Skip to content

Conversation

@zch93
Copy link
Contributor

@zch93 zch93 commented Jan 14, 2023

What is the purpose of the change

The original PR which modified the flink-parent: #apache/flink#21606

This PR aims to publish SBOM artifacts.

  • Here is an article to give some context: article

Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: CycloneDX, Software Identification (SWID) tag, Software Package Data Exchange® (SPDX).

This PR uses CycloneDX maven plugin, a lightweight software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis.

BOM files get automatically published on maven deploy.

Brief change log

  • Add cyclonedx-maven-plugin plugin to the flink-ml-parent pom

Verifying this change

Each jar file will have two corresponding files: xxx-cyclonedx.xml and xxx-cyclonedx.json 🎉
Example:

$ mvn install -DskipTests
...
[INFO] Installing /Users/zsomborchikan/Desktop/flink_upstream/flink-ml/flink-ml-dist/target/bom.xml to /Users/zsomborchikan/.m2/repository/org/apache/flink/flink-ml-dist/2.2-SNAPSHOT/flink-ml-dist-2.2-SNAPSHOT-cyclonedx.xml
[INFO] Installing /Users/zsomborchikan/Desktop/flink_upstream/flink-ml/flink-ml-dist/target/bom.json to /Users/zsomborchikan/.m2/repository/org/apache/flink/flink-ml-dist/2.2-SNAPSHOT/flink-ml-dist-2.2-SNAPSHOT-cyclonedx.json
[INFO] Installing /Users/zsomborchikan/Desktop/flink_upstream/flink-ml/flink-ml-dist/target/flink-ml-dist-2.2-SNAPSHOT-tests.jar to /Users/zsomborchikan/.m2/repository/org/apache/flink/flink-ml-dist/2.2-SNAPSHOT/flink-ml-dist-2.2-SNAPSHOT-tests.jar
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Flink ML 2.2-SNAPSHOT:
[INFO] 
[INFO] Flink ML ........................................... SUCCESS [  7.690 s]
[INFO] Flink ML : Iteration ............................... SUCCESS [ 17.761 s]
[INFO] Flink ML : Core .................................... SUCCESS [  7.089 s]
[INFO] Flink ML : Lib ..................................... SUCCESS [  8.036 s]
[INFO] Flink ML : Tests ................................... SUCCESS [  1.534 s]
[INFO] Flink ML : Benchmark ............................... SUCCESS [  2.212 s]
[INFO] Flink ML : Uber .................................... SUCCESS [  2.592 s]
[INFO] Flink ML : Examples ................................ SUCCESS [  2.629 s]
[INFO] flink-ml-python .................................... SUCCESS [  1.607 s]
[INFO] Flink ML : Dist .................................... SUCCESS [  2.706 s]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------


$ ls -la /Users/zsomborchikan/.m2/repository/org/apache/flink/flink-ml-dist/2.2-SNAPSHOT
drwxr-xr-x@ 9 zsomborchikan  staff     288 Jan 14 10:47 .
drwxr-xr-x@ 4 zsomborchikan  staff     128 Jan 14 10:44 ..
-rw-r--r--@ 1 zsomborchikan  staff     332 Jan 14 10:47 _remote.repositories
-rw-r--r--@ 1 zsomborchikan  staff  165270 Jan 14 10:47 flink-ml-dist-2.2-SNAPSHOT-cyclonedx.json
-rw-r--r--@ 1 zsomborchikan  staff  146739 Jan 14 10:47 flink-ml-dist-2.2-SNAPSHOT-cyclonedx.xml
-rw-r--r--@ 1 zsomborchikan  staff     464 Jan 14 10:47 flink-ml-dist-2.2-SNAPSHOT-tests.jar
-rw-r--r--@ 1 zsomborchikan  staff    9647 Jan 14 10:47 flink-ml-dist-2.2-SNAPSHOT.jar
-rw-r--r--@ 1 zsomborchikan  staff    3708 Jan 12 15:53 flink-ml-dist-2.2-SNAPSHOT.pom
-rw-r--r--@ 1 zsomborchikan  staff    1321 Jan 14 10:47 maven-metadata-local.xml

Does this pull request potentially affect one of the following parts:

  • Dependencies (does it add or upgrade a dependency): Yes, but it's plugin dependency.
  • The public API, i.e., is any changed class annotated with @public(Evolving): No

Documentation

  • Does this pull request introduce a new feature? No
  • If yes, how is the feature documented? N/A

@lindong28 lindong28 changed the title [FLINK-30578][build] Publish SBOM for externalized connectors [FLINK-30578][build] Publish SBOM artifacts Jan 16, 2023
@lindong28
Copy link
Member

Thanks for the PR. LGTM.

@lindong28 lindong28 merged commit 2822d44 into apache:master Jan 16, 2023
vacaly pushed a commit to vacaly/flink-ml that referenced this pull request Feb 8, 2023
vacaly pushed a commit to vacaly/flink-ml that referenced this pull request Feb 10, 2023
Fanoid pushed a commit to Fanoid/flink-ml that referenced this pull request Apr 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants