adoptium / temurin-build

Eclipse Temurin™ build scripts - common across all releases/versions
Apache License 2.0
1.03k stars 251 forks source link

Add support in the sbom generator for inject a list of packages from our build env. #3086

Open zdtsw opened 2 years ago

zdtsw commented 2 years ago

To continue with https://github.com/adoptium/temurin-build/issues/2813#issuecomment-1231731166 add new functions https://github.com/adoptium/temurin-build/blob/master/cyclonedx-lib/src/temurin/sbom/TemurinGenSBOM.java to support a "formulation" (even we need more information from CDX) it could be good to have a draft in our sbom.json with such till we have the new specification defined in CDX1.5 use input list

 autoconf-2.71-r0
 bash-5.1.16-r0
 binutils-2.37-r3
 busybox-1.34.1-r7
 g++-10.3.1_git20211027-r0
 gcc-10.3.1_git20211027-r0
 git-2.34.4-r0
 grep-3.7-r0
 m4-1.4.18-r2
 make-4.3-r0
 musl-1.2.2-r7
 musl-utils-1.2.2-r7
 pkgconf-1.8.0-r0
 sed-4.8-r0
 tar-1.34-r0
 zip-3.0-r9

for now, till we have a "real" list from each jdk version created from jenkins build agents

zdtsw commented 2 years ago

on hold till we have a bit more information from CDX