8000 Distribution SBOM generation by aloubyansky · Pull Request #51743 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Distribution SBOM generation #51743

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aloubyansky wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Distribution SBOM generation #51743

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion js/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "root",
"private": true,
"type": "module",
"packageManager": "pnpm@11.1.1",
"packageManager": "pnpm@11.21.0",
@aloubyansky aloubyansky Aug 14, 2026
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was necessary to get the latest pnpm sbom generator.

@michalvavrik michalvavrik Aug 17, 2026
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was necessary to get the latest pnpm sbom generator.

@edewit is this fine, please?

"scripts": {
"prepare": "cd .. && husky js/.husky",
"build": "wireit"
Expand Down
15 changes: 14 additions & 1 deletion js/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@

<properties>
<node.version>v24.9.0</node.version>
<pnpm.version>11.1.1</pnpm.version>
<pnpm.version>11.21.0</pnpm.version>
<!-- The JavaScript projects use non-standard folders for their sources, therefore, name it here explicitly -->
<maven.build.cache.input.1>src</maven.build.cache.input.1>
<maven.build.cache.input.2>public</maven.build.cache.input.2>
Expand Down Expand Up @@ -124,6 +124,19 @@
<arguments>build</arguments>
</configuration>
</execution>
<execution>
<id>generate-js-sbom</id>
<phase>package</phase>
<goals>
<goal>pnpm</goal>
</goals>
<configuration>
<!-- Generate an SBOM for the NPM packages.
-prod argument excludes non-production dependencies. W/o it non-production dependencies
will appear with scope 'excluded', meaning excluded from runtime -->
<arguments>sbom --sbom-format cyclonedx --prod --filter !create-keycloak-theme --filter !keycloak-server --out ${project.build.directory}/js-sbom.cdx.json</arguments>
</configuration>
</execution>
</executions>
</plugin>
<!-- newer versions of pnpm do not have an executable cjs file, see https://github.com/eirslett/frontend-maven-plugin/issues/1224 -->
Expand Down
22 changes: 22 additions & 0 deletions quarkus/dist/assembly.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,9 @@
<includes>
<include>**/**</include>
</includes>
<excludes>
<exclude>*-cyclonedx.json</exclude>
</excludes>
</fileSet>
<fileSet>
<directory>src/main/content/conf</directory>
Expand Down Expand Up @@ -115,4 +118,23 @@
</file>
</files>

<!-- Generate an SBOM for the assembly archive -->
<containerDescriptorHandlers>
<containerDescriptorHandler>
<handlerName>sbom</handlerName>
<configuration>
<!-- External SBOMs to merge -->
<externalSboms>../../js/target/js-sbom.cdx.json,../server/target/lib/quarkus-run-cyclonedx.json</externalSboms>
<!-- Where to store the SBOM: embedded - as an archive entry, external - as an external file, all - both -->
<outputMode>all</outputMode>
<!-- Whether to manifest libraries only, skipping miscellaneous files
<librariesOnly>true</librariesOnly-->
<!-- Whether to pretty-print the JSON
<prettyPrint>true</prettyPrint-->
<!-- Whether to attach external SBOM file as a Maven artifact
<attach>true</attach-->
</configuration>
</containerDescriptorHandler>
</containerDescriptorHandlers>

</assembly>
7 changes: 7 additions & 0 deletions quarkus/dist/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,13 @@
</configuration>
</execution>
</executions>
<dependencies>
<dependency>
<groupId>dev.cyberstamp.maven.assembly.sbom</groupId>
<artifactId>assembly-sbom-handler</artifactId>
<version>0.1.2</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</build>
Expand Down
7 changes: 7 additions & 0 deletions quarkus/server/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,12 +50,18 @@
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>io.quarkus</groupId>
<artifactId>quarkus-cyclonedx</artifactId>
@michalvavrik michalvavrik Aug 17, 2026
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aloubyansky do I understand it right that this extension is not supported downstream https://code.quarkus.redhat.com/?e=cyclonedx&extension-search=cyclo ? Is there any plan to support it, maybe in 3.40 or 4.0?

@aloubyansky aloubyansky Aug 17, 2026 •
edited
Loading
Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question. I thought it had some support scope but apparently it doesn't. Probably because it's "build time only", which shouldn't matter.
It's been rebuilt from source though since 3.15
https://maven.repository.redhat.com/ga/io/quarkus/quarkus-cyclonedx/
https://maven.repository.redhat.com/ga/io/quarkus/quarkus-cyclonedx-deployment/

@michalvavrik michalvavrik Aug 17, 2026
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question. I thought it had some support scope but apparently it doesn't. Probably because it's "build time only", which shouldn't matter. It's been rebuilt from source though since 3.15 https://maven.repository.redhat.com/ga/io/quarkus/quarkus-cyclonedx/ https://maven.repository.redhat.com/ga/io/quarkus/quarkus-cyclonedx-deployment/

Ok, thanks. I think it should be fine, but we need to hear from others or I'll ask around.

</dependency>
</dependencies>

<properties>
<!-- define this as a property, so it can still be overwritten on the CLI -->
<!-- direct the auto-created files to the target folder, so they are cleaned by "mvn clean" -->
<kc.home.dir>${project.build.directory}/kc</kc.home.dir>
<!-- Enable Quarkus SBOM generation for this build -->
<quarkus.cyclonedx.enabled>true</quarkus.cyclonedx.enabled>
</properties>

<build>
Expand All @@ -81,6 +87,7 @@
<kc.home.dir>${kc.home.dir}</kc.home.dir>
<kc.db>dev-file</kc.db>
<java.util.concurrent.ForkJoinPool.common.threadFactory>io.quarkus.bootstrap.forkjoin.QuarkusForkJoinWorkerThreadFactory</java.util.concurrent.ForkJoinPool.common.threadFactory>
<quarkus.cyclonedx.enabled>${quarkus.cyclonedx.enabled}</quarkus.cyclonedx.enabled>
</systemProperties>
</configuration>
<executions>
Expand Down
5 changes: 4 additions & 1 deletion quarkus/server/src/main/resources/application.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,7 @@ quarkus.package.output-name=keycloak
quarkus.package.jar.type=mutable-jar
quarkus.package.output-directory=lib
quarkus.package.jar.user-providers-directory=../providers
quarkus.package.main-class=keycloak
quarkus.package.main-class=keycloak

# disable Quarkus SBOM generation by default, for re-augmentation specifically
quarkus.cyclonedx.enabled=false
0