This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/ant-antlibs-cyclonedx.git
The following commit(s) were added to refs/heads/main by this push:
new 8cd3b19 update cyclonedx-core-java which dropped its commons
dependencies
8cd3b19 is described below
commit 8cd3b1911824ca57dfe1649e41a60df0fd7f2a84
Author: Stefan Bodewig <[email protected]>
AuthorDate: Tue Aug 25 07:32:41 2026 +0200
update cyclonedx-core-java which dropped its commons dependencies
---
changes.xml | 2 +-
docs/index.html | 6 +-----
ivy.xml | 3 +--
project-template.pom | 2 +-
.../org/apache/ant/cyclonedx/ComponentBomTask.java | 19 ++++++++++++++++---
5 files changed, 20 insertions(+), 12 deletions(-)
diff --git a/changes.xml b/changes.xml
index f5bd076..a34da27 100644
--- a/changes.xml
+++ b/changes.xml
@@ -92,7 +92,7 @@
sort order to support reproducible builds.
</action>
<action type="update">
- Updated cyclonedx-java-core library dependency to 13.0.0.
+ Updated cyclonedx-java-core library dependency to 13.2.0.
</action>
<action type="update">
The default SBOM version now is 1.7 and the isExternal attribute
diff --git a/docs/index.html b/docs/index.html
index c3ee445..96e3175 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -91,11 +91,7 @@ <h2>Requirements and Dependencies of this Ant Library</h2>
<p>The only direct dependency
is <a href="https://github.com/CycloneDX/cyclonedx-core-java";>CycloneDX
Core (Java)</a> but this in turn transitively depends on
- commons-io, commons-lang3, commons-collections4 and
- commons-codec of
- the <a href="https://commons.apache.org/";>Apache Commons</a>
- project as well
- as <a href="https://github.com/package-url/packageurl-java";>Package
+ <a href="https://github.com/package-url/packageurl-java";>Package
URL (purl) for Java</a>. It also depends
on <a href="https://github.com/FasterXML/jackson";>Jackson</a>
and <a href="https://github.com/FasterXML/woodstox/";>woodstox</a>
diff --git a/ivy.xml b/ivy.xml
index 6bfb907..6885686 100644
--- a/ivy.xml
+++ b/ivy.xml
@@ -58,11 +58,10 @@
<artifact name="${artifact.name}" type="cyclonedx.json.asc"
ext="cdx.json.asc"/>
</publications>
<dependencies>
- <dependency org="org.cyclonedx" name="cyclonedx-core-java" rev="13.1.0"
conf="default"/>
+ <dependency org="org.cyclonedx" name="cyclonedx-core-java" rev="13.2.0"
conf="default"/>
<dependency org="org.apache.ant" name="ant" rev="1.10.17"
conf="provided->default"/>
<dependency org="org.apache.ant" name="ant-launcher" rev="1.10.17"
conf="provided->default"/>
<dependency org="org.apache.ivy" name="ivy" rev="2.6.0"
conf="provided->default"/>
- <dependency org="commons-codec" name="commons-codec" rev="1.22.1"
conf="default"/>
<dependency org="org.apache.ant" name="ant-antunit" rev="1.5.0"
conf="test->default"/>
</dependencies>
</ivy-module>
diff --git a/project-template.pom b/project-template.pom
index 0838d92..4a3b0fa 100644
--- a/project-template.pom
+++ b/project-template.pom
@@ -73,7 +73,7 @@
<dependency>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-core-java</artifactId>
- <version>13.1.0</version>
+ <version>13.2.0</version>
<scope>compile</scope>
</dependency>
<dependency>
diff --git a/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
b/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
index f74584b..179b994 100644
--- a/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
+++ b/src/main/org/apache/ant/cyclonedx/ComponentBomTask.java
@@ -22,6 +22,8 @@ import java.io.FileOutputStream;
import java.io.IOException;
import java.io.OutputStreamWriter;
import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
import java.util.AbstractMap;
import java.util.ArrayList;
import java.util.Collections;
@@ -44,8 +46,6 @@ import org.apache.tools.ant.Task;
import org.apache.tools.ant.types.Resource;
import org.apache.tools.ant.types.ResourceCollection;
import org.apache.tools.ant.types.resources.Union;
-import org.apache.commons.codec.digest.DigestUtils;
-import org.apache.commons.codec.digest.MessageDigestAlgorithms;
import org.cyclonedx.Format;
import org.cyclonedx.exception.GeneratorException;
@@ -377,7 +377,7 @@ public class ComponentBomTask extends Task {
+ ":" + (component.getGroup() == null ? "group" :
component.getGroup())
+ ":" + (component.getVersion() == null ? "group" :
component.getVersion());
}
- byte[] componentIdHash = new
DigestUtils(MessageDigestAlgorithms.MD5).digest(componentId);
+ byte[] componentIdHash = digest(componentId);
long clockseq = ((long)(componentIdHash[0] & 0x3F) << 56) |
((long)(componentIdHash[1] & 0xFF) << 48);
long nodeLow = ((componentIdHash[2] & 0xFFl) << 40) |
((long)(componentIdHash[3] & 0xFF) << 32);
long nodeHigh = ((componentIdHash[4] & 0xFFl) << 24) |
((componentIdHash[5] & 0xFF) << 16)
@@ -387,6 +387,19 @@ public class ComponentBomTask extends Task {
return new UUID(msb, lsb);
}
+ private byte[] digest(String s) {
+ try {
+ MessageDigest messageDigest = MessageDigest.getInstance("MD5");
+ if (messageDigest == null) {
+ throw new BuildException("Unable to create Message Digest",
getLocation());
+ }
+ messageDigest.update(s.getBytes(StandardCharsets.UTF_8));
+ return messageDigest.digest();
+ } catch (NoSuchAlgorithmException noalgo) {
+ throw new BuildException(noalgo, getLocation());
+ }
+ }
+
private Metadata createMetadata(Date timestamp) throws IOException {
Metadata meta = new Metadata();
meta.setTimestamp(timestamp);
