zch93 opened a new pull request, #200: URL: https://github.com/apache/flink-ml/pull/200
## What is the purpose of the change The original PR which modified the flink-parent: #https://github.com/apache/flink/pull/21606 This PR aims to publish SBOM artifacts. - Here is an article to give some context: [article](https://www.activestate.com/blog/why-the-us-government-is-mandating-software-bill-of-materials-sbom/) Software Bill of Materials (SBOM) are additional artifacts containing the aggregate of all direct and transitive dependencies of a project. The US Government (based on NIST recommendations) currently accepts only the three most popular SBOM standards as valid, namely: [CycloneDX](https://cyclonedx.org/), [Software Identification (SWID) tag](https://csrc.nist.gov/projects/Software-Identification-SWID), [Software Package Data Exchange® (SPDX)](https://spdx.dev/). This PR uses [CycloneDX maven plugin](https://github.com/CycloneDX/cyclonedx-maven-plugin), a lightweight software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis. BOM files get automatically published on maven deploy. ## Brief change log - Add `cyclonedx-maven-plugin plugin` to the `flink-connector-parent` pom ## Verifying this change Each `jar` file will have two corresponding files: `xxx-cyclonedx.xml` and `xxx-cyclonedx.json` :tada: Example: ``` $ mvn install -DskipTests ... [INFO] Installing /Users/zsomborchikan/Desktop/flink_upstream/flink-ml/flink-ml-dist/target/bom.xml to /Users/zsomborchikan/.m2/repository/org/apache/flink/flink-ml-dist/2.2-SNAPSHOT/flink-ml-dist-2.2-SNAPSHOT-cyclonedx.xml [INFO] Installing /Users/zsomborchikan/Desktop/flink_upstream/flink-ml/flink-ml-dist/target/bom.json to /Users/zsomborchikan/.m2/repository/org/apache/flink/flink-ml-dist/2.2-SNAPSHOT/flink-ml-dist-2.2-SNAPSHOT-cyclonedx.json [INFO] Installing /Users/zsomborchikan/Desktop/flink_upstream/flink-ml/flink-ml-dist/target/flink-ml-dist-2.2-SNAPSHOT-tests.jar to /Users/zsomborchikan/.m2/repository/org/apache/flink/flink-ml-dist/2.2-SNAPSHOT/flink-ml-dist-2.2-SNAPSHOT-tests.jar [INFO] ------------------------------------------------------------------------ [INFO] Reactor Summary for Flink ML 2.2-SNAPSHOT: [INFO] [INFO] Flink ML ........................................... SUCCESS [ 7.690 s] [INFO] Flink ML : Iteration ............................... SUCCESS [ 17.761 s] [INFO] Flink ML : Core .................................... SUCCESS [ 7.089 s] [INFO] Flink ML : Lib ..................................... SUCCESS [ 8.036 s] [INFO] Flink ML : Tests ................................... SUCCESS [ 1.534 s] [INFO] Flink ML : Benchmark ............................... SUCCESS [ 2.212 s] [INFO] Flink ML : Uber .................................... SUCCESS [ 2.592 s] [INFO] Flink ML : Examples ................................ SUCCESS [ 2.629 s] [INFO] flink-ml-python .................................... SUCCESS [ 1.607 s] [INFO] Flink ML : Dist .................................... SUCCESS [ 2.706 s] [INFO] ------------------------------------------------------------------------ [INFO] BUILD SUCCESS [INFO] ------------------------------------------------------------------------ $ ls -la /Users/zsomborchikan/.m2/repository/org/apache/flink/flink-ml-dist/2.2-SNAPSHOT drwxr-xr-x@ 9 zsomborchikan staff 288 Jan 14 10:47 . drwxr-xr-x@ 4 zsomborchikan staff 128 Jan 14 10:44 .. -rw-r--r--@ 1 zsomborchikan staff 332 Jan 14 10:47 _remote.repositories -rw-r--r--@ 1 zsomborchikan staff 165270 Jan 14 10:47 flink-ml-dist-2.2-SNAPSHOT-cyclonedx.json -rw-r--r--@ 1 zsomborchikan staff 146739 Jan 14 10:47 flink-ml-dist-2.2-SNAPSHOT-cyclonedx.xml -rw-r--r--@ 1 zsomborchikan staff 464 Jan 14 10:47 flink-ml-dist-2.2-SNAPSHOT-tests.jar -rw-r--r--@ 1 zsomborchikan staff 9647 Jan 14 10:47 flink-ml-dist-2.2-SNAPSHOT.jar -rw-r--r--@ 1 zsomborchikan staff 3708 Jan 12 15:53 flink-ml-dist-2.2-SNAPSHOT.pom -rw-r--r--@ 1 zsomborchikan staff 1321 Jan 14 10:47 maven-metadata-local.xml ``` ## Does this pull request potentially affect one of the following parts: - Dependencies (does it add or upgrade a dependency): Yes, but it's plugin dependency. - The public API, i.e., is any changed class annotated with @Public(Evolving): No ## Documentation - Does this pull request introduce a new feature? No - If yes, how is the feature documented? N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
