Skip to content

fix(sbom): mix projectPath into deterministic UUID seed #15614

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jamesfredley merged 6 commits into from
May 2, 2026
+31 −3
Merged

fix(sbom): mix projectPath into deterministic UUID seed #15614

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d6a80e0
fix(sbom): mix projectPath into deterministic UUID seed
jamesfredley Apr 30, 2026
462b2f8
fix(sbom): address Copilot review feedback
jamesfredley Apr 30, 2026
4d1a78f
fix(sbom): also fix UUID collisions in com.gradleup.shadow fat jars
jamesfredley May 1, 2026
23f586d
fix(sbom): move shadow jar SBOM wiring into grails-cli build.gradle
jamesfredley May 1, 2026
1144b74
fix(sbom): address jdaugherty review feedback
jamesfredley May 2, 2026
0453de0
Merge branch '8.0.x' into fix/sbom-uuid-collision-gradle-9
jamesfredley May 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -261,10 +261,20 @@ class SbomPlugin implements Plugin<Project> {
}
}

// force the serialNumber to be reproducible by removing it & recalculating
// force the serialNumber to be reproducible by clearing it & recalculating.
// Mix the projectPath into the UUID seed so two modules whose post-processed
// BOM JSON happens to be identical (for example, empty BOM platforms with no
// runtime dependencies, or modules whose metadata.component is filled in
// identically by the CycloneDX plugin) still receive distinct serialNumbers
// as required by the CycloneDX specification. Including projectPath preserves
// reproducibility because the same project path + same content always yields
// the same UUID across rebuilds. This guards against collisions introduced by
// CycloneDX 3.0.0 / Gradle 9 metadata changes.
// See: https://cyclonedx.org/docs/1.6/json/#serialNumber
bom['serialNumber'] = ''
def withOutSerial = JsonOutput.prettyPrint(JsonOutput.toJson(bom))
def uuid = UUID.nameUUIDFromBytes(withOutSerial.getBytes(StandardCharsets.UTF_8.name()))
def withoutSerial = JsonOutput.prettyPrint(JsonOutput.toJson(bom))
def uuidSeed = "${projectPath}\n${withoutSerial}"
def uuid = UUID.nameUUIDFromBytes(uuidSeed.getBytes(StandardCharsets.UTF_8))
bom['serialNumber'] = "urn:uuid:$uuid".toString()

f.setText(JsonOutput.prettyPrint(JsonOutput.toJson(bom)), StandardCharsets.UTF_8.name())
Expand Down
1 change: 1 addition & 0 deletions grails-forge/grails-cli-shadow/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ shadowJarTask.configure { ShadowJar it ->

it.exclude(
'META-INF/DEPENDENCIES', // until we publish our own SBOM, this won't be correct so exclude
'META-INF/sbom.json', // intermediate build, exclude conflicting files
'about.html' // restatement of the Eclipse Distribution License - Version 1.0 for jakarta
)
}
17 changes: 17 additions & 0 deletions grails-forge/grails-cli/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ import com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar
import org.apache.grails.forge.buildlogic.shadowjar.GrailsGroovyExtensionTransformer
import org.apache.grails.forge.buildlogic.shadowjar.GrailsShadowLicenseTransform
import org.apache.grails.forge.buildlogic.shadowjar.GrailsShadowNoticeTransform
import org.cyclonedx.gradle.CyclonedxDirectTask

plugins {
id 'groovy'
Expand Down Expand Up @@ -122,8 +123,24 @@ shadowJarTask.configure { ShadowJar it ->
'META-INF/DEPENDENCIES', // until we publish our own SBOM, this won't be correct so exclude
'META-INF/grails-plugin.xml', // we do not start or compile a grails application so these files are not needed (grails-core, url mappings, etc plugins)
'META-INF/grails-plugin.xml.asc', // avoid signing artifacts
'META-INF/sbom.json', // re-introduced below from this project's own cyclonedxDirectBom output to avoid the wrong transitive SBOM winning the shadow merge
'about.html' // restatement of the Eclipse Distribution License - Version 1.0 for jakarta
)

// Re-introduce this project's own SBOM into the fat jar (mirrors org.apache.grails.buildsrc.sbom).
if (!project.findProperty('skipJavaComponent')) {
TaskProvider<CyclonedxDirectTask> cyclonedxDirectBomTask = tasks.named('cyclonedxDirectBom', CyclonedxDirectTask)
it.from(cyclonedxDirectBomTask) { CopySpec spec ->
spec.into('META-INF')
spec.rename {
'sbom.json'
}
}
it.manifest { Manifest manifest ->
manifest.attributes('Sbom-Location': 'META-INF/sbom.json')
Copy link
Copy Markdown
Contributor

@jdaugherty jdaugherty May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this added by the cyclonedx plugin already? Did you check the manifest files? Do we do this anywhere else?

Copy link
Copy Markdown
Contributor Author

@jamesfredley jamesfredley May 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I checked all three:

  1. Is this added by the cyclonedx plugin already? No. Searched the cyclonedx-gradle-plugin source (3.0.x and master) for Sbom-Location / Sbom-Format and there are zero hits - the plugin does not touch the jar manifest at all.

  2. Did you check the manifest files? Yes. Extracted META-INF/MANIFEST.MF from grails-cli-8.0.0-SNAPSHOT.jar (regular) and -all.jar (fat) after --rerun-tasks:

    • Sbom-Location: META-INF/sbom.json
    • Sbom-Format: CycloneDX

    Without the explicit manifest { ... } block on the shadowJar configure, those entries vanish from the fat jar (shadow merges manifests but does not regenerate the SBOM-pointing entries).

  3. Do we do this anywhere else? Yes - SbomPlugin.publishSbomForJarProjects adds the same two attributes to the regular jar in the same module (lines 389-392). The shadow-jar wiring intentionally mirrors that to keep both jars discoverable by downstream SBOM consumers via the standard manifest header.

Left the manifest block in place; the entries are validated to appear in the output.

manifest.attributes('Sbom-Format': 'CycloneDX')
}
}
}
// Make shadow jar a direct dependency of assemble instead of using deprecated archives configuration
tasks.named('assemble').configure {
Expand Down
Loading