41d0781..f46206d0f82 100644 --- a/prepare/compiler/build.gradle.kts +++ b/prepare/compiler/build.gradle.kts @@ -250,8 +250,16 @@ dependencies { fatJarContentsStripVersions(commonDependency("one.util:streamex")) { isTransitive = false } } +configureSbom() // sbom for main maven publication publish() +// sbom for dist +val distSbomTask = configureSbom( + target = "Dist", + documentName = "Kotlin Compiler Distribution", + setOf(configurations.runtimeClasspath.name, libraries.name, librariesStripVersion.name, compilerPlugins.name) +) + val packCompiler by task { duplicatesStrategy = DuplicatesStrategy.EXCLUDE destinationDirectory.set(File(buildDir, "libs")) @@ -430,12 +438,6 @@ val distJs = distTask("distJs") { from(distJSContents) } -val compilerZipSbomName = "kotlin-compiler-zip" -val sbom = configureSbom( - moduleName = compilerZipSbomName, - gradleConfigurations = setOf("runtimeClasspath", libraries.name, librariesStripVersion.name, compilerPlugins.name) -) - distTask("dist") { destinationDir = File(distDir) @@ -443,12 +445,12 @@ distTask("dist") { dependsOn(distCommon) dependsOn(distMaven) dependsOn(distJs) - dependsOn("spdxSbomForKotlin-compiler-zip") + dependsOn(distSbomTask) from(buildNumber) from(distStdlibMinimalForTests) - from(sbom.file) { - rename("$compilerZipSbomName.spdx.json", "${project.name}-${project.version}.spdx.json") + from(distSbomTask.map { it.outputDirectory.file("dist.spdx.json") }) { + rename(".*", "${project.name}-${project.version}.spdx.json") } }