Add p2-aware model converter for CycloneDX SBOM generation

This change consists of two parts. The first part consists of generating
a valid package URL for a given p2 artifact. The PURL contains the
symbolic name, version and classifier of the artifact key, as well as
the repository it is located in.
The second part handles the dependencies between two PURLs. For the sake
of consistency, this dependency tree matches the tree calculated by the
dependency-tree mojo.

RELEASE_NOTES.md

@@ -2,6 +2,12 @@
 
 This page describes the noteworthy improvements provided by each release of Eclipse Tycho.
 
+## 4.0.6
+
+### backports:
+
+- Support for CycloneDX Maven Plugin
+
 ## 4.0.5
 
 ### backports:

pom.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
- - Copyright (c) 2008, 2022 Sonatype Inc. and others.
+ - Copyright (c) 2008, 2024 Sonatype Inc. and others.
  - All rights reserved. This program and the accompanying materials
  - are made available under the terms of the Eclipse Public License v1.0
  - which accompanies this distribution, and is available at
@@ -542,6 +542,7 @@
 		<module>tycho-ds-plugin</module>
 		<module>tycho-buildtimestamp-jgit</module>
 		<module>tycho-baseline-plugin</module>
+		<module>tycho-sbom</module>
 		<!-- surefire -->
 		<module>tycho-surefire</module>
 		<!-- release -->

tycho-core/src/main/java/org/eclipse/tycho/core/maven/TychoReactorReader.java

@@ -1,5 +1,5 @@
 /*******************************************************************************
- * Copyright (c) 2023 Christoph Läubrich and others.
+ * Copyright (c) 2023, 2024 Christoph Läubrich and others.
  * All rights reserved. This program and the accompanying materials
  * are made available under the terms of the Eclipse Public License v1.0
  * which accompanies this distribution, and is available at
@@ -67,7 +67,7 @@ public File findArtifact(Artifact artifact) {
         }).orElse(null);
     }
 
-    private Optional<MavenProject> getTychoReactorProject(Artifact artifact) {
+    public Optional<MavenProject> getTychoReactorProject(Artifact artifact) {
         if (isTychoReactorArtifact(artifact)) {
             String projectKey = ArtifactUtils.key(artifact.getGroupId(), artifact.getArtifactId(),
                     artifact.getVersion());
@@ -81,13 +81,20 @@ private Optional<MavenProject> getTychoReactorProject(Artifact artifact) {
         return Optional.empty();
     }
 
-    private boolean isTychoReactorArtifact(Artifact artifact) {
+    public boolean isTychoReactorArtifact(Artifact artifact) {
         if (artifact.getClassifier() == null || artifact.getClassifier().isBlank()) {
-            return PackagingType.TYCHO_PACKAGING_TYPES.contains(artifact.getProperty("type", ""));
+            return PackagingType.TYCHO_PACKAGING_TYPES.contains(getPackagingType(artifact));
         }
         return false;
     }
 
+    public String getPackagingType(Artifact artifact) {
+        if (artifact != null) {
+            return artifact.getProperty("type", "");
+        }
+        return null;
+    }
+
     @Override
     public List<String> findVersions(Artifact artifact) {
         return getTychoReactorProject(artifact).map(project -> List.of(artifact.getVersion())).orElse(List.of());

tycho-its/pom.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
- - Copyright (c) 2008, 2022 Sonatype Inc. and others.
+ - Copyright (c) 2008, 2024 Sonatype Inc. and others.
  - All rights reserved. This program and the accompanying materials
  - are made available under the terms of the Eclipse Public License v1.0
  - which accompanies this distribution, and is available at
@@ -214,6 +214,12 @@
 			<version>3.1.0</version>
 			<scope>test</scope>
 		</dependency>
+		<!-- sbom tests -->
+		<dependency>
+			<groupId>org.cyclonedx</groupId>
+			<artifactId>cyclonedx-core-java</artifactId>
+			<version>8.0.3</version>
+		</dependency>
 
 		<!-- artifacts to be tested -->
 		<dependency>

tycho-its/projects/sbom/.mvn/extensions.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<extensions>
+  <extension>
+    <groupId>org.eclipse.tycho</groupId>
+    <artifactId>tycho-build</artifactId>
+    <version>${tycho-version}</version>
+  </extension>
+</extensions>

tycho-its/projects/sbom/.mvn/maven.config

@@ -0,0 +1 @@
+-Dtycho-version=5.0.0-SNAPSHOT

tycho-its/projects/sbom/example.feature/build.properties

@@ -0,0 +1 @@
+bin.includes = feature.xml

tycho-its/projects/sbom/example.feature/feature.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<feature
+      id="example.feature"
+      label="Feature with SBOM"
+      version="1.0.0.qualifier">
+
+   <description url="http://www.example.com/description">
+      [Enter Feature Description here.]
+   </description>
+
+   <copyright url="http://www.example.com/copyright">
+      [Enter Copyright Description here.]
+   </copyright>
+
+   <license url="http://www.example.com/license">
+      [Enter License Description here.]
+   </license>
+
+   <plugin
+         id="example.plugin"
+         version="0.0.0"/>
+
+</feature>

tycho-its/projects/sbom/example.plugin/META-INF/MANIFEST.MF

@@ -0,0 +1,11 @@
+Manifest-Version: 1.0
+Bundle-ManifestVersion: 2
+Bundle-Name: Plugin with SBOM
+Bundle-SymbolicName: example.plugin
+Bundle-Version: 1.0.0.qualifier
+Require-Bundle: org.eclipse.core.databinding;bundle-version="1.13.100",
+ org.eclipse.core.databinding.beans;bundle-version="1.10.100",
+ org.eclipse.core.databinding.observable;bundle-version="1.13.100",
+ org.eclipse.core.databinding.property;bundle-version="1.10.100"
+Automatic-Module-Name: example.plugin
+Bundle-RequiredExecutionEnvironment: JavaSE-17

tycho-its/projects/sbom/example.plugin/build.properties

@@ -0,0 +1,4 @@
+source.. = src/
+output.. = bin/
+bin.includes = META-INF/,\
+               .

tycho-its/projects/sbom/pom.xml

@@ -0,0 +1,86 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<groupId>tycho-demo</groupId>
+	<artifactId>sbom</artifactId>
+	<version>1.0.0-SNAPSHOT</version>
+	<packaging>pom</packaging>
+
+	<properties>
+		<tycho-version>5.0.0-SNAPSHOT</tycho-version>
+		<tycho.sbom.url>https://www.example.p2.repo/</tycho.sbom.url>
+	</properties>
+
+	<modules>
+		<module>example.feature</module>
+		<module>example.plugin</module>
+		<module>product</module>
+		<module>repository</module>
+	</modules>
+
+	<build>
+		<plugins>
+			<plugin>
+				<groupId>org.eclipse.tycho</groupId>
+				<artifactId>tycho-maven-plugin</artifactId>
+				<version>${tycho-version}</version>
+				<extensions>true</extensions>
+			</plugin>
+			<plugin>
+				<groupId>org.eclipse.tycho</groupId>
+				<artifactId>target-platform-configuration</artifactId>
+				<version>${tycho-version}</version>
+				<configuration>
+					<target>
+						<file>../target-definition.target</file>
+					</target>
+					<environments>
+						<environment>
+							<os>linux</os>
+							<ws>gtk</ws>
+							<arch>x86_64</arch>
+						</environment>
+					</environments>
+				</configuration>
+			</plugin>
+			<plugin>
+				<groupId>org.eclipse.tycho</groupId>
+				<artifactId>tycho-packaging-plugin</artifactId>
+				<version>${tycho-version}</version>
+				<configuration>
+					<forceContextQualifier>today</forceContextQualifier>
+				</configuration>
+			</plugin>
+			<plugin>
+				<groupId>org.cyclonedx</groupId>
+				<artifactId>cyclonedx-maven-plugin</artifactId>
+				<version>2.7.9</version>
+				<configuration>
+					<includeTestScope>true</includeTestScope>
+				</configuration>
+				<executions>
+					<execution>
+						<goals>
+							<goal>makeBom</goal>
+						</goals>
+					</execution>
+				</executions>
+				<dependencies>
+					<dependency>
+						<groupId>org.eclipse.tycho</groupId>
+						<artifactId>tycho-sbom</artifactId>
+						<version>${tycho-version}</version>
+					</dependency>
+				</dependencies>
+			</plugin>
+		</plugins>
+		<pluginManagement>
+			<plugins>
+				<plugin>
+					<groupId>org.eclipse.tycho</groupId>
+					<artifactId>tycho-p2-director-plugin</artifactId>
+					<version>${tycho-version}</version>
+				</plugin>
+			</plugins>
+		</pluginManagement>		
+	</build>
+</project>

tycho-its/projects/sbom/product/example.product

@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?pde version="3.5"?>
+
+<product uid="example" version="1.0.0.qualifier" type="mixed" includeLaunchers="true" autoIncludeRequirements="false">
+
+   <configIni use="default">
+   </configIni>
+
+   <launcherArgs>
+      <vmArgsMac>-XstartOnFirstThread -Dorg.eclipse.swt.internal.carbon.smallFonts
+      </vmArgsMac>
+   </launcherArgs>
+
+   <plugins>
+      <plugin id="example.plugin"/>
+      <plugin id="org.eclipse.core.databinding"/>
+      <plugin id="org.eclipse.core.databinding.beans"/>
+      <plugin id="org.eclipse.core.databinding.observable"/>
+      <plugin id="org.eclipse.core.databinding.property"/>
+      <plugin id="org.eclipse.equinox.common"/>
+      <plugin id="org.eclipse.osgi"/>
+   </plugins>
+
+   <features>
+      <feature id="example.feature" installMode="root"/>
+   </features>
+
+
+</product>

tycho-its/projects/sbom/repository/category.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<site>
+   <feature id="example.feature"/>
+   <bundle id="example.plugin"/>
+</site>

tycho-its/projects/sbom/target-definition.target

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<?pde version="3.8"?>
+<target name="target-definition">
+	<locations>
+		<location includeAllPlatforms="false" includeConfigurePhase="true" includeMode="planner" includeSource="true" type="InstallableUnit">
+			<repository location="https://download.eclipse.org/releases/2023-12/"/>
+			<unit id="org.eclipse.sdk.feature.group" version="0.0.0"/>
+			<unit id="org.eclipse.equinox.sdk.feature.group" version="0.0.0"/>
+		</location>
+	</locations>
+</target>