Re: [PR] feature: generate sboms for all published binary jar files [grails-core]

[via GitHub]

matrei commented on code in PR #15087:
URL: https://github.com/apache/grails-core/pull/15087#discussion_r2371412078


##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']
+
+        // licenses are standardized @ https://spdx.org/licenses/
+        def licenses = [
+                'Apache-2.0' : [
+                        id: 'Apache-2.0',
+                        url: 'https://www.apache.org/licenses/LICENSE-2.0'
+                ],
+                'BSD-2-Clause' : [
+                        id: 'BSD-2-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                'BSD-3-Clause' : [
+                        id: 'BSD-3-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                // Variant of Apache 1.1 license. Approved by legal LEGAL-707
+                'OpenSymphony' : [
+                        // id is optional and the opensymphony license doesn't 
have an SPDX id
+                        name: 'The OpenSymphony Software License, Version 1.1',
+                        url: 
'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
+                ],
+                'UPL-1.0' : [
+                        id: 'UPL-1.0',
+                        url: 'https://oss.oracle.com/licenses/upl/'
+                ],
+        ]
+
+        def licenseMapping = [
+                'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 
'BSD-3-Clause', // maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // 
maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', 
// maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar' : 
'Apache-2.0', // maps incorrectly because of 
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not 
define a license
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 
'OpenSymphony', // custom license approved by legal LEGAL-707
+                'pkg:maven/org.jruby/jzlib@1.1.5?type=jar': 'BSD-3-Clause'// 
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
 shows it's a 3 clause
+        ]
+
+        // we don't distribute these so these licenses are considered 
acceptable, but we still prefer ASF licenses.
+        // Require a whitelist of any case of category X licenses to prevent 
accidental inclusion in a distributed artifact
+        // this list will need to be updated anytime we change versions so we 
can revise the licenses
+        def licenseExceptions = [
+                'grails-data-hibernate5-core': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-spring-boot': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-dbmigration': [
+                        'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 
'CDDL-1.1', // api export
+                ],
+        ]
+
+        def pickLicense = { String bomRef, List licenseChoices ->
+            if(!bomRef) {
+                throw new GradleException("No bomRef found for a dependency of 
${project.name}, cannot pick license")
+            }
+
+            logger.info('Picking license for {} from {} choices', bomRef, 
licenseChoices.size())
+            if(licenseMapping.containsKey(bomRef)) {
+                // There are several reasons that cyclone will get the license 
wrong, usually due to upstream not publishing information or publishing it 
incorrectly
+                // see the licenseMapping map above for details
+                def licenseId = licenseMapping[bomRef]
+                logger.lifecycle('Forcing license for {} to {}', bomRef, 
licenseId)
+
+                def licenseBlock = licenses[licenseId]
+                if(!licenseBlock) {

Review Comment:
   Space after `if`?



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']

Review Comment:
   Multi-line for readability?



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']
+
+        // licenses are standardized @ https://spdx.org/licenses/
+        def licenses = [
+                'Apache-2.0' : [
+                        id: 'Apache-2.0',
+                        url: 'https://www.apache.org/licenses/LICENSE-2.0'
+                ],
+                'BSD-2-Clause' : [
+                        id: 'BSD-2-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                'BSD-3-Clause' : [
+                        id: 'BSD-3-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                // Variant of Apache 1.1 license. Approved by legal LEGAL-707
+                'OpenSymphony' : [
+                        // id is optional and the opensymphony license doesn't 
have an SPDX id
+                        name: 'The OpenSymphony Software License, Version 1.1',
+                        url: 
'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
+                ],
+                'UPL-1.0' : [
+                        id: 'UPL-1.0',
+                        url: 'https://oss.oracle.com/licenses/upl/'
+                ],
+        ]
+
+        def licenseMapping = [
+                'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 
'BSD-3-Clause', // maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // 
maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', 
// maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar' : 
'Apache-2.0', // maps incorrectly because of 
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not 
define a license
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 
'OpenSymphony', // custom license approved by legal LEGAL-707
+                'pkg:maven/org.jruby/jzlib@1.1.5?type=jar': 'BSD-3-Clause'// 
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
 shows it's a 3 clause
+        ]
+
+        // we don't distribute these so these licenses are considered 
acceptable, but we still prefer ASF licenses.
+        // Require a whitelist of any case of category X licenses to prevent 
accidental inclusion in a distributed artifact
+        // this list will need to be updated anytime we change versions so we 
can revise the licenses
+        def licenseExceptions = [
+                'grails-data-hibernate5-core': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-spring-boot': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-dbmigration': [
+                        'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 
'CDDL-1.1', // api export
+                ],
+        ]
+
+        def pickLicense = { String bomRef, List licenseChoices ->
+            if(!bomRef) {

Review Comment:
   Space after `if`?



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']
+
+        // licenses are standardized @ https://spdx.org/licenses/
+        def licenses = [
+                'Apache-2.0' : [
+                        id: 'Apache-2.0',
+                        url: 'https://www.apache.org/licenses/LICENSE-2.0'
+                ],
+                'BSD-2-Clause' : [
+                        id: 'BSD-2-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                'BSD-3-Clause' : [
+                        id: 'BSD-3-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                // Variant of Apache 1.1 license. Approved by legal LEGAL-707
+                'OpenSymphony' : [
+                        // id is optional and the opensymphony license doesn't 
have an SPDX id
+                        name: 'The OpenSymphony Software License, Version 1.1',
+                        url: 
'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
+                ],
+                'UPL-1.0' : [
+                        id: 'UPL-1.0',
+                        url: 'https://oss.oracle.com/licenses/upl/'
+                ],
+        ]
+
+        def licenseMapping = [
+                'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 
'BSD-3-Clause', // maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // 
maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', 
// maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar' : 
'Apache-2.0', // maps incorrectly because of 
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not 
define a license
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 
'OpenSymphony', // custom license approved by legal LEGAL-707
+                'pkg:maven/org.jruby/jzlib@1.1.5?type=jar': 'BSD-3-Clause'// 
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
 shows it's a 3 clause
+        ]
+
+        // we don't distribute these so these licenses are considered 
acceptable, but we still prefer ASF licenses.
+        // Require a whitelist of any case of category X licenses to prevent 
accidental inclusion in a distributed artifact
+        // this list will need to be updated anytime we change versions so we 
can revise the licenses
+        def licenseExceptions = [
+                'grails-data-hibernate5-core': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-spring-boot': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-dbmigration': [
+                        'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 
'CDDL-1.1', // api export
+                ],
+        ]
+
+        def pickLicense = { String bomRef, List licenseChoices ->
+            if(!bomRef) {
+                throw new GradleException("No bomRef found for a dependency of 
${project.name}, cannot pick license")
+            }
+
+            logger.info('Picking license for {} from {} choices', bomRef, 
licenseChoices.size())
+            if(licenseMapping.containsKey(bomRef)) {
+                // There are several reasons that cyclone will get the license 
wrong, usually due to upstream not publishing information or publishing it 
incorrectly
+                // see the licenseMapping map above for details
+                def licenseId = licenseMapping[bomRef]
+                logger.lifecycle('Forcing license for {} to {}', bomRef, 
licenseId)
+
+                def licenseBlock = licenses[licenseId]
+                if(!licenseBlock) {
+                    throw new GradleException("Cannot find license information 
for id ${licenseId} to use for bomRef ${bomRef} in project ${project.name}")
+                }
+
+                return licenseBlock
+            }
+
+            if (!(licenseChoices instanceof List) || licenseChoices.isEmpty()) 
{
+                throw new GradleException("No License was found for 
dependency: ${bomRef} in project ${project.name}")
+            }
+
+            def licenseIds = licenseChoices.findAll { it instanceof Map && 
it.license instanceof Map && it.license.id }
+            def foundLicense = preferredLicenses.find { p -> licenseIds.any { 
it.license.id == p } }
+            if (foundLicense) {
+                return licenseIds.find { it.license.id == foundLicense }
+            }
+
+            def defaultLicense = licenseChoices[0] // pick the first one found
+            def defaultLicenseId = defaultLicense.license.id as String
+            if(defaultLicenseId == null) {

Review Comment:
   Space after `if`?



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']
+
+        // licenses are standardized @ https://spdx.org/licenses/
+        def licenses = [
+                'Apache-2.0' : [
+                        id: 'Apache-2.0',
+                        url: 'https://www.apache.org/licenses/LICENSE-2.0'
+                ],
+                'BSD-2-Clause' : [
+                        id: 'BSD-2-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                'BSD-3-Clause' : [
+                        id: 'BSD-3-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                // Variant of Apache 1.1 license. Approved by legal LEGAL-707
+                'OpenSymphony' : [
+                        // id is optional and the opensymphony license doesn't 
have an SPDX id
+                        name: 'The OpenSymphony Software License, Version 1.1',
+                        url: 
'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
+                ],
+                'UPL-1.0' : [
+                        id: 'UPL-1.0',
+                        url: 'https://oss.oracle.com/licenses/upl/'
+                ],
+        ]
+
+        def licenseMapping = [
+                'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 
'BSD-3-Clause', // maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // 
maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', 
// maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar' : 
'Apache-2.0', // maps incorrectly because of 
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not 
define a license
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 
'OpenSymphony', // custom license approved by legal LEGAL-707
+                'pkg:maven/org.jruby/jzlib@1.1.5?type=jar': 'BSD-3-Clause'// 
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
 shows it's a 3 clause
+        ]
+
+        // we don't distribute these so these licenses are considered 
acceptable, but we still prefer ASF licenses.
+        // Require a whitelist of any case of category X licenses to prevent 
accidental inclusion in a distributed artifact
+        // this list will need to be updated anytime we change versions so we 
can revise the licenses
+        def licenseExceptions = [
+                'grails-data-hibernate5-core': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-spring-boot': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-dbmigration': [
+                        'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 
'CDDL-1.1', // api export
+                ],
+        ]
+
+        def pickLicense = { String bomRef, List licenseChoices ->
+            if(!bomRef) {
+                throw new GradleException("No bomRef found for a dependency of 
${project.name}, cannot pick license")
+            }
+
+            logger.info('Picking license for {} from {} choices', bomRef, 
licenseChoices.size())
+            if(licenseMapping.containsKey(bomRef)) {
+                // There are several reasons that cyclone will get the license 
wrong, usually due to upstream not publishing information or publishing it 
incorrectly
+                // see the licenseMapping map above for details
+                def licenseId = licenseMapping[bomRef]
+                logger.lifecycle('Forcing license for {} to {}', bomRef, 
licenseId)
+
+                def licenseBlock = licenses[licenseId]
+                if(!licenseBlock) {
+                    throw new GradleException("Cannot find license information 
for id ${licenseId} to use for bomRef ${bomRef} in project ${project.name}")
+                }
+
+                return licenseBlock
+            }
+
+            if (!(licenseChoices instanceof List) || licenseChoices.isEmpty()) 
{
+                throw new GradleException("No License was found for 
dependency: ${bomRef} in project ${project.name}")
+            }
+
+            def licenseIds = licenseChoices.findAll { it instanceof Map && 
it.license instanceof Map && it.license.id }
+            def foundLicense = preferredLicenses.find { p -> licenseIds.any { 
it.license.id == p } }
+            if (foundLicense) {
+                return licenseIds.find { it.license.id == foundLicense }
+            }
+
+            def defaultLicense = licenseChoices[0] // pick the first one found
+            def defaultLicenseId = defaultLicense.license.id as String
+            if(defaultLicenseId == null) {
+                throw new GradleException("Could not determine License id for 
dependency: ${bomRef} in project ${project.name} for value ${defaultLicense}")
+            }
+            if(!(defaultLicenseId in preferredLicenses)) {
+                def projectLicenseExemptions = licenseExceptions[project.name] 
?: [:]
+                def permittedLicense = projectLicenseExemptions.get(bomRef) == 
defaultLicenseId
+                if(!permittedLicense) {
+                    throw new GradleException("Unpermitted License found for 
bom dependency: ${bomRef} in project ${project.name} : ${defaultLicenseId}")
+                }
+            }
+
+            return defaultLicense
+        }
+
+        // json schema is documented here: https://cyclonedx.org/docs/1.6/json/
+        def rewriteSbom = { File f ->
+            def bom = new JsonSlurper().parse(f)
+
+            // timestamp is not reproducible: 
https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/292
+            bom.metadata.timestamp = 
DateTimeFormatter.ISO_INSTANT.format(buildDate.truncatedTo(ChronoUnit.SECONDS))
+
+            // components[*].licenses
+            def comps = (bom instanceof Map && bom.components instanceof List) 
? bom.components : []
+            comps.each { c ->
+                if (c instanceof Map && c.licenses instanceof List && 
!c.licenses.isEmpty()) {
+                    def chosen = pickLicense(c['bom-ref'] as String, 
c.licenses as List)
+                    if (chosen != null) {
+                        c.licenses = [chosen]
+                    }
+                }
+            }
+
+            // force the serialNumber to be reproducible by removing it & 
recalculating
+            bom.serialNumber = ''
+            String withOutSerial = 
JsonOutput.prettyPrint(JsonOutput.toJson(bom))
+            def uuid = 
UUID.nameUUIDFromBytes(withOutSerial.getBytes(StandardCharsets.UTF_8.name()))
+            def urn = "urn:uuid:${uuid.toString()}" as String
+            bom.serialNumber = urn
+
+            f.setText(JsonOutput.prettyPrint(JsonOutput.toJson(bom)), 
StandardCharsets.UTF_8.name())
+
+            logger.info('Rewrote JSON SBOM ({}) to pick preferred license', 
project.relativePath(f))
+        }
+
+        sbomOutputLocation.get().with { rewriteSbom(it.asFile) }
+    }
+}
+
+// for now, we only publish the sbom inside of the binary jar (our bom 
projects won't have a jar file)
+pluginManager.withPlugin('java') {
+    tasks.named('assemble').configure {
+        dependsOn tasks.named('cyclonedxBom')
+    }
+
+    if (!project.findProperty('skipJavaComponent')) {
+        tasks.named('jar', Jar).configure { Jar jar ->
+            jar.dependsOn tasks.named('cyclonedxBom')

Review Comment:
   Simplify?
   ```groovy
   jar.dependsOn('cyclonedxBom')
   ```



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']
+
+        // licenses are standardized @ https://spdx.org/licenses/
+        def licenses = [
+                'Apache-2.0' : [
+                        id: 'Apache-2.0',
+                        url: 'https://www.apache.org/licenses/LICENSE-2.0'
+                ],
+                'BSD-2-Clause' : [
+                        id: 'BSD-2-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                'BSD-3-Clause' : [
+                        id: 'BSD-3-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                // Variant of Apache 1.1 license. Approved by legal LEGAL-707
+                'OpenSymphony' : [
+                        // id is optional and the opensymphony license doesn't 
have an SPDX id
+                        name: 'The OpenSymphony Software License, Version 1.1',
+                        url: 
'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
+                ],
+                'UPL-1.0' : [
+                        id: 'UPL-1.0',
+                        url: 'https://oss.oracle.com/licenses/upl/'
+                ],
+        ]
+
+        def licenseMapping = [
+                'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 
'BSD-3-Clause', // maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // 
maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', 
// maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar' : 
'Apache-2.0', // maps incorrectly because of 
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not 
define a license
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 
'OpenSymphony', // custom license approved by legal LEGAL-707
+                'pkg:maven/org.jruby/jzlib@1.1.5?type=jar': 'BSD-3-Clause'// 
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
 shows it's a 3 clause
+        ]
+
+        // we don't distribute these so these licenses are considered 
acceptable, but we still prefer ASF licenses.
+        // Require a whitelist of any case of category X licenses to prevent 
accidental inclusion in a distributed artifact
+        // this list will need to be updated anytime we change versions so we 
can revise the licenses
+        def licenseExceptions = [
+                'grails-data-hibernate5-core': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-spring-boot': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-dbmigration': [
+                        'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 
'CDDL-1.1', // api export
+                ],
+        ]
+
+        def pickLicense = { String bomRef, List licenseChoices ->
+            if(!bomRef) {
+                throw new GradleException("No bomRef found for a dependency of 
${project.name}, cannot pick license")
+            }
+
+            logger.info('Picking license for {} from {} choices', bomRef, 
licenseChoices.size())
+            if(licenseMapping.containsKey(bomRef)) {

Review Comment:
   Space after `if`?



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)

Review Comment:
   <img width="722" height="81" alt="Screenshot_20250923_093025" 
src="https://github.com/user-attachments/assets/5edf0a2a-865b-4b91-944d-4d24166377d5";
 />
   
   ```groovy
       it.setProjectType(findProperty('sbomProjectType')?.toString() ?: 
Component.Type.FRAMEWORK.name())
       i...@componentname.set(findProperty('pomArtifactId')?.toString() ?: 
project.name)
   ```
   or
   
   ```groovy
       it.setProjectType((findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name()) as String)
       i...@componentname.set((findProperty('pomArtifactId') ?: project.name) 
as String)
   ```
   
   will provide the correct type (String) to the methods.



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']
+
+        // licenses are standardized @ https://spdx.org/licenses/
+        def licenses = [
+                'Apache-2.0' : [
+                        id: 'Apache-2.0',
+                        url: 'https://www.apache.org/licenses/LICENSE-2.0'
+                ],
+                'BSD-2-Clause' : [
+                        id: 'BSD-2-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                'BSD-3-Clause' : [
+                        id: 'BSD-3-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                // Variant of Apache 1.1 license. Approved by legal LEGAL-707
+                'OpenSymphony' : [
+                        // id is optional and the opensymphony license doesn't 
have an SPDX id
+                        name: 'The OpenSymphony Software License, Version 1.1',
+                        url: 
'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
+                ],
+                'UPL-1.0' : [
+                        id: 'UPL-1.0',
+                        url: 'https://oss.oracle.com/licenses/upl/'
+                ],
+        ]
+
+        def licenseMapping = [
+                'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 
'BSD-3-Clause', // maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // 
maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', 
// maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar' : 
'Apache-2.0', // maps incorrectly because of 
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not 
define a license
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 
'OpenSymphony', // custom license approved by legal LEGAL-707
+                'pkg:maven/org.jruby/jzlib@1.1.5?type=jar': 'BSD-3-Clause'// 
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
 shows it's a 3 clause
+        ]
+
+        // we don't distribute these so these licenses are considered 
acceptable, but we still prefer ASF licenses.
+        // Require a whitelist of any case of category X licenses to prevent 
accidental inclusion in a distributed artifact
+        // this list will need to be updated anytime we change versions so we 
can revise the licenses
+        def licenseExceptions = [
+                'grails-data-hibernate5-core': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-spring-boot': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-dbmigration': [
+                        'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 
'CDDL-1.1', // api export
+                ],
+        ]
+
+        def pickLicense = { String bomRef, List licenseChoices ->
+            if(!bomRef) {
+                throw new GradleException("No bomRef found for a dependency of 
${project.name}, cannot pick license")
+            }
+
+            logger.info('Picking license for {} from {} choices', bomRef, 
licenseChoices.size())
+            if(licenseMapping.containsKey(bomRef)) {
+                // There are several reasons that cyclone will get the license 
wrong, usually due to upstream not publishing information or publishing it 
incorrectly
+                // see the licenseMapping map above for details
+                def licenseId = licenseMapping[bomRef]
+                logger.lifecycle('Forcing license for {} to {}', bomRef, 
licenseId)
+
+                def licenseBlock = licenses[licenseId]
+                if(!licenseBlock) {
+                    throw new GradleException("Cannot find license information 
for id ${licenseId} to use for bomRef ${bomRef} in project ${project.name}")
+                }
+
+                return licenseBlock
+            }
+
+            if (!(licenseChoices instanceof List) || licenseChoices.isEmpty()) 
{
+                throw new GradleException("No License was found for 
dependency: ${bomRef} in project ${project.name}")
+            }
+
+            def licenseIds = licenseChoices.findAll { it instanceof Map && 
it.license instanceof Map && it.license.id }
+            def foundLicense = preferredLicenses.find { p -> licenseIds.any { 
it.license.id == p } }
+            if (foundLicense) {
+                return licenseIds.find { it.license.id == foundLicense }
+            }
+
+            def defaultLicense = licenseChoices[0] // pick the first one found
+            def defaultLicenseId = defaultLicense.license.id as String
+            if(defaultLicenseId == null) {
+                throw new GradleException("Could not determine License id for 
dependency: ${bomRef} in project ${project.name} for value ${defaultLicense}")
+            }
+            if(!(defaultLicenseId in preferredLicenses)) {

Review Comment:
   Space after `if`?



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']
+
+        // licenses are standardized @ https://spdx.org/licenses/
+        def licenses = [
+                'Apache-2.0' : [
+                        id: 'Apache-2.0',
+                        url: 'https://www.apache.org/licenses/LICENSE-2.0'
+                ],
+                'BSD-2-Clause' : [
+                        id: 'BSD-2-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                'BSD-3-Clause' : [
+                        id: 'BSD-3-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                // Variant of Apache 1.1 license. Approved by legal LEGAL-707
+                'OpenSymphony' : [
+                        // id is optional and the opensymphony license doesn't 
have an SPDX id
+                        name: 'The OpenSymphony Software License, Version 1.1',
+                        url: 
'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
+                ],
+                'UPL-1.0' : [
+                        id: 'UPL-1.0',
+                        url: 'https://oss.oracle.com/licenses/upl/'
+                ],
+        ]
+
+        def licenseMapping = [
+                'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 
'BSD-3-Clause', // maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // 
maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', 
// maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar' : 
'Apache-2.0', // maps incorrectly because of 
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not 
define a license
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 
'OpenSymphony', // custom license approved by legal LEGAL-707
+                'pkg:maven/org.jruby/jzlib@1.1.5?type=jar': 'BSD-3-Clause'// 
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
 shows it's a 3 clause
+        ]
+
+        // we don't distribute these so these licenses are considered 
acceptable, but we still prefer ASF licenses.
+        // Require a whitelist of any case of category X licenses to prevent 
accidental inclusion in a distributed artifact
+        // this list will need to be updated anytime we change versions so we 
can revise the licenses
+        def licenseExceptions = [
+                'grails-data-hibernate5-core': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-spring-boot': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-dbmigration': [
+                        'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 
'CDDL-1.1', // api export
+                ],
+        ]
+
+        def pickLicense = { String bomRef, List licenseChoices ->
+            if(!bomRef) {
+                throw new GradleException("No bomRef found for a dependency of 
${project.name}, cannot pick license")
+            }
+
+            logger.info('Picking license for {} from {} choices', bomRef, 
licenseChoices.size())
+            if(licenseMapping.containsKey(bomRef)) {
+                // There are several reasons that cyclone will get the license 
wrong, usually due to upstream not publishing information or publishing it 
incorrectly
+                // see the licenseMapping map above for details
+                def licenseId = licenseMapping[bomRef]
+                logger.lifecycle('Forcing license for {} to {}', bomRef, 
licenseId)
+
+                def licenseBlock = licenses[licenseId]
+                if(!licenseBlock) {
+                    throw new GradleException("Cannot find license information 
for id ${licenseId} to use for bomRef ${bomRef} in project ${project.name}")
+                }
+
+                return licenseBlock
+            }
+
+            if (!(licenseChoices instanceof List) || licenseChoices.isEmpty()) 
{
+                throw new GradleException("No License was found for 
dependency: ${bomRef} in project ${project.name}")
+            }
+
+            def licenseIds = licenseChoices.findAll { it instanceof Map && 
it.license instanceof Map && it.license.id }
+            def foundLicense = preferredLicenses.find { p -> licenseIds.any { 
it.license.id == p } }
+            if (foundLicense) {
+                return licenseIds.find { it.license.id == foundLicense }
+            }
+
+            def defaultLicense = licenseChoices[0] // pick the first one found
+            def defaultLicenseId = defaultLicense.license.id as String
+            if(defaultLicenseId == null) {
+                throw new GradleException("Could not determine License id for 
dependency: ${bomRef} in project ${project.name} for value ${defaultLicense}")
+            }
+            if(!(defaultLicenseId in preferredLicenses)) {
+                def projectLicenseExemptions = licenseExceptions[project.name] 
?: [:]
+                def permittedLicense = projectLicenseExemptions.get(bomRef) == 
defaultLicenseId
+                if(!permittedLicense) {
+                    throw new GradleException("Unpermitted License found for 
bom dependency: ${bomRef} in project ${project.name} : ${defaultLicenseId}")
+                }
+            }
+
+            return defaultLicense
+        }
+
+        // json schema is documented here: https://cyclonedx.org/docs/1.6/json/
+        def rewriteSbom = { File f ->
+            def bom = new JsonSlurper().parse(f)
+
+            // timestamp is not reproducible: 
https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/292
+            bom.metadata.timestamp = 
DateTimeFormatter.ISO_INSTANT.format(buildDate.truncatedTo(ChronoUnit.SECONDS))
+
+            // components[*].licenses
+            def comps = (bom instanceof Map && bom.components instanceof List) 
? bom.components : []
+            comps.each { c ->
+                if (c instanceof Map && c.licenses instanceof List && 
!c.licenses.isEmpty()) {
+                    def chosen = pickLicense(c['bom-ref'] as String, 
c.licenses as List)
+                    if (chosen != null) {
+                        c.licenses = [chosen]
+                    }
+                }
+            }
+
+            // force the serialNumber to be reproducible by removing it & 
recalculating
+            bom.serialNumber = ''
+            String withOutSerial = 
JsonOutput.prettyPrint(JsonOutput.toJson(bom))
+            def uuid = 
UUID.nameUUIDFromBytes(withOutSerial.getBytes(StandardCharsets.UTF_8.name()))
+            def urn = "urn:uuid:${uuid.toString()}" as String
+            bom.serialNumber = urn
+
+            f.setText(JsonOutput.prettyPrint(JsonOutput.toJson(bom)), 
StandardCharsets.UTF_8.name())
+
+            logger.info('Rewrote JSON SBOM ({}) to pick preferred license', 
project.relativePath(f))
+        }
+
+        sbomOutputLocation.get().with { rewriteSbom(it.asFile) }
+    }
+}
+
+// for now, we only publish the sbom inside of the binary jar (our bom 
projects won't have a jar file)
+pluginManager.withPlugin('java') {
+    tasks.named('assemble').configure {
+        dependsOn tasks.named('cyclonedxBom')

Review Comment:
   Simplify?
   ```groovy
   dependsOn('cyclonedxBom')
   ```



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']
+
+        // licenses are standardized @ https://spdx.org/licenses/
+        def licenses = [
+                'Apache-2.0' : [
+                        id: 'Apache-2.0',
+                        url: 'https://www.apache.org/licenses/LICENSE-2.0'
+                ],
+                'BSD-2-Clause' : [
+                        id: 'BSD-2-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                'BSD-3-Clause' : [
+                        id: 'BSD-3-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                // Variant of Apache 1.1 license. Approved by legal LEGAL-707
+                'OpenSymphony' : [
+                        // id is optional and the opensymphony license doesn't 
have an SPDX id
+                        name: 'The OpenSymphony Software License, Version 1.1',
+                        url: 
'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
+                ],
+                'UPL-1.0' : [
+                        id: 'UPL-1.0',
+                        url: 'https://oss.oracle.com/licenses/upl/'
+                ],
+        ]
+
+        def licenseMapping = [
+                'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 
'BSD-3-Clause', // maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // 
maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', 
// maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar' : 
'Apache-2.0', // maps incorrectly because of 
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not 
define a license
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 
'OpenSymphony', // custom license approved by legal LEGAL-707
+                'pkg:maven/org.jruby/jzlib@1.1.5?type=jar': 'BSD-3-Clause'// 
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
 shows it's a 3 clause
+        ]
+
+        // we don't distribute these so these licenses are considered 
acceptable, but we still prefer ASF licenses.
+        // Require a whitelist of any case of category X licenses to prevent 
accidental inclusion in a distributed artifact
+        // this list will need to be updated anytime we change versions so we 
can revise the licenses
+        def licenseExceptions = [
+                'grails-data-hibernate5-core': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-spring-boot': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-dbmigration': [
+                        'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 
'CDDL-1.1', // api export
+                ],
+        ]
+
+        def pickLicense = { String bomRef, List licenseChoices ->
+            if(!bomRef) {
+                throw new GradleException("No bomRef found for a dependency of 
${project.name}, cannot pick license")
+            }
+
+            logger.info('Picking license for {} from {} choices', bomRef, 
licenseChoices.size())
+            if(licenseMapping.containsKey(bomRef)) {
+                // There are several reasons that cyclone will get the license 
wrong, usually due to upstream not publishing information or publishing it 
incorrectly
+                // see the licenseMapping map above for details
+                def licenseId = licenseMapping[bomRef]
+                logger.lifecycle('Forcing license for {} to {}', bomRef, 
licenseId)
+
+                def licenseBlock = licenses[licenseId]
+                if(!licenseBlock) {
+                    throw new GradleException("Cannot find license information 
for id ${licenseId} to use for bomRef ${bomRef} in project ${project.name}")
+                }
+
+                return licenseBlock
+            }
+
+            if (!(licenseChoices instanceof List) || licenseChoices.isEmpty()) 
{
+                throw new GradleException("No License was found for 
dependency: ${bomRef} in project ${project.name}")
+            }
+
+            def licenseIds = licenseChoices.findAll { it instanceof Map && 
it.license instanceof Map && it.license.id }
+            def foundLicense = preferredLicenses.find { p -> licenseIds.any { 
it.license.id == p } }
+            if (foundLicense) {
+                return licenseIds.find { it.license.id == foundLicense }
+            }
+
+            def defaultLicense = licenseChoices[0] // pick the first one found
+            def defaultLicenseId = defaultLicense.license.id as String
+            if(defaultLicenseId == null) {
+                throw new GradleException("Could not determine License id for 
dependency: ${bomRef} in project ${project.name} for value ${defaultLicense}")
+            }
+            if(!(defaultLicenseId in preferredLicenses)) {
+                def projectLicenseExemptions = licenseExceptions[project.name] 
?: [:]
+                def permittedLicense = projectLicenseExemptions.get(bomRef) == 
defaultLicenseId
+                if(!permittedLicense) {
+                    throw new GradleException("Unpermitted License found for 
bom dependency: ${bomRef} in project ${project.name} : ${defaultLicenseId}")
+                }
+            }
+
+            return defaultLicense
+        }
+
+        // json schema is documented here: https://cyclonedx.org/docs/1.6/json/
+        def rewriteSbom = { File f ->
+            def bom = new JsonSlurper().parse(f)
+
+            // timestamp is not reproducible: 
https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/292
+            bom.metadata.timestamp = 
DateTimeFormatter.ISO_INSTANT.format(buildDate.truncatedTo(ChronoUnit.SECONDS))
+
+            // components[*].licenses
+            def comps = (bom instanceof Map && bom.components instanceof List) 
? bom.components : []
+            comps.each { c ->
+                if (c instanceof Map && c.licenses instanceof List && 
!c.licenses.isEmpty()) {
+                    def chosen = pickLicense(c['bom-ref'] as String, 
c.licenses as List)
+                    if (chosen != null) {
+                        c.licenses = [chosen]
+                    }
+                }
+            }
+
+            // force the serialNumber to be reproducible by removing it & 
recalculating
+            bom.serialNumber = ''
+            String withOutSerial = 
JsonOutput.prettyPrint(JsonOutput.toJson(bom))
+            def uuid = 
UUID.nameUUIDFromBytes(withOutSerial.getBytes(StandardCharsets.UTF_8.name()))
+            def urn = "urn:uuid:${uuid.toString()}" as String
+            bom.serialNumber = urn
+
+            f.setText(JsonOutput.prettyPrint(JsonOutput.toJson(bom)), 
StandardCharsets.UTF_8.name())
+
+            logger.info('Rewrote JSON SBOM ({}) to pick preferred license', 
project.relativePath(f))
+        }
+
+        sbomOutputLocation.get().with { rewriteSbom(it.asFile) }
+    }
+}
+
+// for now, we only publish the sbom inside of the binary jar (our bom 
projects won't have a jar file)
+pluginManager.withPlugin('java') {
+    tasks.named('assemble').configure {
+        dependsOn tasks.named('cyclonedxBom')
+    }
+
+    if (!project.findProperty('skipJavaComponent')) {
+        tasks.named('jar', Jar).configure { Jar jar ->

Review Comment:
   Type is redundant?
   ```groovy
   tasks.named('jar').configure { Jar jar ->
   ```



##########
gradle/sbom-config.gradle:
##########
@@ -0,0 +1,242 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import org.cyclonedx.gradle.CycloneDxTask
+import org.cyclonedx.model.ExternalReference
+import org.cyclonedx.model.LicenseChoice
+import org.cyclonedx.model.License
+import org.cyclonedx.model.OrganizationalContact
+import org.cyclonedx.model.OrganizationalEntity
+import org.cyclonedx.model.Component
+
+import java.nio.charset.StandardCharsets
+import java.time.format.DateTimeFormatter
+import java.time.temporal.ChronoUnit
+
+apply plugin: 'org.cyclonedx.bom'
+
+project.ext.setProperty('sbomOutputLocation', 
project.layout.buildDirectory.file("${findProperty('pomArtifactId') ?: 
project.name}-${projectVersion}-sbom.json"))
+
+def sbomTask = tasks.named('cyclonedxBom', CycloneDxTask)
+sbomTask.configure { CycloneDxTask it ->
+    // the 2.x version of Cyclonedx uses a legacy syntax & helpers for setting 
inputs so the syntax below
+    // is required until the 3.x version is GA
+    it.setProjectType(findProperty('sbomProjectType') ?: 
Component.Type.FRAMEWORK.name())
+    i...@componentname.set(findProperty('pomArtifactId') ?: project.name)
+    i...@organizationalentity.set(new OrganizationalEntity().tap {
+        name = 'Apache Software Foundation'
+        urls = ['https://www.apache.org/', 'https://security.apache.org/']
+        addContact(new OrganizationalContact().tap {
+            name = 'Apache Grails Development Team'
+            email = 'd...@grails.apache.org'
+        })
+    })
+    i...@licensechoice.set(new LicenseChoice().tap {
+        addLicense(new License().tap {
+            name = 'Apache-2.0'
+            url = 'https://www.apache.org/licenses/LICENSE-2.0.txt'
+        })
+    })
+
+    i...@externalreferences.set([
+            new ExternalReference().tap {
+                url = 'https://grails.apache.org/'
+                type = ExternalReference.Type.WEBSITE
+            }
+    ])
+
+    // sboms are published for the purposes of vulnerability analysis so only 
include the runtime classpath
+    i...@includeconfigs.set(['runtimeClasspath'])
+    i...@skipconfigs.set(['compileClasspath', 'testRuntimeClasspath'])
+
+    // turn off license text since it's base64 encoded & will inflate the jar 
sizes
+    i...@includelicensetext.set(false)
+
+    // disable xml output
+    it.xmlOutput.unsetConvention()
+
+    def sbomOutputLocation = findProperty('sbomOutputLocation')
+    it.jsonOutput.set(sbomOutputLocation.get())
+    it.outputs.file(sbomOutputLocation)
+
+    // cyclonedx does not support "choosing" the license placed in the sbom
+    // see: https://github.com/CycloneDX/cyclonedx-gradle-plugin/issues/16
+    it.doLast {
+        // ordered so that first value is the most preferred, this list is 
from https://www.apache.org/legal/resolved.html
+        def preferredLicenses = ['Apache-2.0', 'EPL-1.0', 'BSD-3-Clause', 
'EPL-2.0', 'MIT', 'MIT-0', '0BSD', 'UPL-1.0', 'CC0-1.0', 'ICU', 'Xnet', 'NCSA', 
'W3C', 'Zlib', 'AFL-3.0', 'MS-PL', 'PSF-2.0', 'APAFML', 'BSL-1.0', 'WTFPL', 
'Unlicense', 'HPND', 'EPICS', 'TCL']
+
+        // licenses are standardized @ https://spdx.org/licenses/
+        def licenses = [
+                'Apache-2.0' : [
+                        id: 'Apache-2.0',
+                        url: 'https://www.apache.org/licenses/LICENSE-2.0'
+                ],
+                'BSD-2-Clause' : [
+                        id: 'BSD-2-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                'BSD-3-Clause' : [
+                        id: 'BSD-3-Clause',
+                        url: 'https://opensource.org/license/bsd-3-clause/'
+                ],
+                // Variant of Apache 1.1 license. Approved by legal LEGAL-707
+                'OpenSymphony' : [
+                        // id is optional and the opensymphony license doesn't 
have an SPDX id
+                        name: 'The OpenSymphony Software License, Version 1.1',
+                        url: 
'https://raw.githubusercontent.com/sitemesh/sitemesh2/refs/heads/master/LICENSE.txt'
+                ],
+                'UPL-1.0' : [
+                        id: 'UPL-1.0',
+                        url: 'https://oss.oracle.com/licenses/upl/'
+                ],
+        ]
+
+        def licenseMapping = [
+                'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar' : 
'BSD-3-Clause', // maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/jline/jline@2.14.6?type=jar' : 'BSD-2-Clause', // 
maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                'pkg:maven/org.jline/jline@3.23.0?type=jar' : 'BSD-2-Clause', 
// maps incorrectly because of 
https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+                
'pkg:maven/org.liquibase.ext/liquibase-hibernate5@4.27.0?type=jar' : 
'Apache-2.0', // maps incorrectly because of 
https://github.com/liquibase/liquibase/issues/2445 & the base pom does not 
define a license
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                
'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom' : 'UPL-1.0', 
// does not have map based on license id
+                'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar' : 
'OpenSymphony', // custom license approved by legal LEGAL-707
+                'pkg:maven/org.jruby/jzlib@1.1.5?type=jar': 'BSD-3-Clause'// 
https://web.archive.org/web/20240822213507/http://www.jcraft.com/jzlib/LICENSE.txt
 shows it's a 3 clause
+        ]
+
+        // we don't distribute these so these licenses are considered 
acceptable, but we still prefer ASF licenses.
+        // Require a whitelist of any case of category X licenses to prevent 
accidental inclusion in a distributed artifact
+        // this list will need to be updated anytime we change versions so we 
can revise the licenses
+        def licenseExceptions = [
+                'grails-data-hibernate5-core': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-spring-boot': [
+                        
'pkg:maven/org.hibernate.common/hibernate-commons-annotations@5.1.2.Final?type=jar':
 'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                        
'pkg:maven/org.hibernate/hibernate-core-jakarta@5.6.15.Final?type=jar': 
'LGPL-2.1-only', // hibernate 5 is LGPL, we are migrating to ASF license in 
hibernate 7
+                ],
+                'grails-data-hibernate5-dbmigration': [
+                        'pkg:maven/javax.xml.bind/jaxb-api@2.3.1?type=jar': 
'CDDL-1.1', // api export
+                ],
+        ]
+
+        def pickLicense = { String bomRef, List licenseChoices ->
+            if(!bomRef) {
+                throw new GradleException("No bomRef found for a dependency of 
${project.name}, cannot pick license")
+            }
+
+            logger.info('Picking license for {} from {} choices', bomRef, 
licenseChoices.size())
+            if(licenseMapping.containsKey(bomRef)) {
+                // There are several reasons that cyclone will get the license 
wrong, usually due to upstream not publishing information or publishing it 
incorrectly
+                // see the licenseMapping map above for details
+                def licenseId = licenseMapping[bomRef]
+                logger.lifecycle('Forcing license for {} to {}', bomRef, 
licenseId)
+
+                def licenseBlock = licenses[licenseId]
+                if(!licenseBlock) {
+                    throw new GradleException("Cannot find license information 
for id ${licenseId} to use for bomRef ${bomRef} in project ${project.name}")
+                }
+
+                return licenseBlock
+            }
+
+            if (!(licenseChoices instanceof List) || licenseChoices.isEmpty()) 
{
+                throw new GradleException("No License was found for 
dependency: ${bomRef} in project ${project.name}")
+            }
+
+            def licenseIds = licenseChoices.findAll { it instanceof Map && 
it.license instanceof Map && it.license.id }
+            def foundLicense = preferredLicenses.find { p -> licenseIds.any { 
it.license.id == p } }
+            if (foundLicense) {
+                return licenseIds.find { it.license.id == foundLicense }
+            }
+
+            def defaultLicense = licenseChoices[0] // pick the first one found
+            def defaultLicenseId = defaultLicense.license.id as String
+            if(defaultLicenseId == null) {
+                throw new GradleException("Could not determine License id for 
dependency: ${bomRef} in project ${project.name} for value ${defaultLicense}")
+            }
+            if(!(defaultLicenseId in preferredLicenses)) {
+                def projectLicenseExemptions = licenseExceptions[project.name] 
?: [:]
+                def permittedLicense = projectLicenseExemptions.get(bomRef) == 
defaultLicenseId
+                if(!permittedLicense) {

Review Comment:
   Space after `if`?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscr...@grails.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org