|
| 1 | +/* |
| 2 | + * Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved. |
| 3 | + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| 4 | + * |
| 5 | + * The Universal Permissive License (UPL), Version 1.0 |
| 6 | + * |
| 7 | + * Subject to the condition set forth below, permission is hereby granted to any |
| 8 | + * person obtaining a copy of this software, associated documentation and/or |
| 9 | + * data (collectively the "Software"), free of charge and under any and all |
| 10 | + * copyright rights in the Software, and any and all patent rights owned or |
| 11 | + * freely licensable by each licensor hereunder covering either (i) the |
| 12 | + * unmodified Software as contributed to or provided by such licensor, or (ii) |
| 13 | + * the Larger Works (as defined below), to deal in both |
| 14 | + * |
| 15 | + * (a) the Software, and |
| 16 | + * |
| 17 | + * (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if |
| 18 | + * one is included with the Software each a "Larger Work" to which the Software |
| 19 | + * is contributed by such licensors), |
| 20 | + * |
| 21 | + * without restriction, including without limitation the rights to copy, create |
| 22 | + * derivative works of, display, perform, and distribute the Software and make, |
| 23 | + * use, sell, offer for sale, import, export, have made, and have sold the |
| 24 | + * Software and the Larger Work(s), and to sublicense the foregoing rights on |
| 25 | + * either these or other terms. |
| 26 | + * |
| 27 | + * This license is subject to the following condition: |
| 28 | + * |
| 29 | + * The above copyright notice and either this complete permission notice or at a |
| 30 | + * minimum a reference to the UPL must be included in all copies or substantial |
| 31 | + * portions of the Software. |
| 32 | + * |
| 33 | + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 34 | + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 35 | + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
| 36 | + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| 37 | + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| 38 | + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
| 39 | + * SOFTWARE. |
| 40 | + */ |
| 41 | + |
| 42 | +package org.graalvm.buildtools.maven |
| 43 | + |
| 44 | +import com.fasterxml.jackson.databind.node.ObjectNode |
| 45 | +import org.graalvm.buildtools.maven.sbom.SBOMGenerator |
| 46 | +import org.graalvm.buildtools.utils.NativeImageUtils |
| 47 | +import spock.lang.Requires |
| 48 | +import com.fasterxml.jackson.databind.ObjectMapper |
| 49 | + |
| 50 | +class SBOMFunctionalTest extends AbstractGraalVMMavenFunctionalTest { |
| 51 | + private static boolean EE() { |
| 52 | + NativeCompileNoForkMojo.isOracleGraalVM(null) |
| 53 | + } |
| 54 | + |
| 55 | + private static boolean CE() { |
| 56 | + !EE() |
| 57 | + } |
| 58 | + |
| 59 | + private static boolean supportedJDKVersion() { |
| 60 | + NativeImageUtils.getMajorJDKVersion(NativeCompileNoForkMojo.getVersionInformation(null)) >= SBOMGenerator.requiredNativeImageVersion |
| 61 | + } |
| 62 | + |
| 63 | + private static boolean unsupportedJDKVersion() { |
| 64 | + !supportedJDKVersion() |
| 65 | + } |
| 66 | + |
| 67 | + private static boolean supportedAugmentedSBOMVersion() { |
| 68 | + EE() && supportedJDKVersion() |
| 69 | + } |
| 70 | + |
| 71 | + @Requires({ EE() }) |
| 72 | + def "sbom is created when buildArg '--enable-sbom=export,embed' is used"() { |
| 73 | + withSample 'java-application' |
| 74 | + |
| 75 | + when: |
| 76 | + /* The 'native-sbom' profile sets the '--enable-sbom' argument. */ |
| 77 | + mvn '-Pnative-sbom', '-DquickBuild', '-DskipTests', 'package', 'exec:exec@native' |
| 78 | + |
| 79 | + def sbom = file("target/example-app.sbom.json") |
| 80 | + |
| 81 | + then: |
| 82 | + buildSucceeded |
| 83 | + outputContainsPattern".*CycloneDX SBOM with \\d+ component\\(s\\) is embedded in binary \\(.*?\\) and exported as JSON \\(see build artifacts\\)\\." |
| 84 | + outputDoesNotContain "Use '--enable-sbom' to assemble a Software Bill of Materials (SBOM)" |
| 85 | + validateSbom sbom |
| 86 | + !file(String.format("target/%s", SBOMGenerator.SBOM_FILENAME)).exists() |
| 87 | + outputContains "Hello, native!" |
| 88 | + } |
| 89 | + |
| 90 | + /** |
| 91 | + * If user sets {@link NativeCompileNoForkMojo#AUGMENTED_SBOM_PARAM_NAME} to true then an SBOM should be generated |
| 92 | + * with default SBOM arguments even if user did not explicitly specify '--enable-sbom' as a buildArg. |
| 93 | + */ |
| 94 | + @Requires({ supportedAugmentedSBOMVersion() }) |
| 95 | + def "sbom is created when only the augmented sbom parameter is used (but not the '--enable-sbom' buildArg)"() { |
| 96 | + withSample 'java-application' |
| 97 | +
|
| 98 | + when: |
| 99 | + mvn '-Pnative-augmentedSBOM-only', '-DquickBuild', '-DskipTests', 'package', 'exec:exec@native' |
| 100 | +
|
| 101 | + def sbom = file("target/example-app.sbom.json") |
| 102 | +
|
| 103 | + then: |
| 104 | + buildSucceeded |
| 105 | + outputContainsPattern".*CycloneDX SBOM with \\d+ component\\(s\\) is embedded in binary \\(.*?\\)." |
| 106 | + outputDoesNotContain "Use '--enable-sbom' to assemble a Software Bill of Materials (SBOM)" |
| 107 | + validateSbom sbom |
| 108 | + !file(String.format("target/%s", SBOMGenerator.SBOM_FILENAME)).exists() |
| 109 | + outputContains "Hello, native!" |
| 110 | + } |
| 111 | +
|
| 112 | + @Requires({ CE() }) |
| 113 | + def "error is thrown when augmented sbom parameter is used with CE"() { |
| 114 | + withSample 'java-application' |
| 115 | +
|
| 116 | + when: |
| 117 | + mvn '-Pnative-augmentedSBOM-only', '-DquickBuild', '-DskipTests', 'package' |
| 118 | +
|
| 119 | + then: |
| 120 | + buildFailed |
| 121 | + outputContains "IllegalArgumentException" |
| 122 | + } |
| 123 | +
|
| 124 | + @Requires({ EE() && unsupportedJDKVersion() }) |
| 125 | + def "error is thrown when augmented sbom parameter is used with EE but not with an unsupported JDK version"() { |
| 126 | + withSample 'java-application' |
| 127 | +
|
| 128 | + when: |
| 129 | + mvn '-Pnative-augmentedSBOM-only', '-DquickBuild', '-DskipTests', 'package' |
| 130 | +
|
| 131 | + then: |
| 132 | + buildFailed |
| 133 | + outputContains "IllegalArgumentException" |
| 134 | + } |
| 135 | +
|
| 136 | + private static boolean validateSbom(File sbom) { |
| 137 | + try { |
| 138 | + if (!sbom.exists()) { |
| 139 | + println "SBOM not found: ${sbom}" |
| 140 | + return false |
| 141 | + } |
| 142 | +
|
| 143 | + def mapper = new ObjectMapper() |
| 144 | + def rootNode = mapper.readTree(sbom) |
| 145 | +
|
| 146 | + // Check root fields |
| 147 | + assert rootNode.has('bomFormat') |
| 148 | + assert rootNode.get('bomFormat').asText() == 'CycloneDX' |
| 149 | + assert rootNode.has('specVersion') |
| 150 | + assert rootNode.has('serialNumber') |
| 151 | + assert rootNode.has('version') |
| 152 | + assert rootNode.has('metadata') |
| 153 | + assert rootNode.has('components') |
| 154 | + assert rootNode.has('dependencies') |
| 155 | +
|
| 156 | + // Check metadata/component |
| 157 | + def metadataComponent = rootNode.path('metadata').path('component') |
| 158 | + assert metadataComponent.has('group') |
| 159 | + assert metadataComponent.get('group').asText() == 'org.graalvm.buildtools.examples' |
| 160 | + assert metadataComponent.has('name') |
| 161 | + assert metadataComponent.get('name').asText() == 'maven' |
| 162 | +
|
| 163 | + // Check that components and dependencies are non-empty |
| 164 | + assert !rootNode.get('components').isEmpty() |
| 165 | + assert !rootNode.get('dependencies').isEmpty() |
| 166 | +
|
| 167 | + // Check that the main component has no dependencies |
| 168 | + def mainComponentId = metadataComponent.get('bom-ref').asText() |
| 169 | + def mainComponentDependency = rootNode.get('dependencies').find { it.get('ref').asText() == mainComponentId } as ObjectNode |
| 170 | + assert mainComponentDependency.get('dependsOn').isEmpty() |
| 171 | +
|
| 172 | + // Check that the main component is not found in "components" |
| 173 | + assert !rootNode.get('components').any { it.get('bom-ref').asText() == mainComponentId } |
| 174 | +
|
| 175 | + return true |
| 176 | + } catch (AssertionError | Exception e) { |
| 177 | + println "SBOM validation failed: ${e.message}" |
| 178 | + return false |
| 179 | + } |
| 180 | + } |
| 181 | +} |
0 commit comments