jamesfredley commented on PR #15625: URL: https://github.com/apache/grails-core/pull/15625#issuecomment-4365054096
### Pivot: drop the aggregate SBOM rather than make it reproducible Pushed [`95b7d83`](https://github.com/apache/grails-core/pull/15625/commits/95b7d83968) which changes the approach to Fix #2 after looking at this from a different angle. The PR title and description have been updated to reflect the new direction. **Original Fix #2**: port the direct-task reproducibility transforms (timestamp pinning, `build-system` externalReference strip, deterministic `serialNumber`) onto the aggregate task so `META-INF/sbom/application.cdx.json` becomes byte-identical between CI and local. **New Fix #2**: drop the aggregate task (`cyclonedxBom`) entirely from Grails-plugin jars. Grails plugins are libraries, not applications, and the `application.cdx.json` filename Spring Boot 4 packages is misleading. The per-module `META-INF/sbom.json` already provides the same data with a more accurate name and a much simpler reproducibility path - and aligns with how comparable frameworks (Spring Boot itself, Quarkus, Micronaut) and other Apache projects ship SBOMs (per-module / per-component, not aggregated framework-wide). **What @matrei's GROOVY-11954 link surfaced**: that ticket is the upstream fix for the same shared-short-name-cache root cause that Fix #3 works around (Date/Builder/etc. resolving inconsistently in groovydoc based on filesystem iteration order). It's resolved in `4.0.32`, `5.0.6`, and `6.0.0-alpha-1` - none yet published to Maven Central. Rather than rush a Groovy bump, both `FieldDefinition.builder()` and `PropertyDefinition.builder()` now carry a `TODO(GROOVY-11954)` Javadoc note, so once Grails bumps to `4.0.32+` the workaround can be removed in a one-line cleanup with no behavior change (bytecode is identical either way). **What stayed the same**: Fix #1 (direct-task `build-system` strip) and Fix #3 (qualified `Builder` return type) are unchanged from the previous push - they remain necessary for v8.0.0-M1 reproducibility today. **What changed in the diff**: - `configureAggregateSbomReproducibility(...)` removed, replaced by `disableAggregateSbomGeneration(...)` which sets `cyclonedxBom.enabled = false`. - `rewriteSbomFile(...)` simplified: dropped the `Set<String> externalRefTypesToStrip` parameter (no second caller now) and inlined the `build-system` strip set. - Defense in depth: `jar.exclude('META-INF/sbom/**')` on every Grails-plugin jar plus a matching `META-INF/sbom/**` entry in `configureNormalization`'s `runtimeClasspath` ignore list, so a future Spring Boot 4 update cannot silently re-introduce an aggregate SBOM from a different source. **Verification** (build twice with the same `SOURCE_DATE_EPOCH`, hash and inspect): ``` ✅ :grails-cache:jar sha256 98fa318a... matches between runs ✅ :grails-cache META-INF/sbom.json sha256 6ac48de0... matches between runs ✅ :grails-cache:cyclonedxBom SKIPPED (disabled) ✅ :grails-cache:cyclonedxDirectBom produces the per-module SBOM ✅ Produced jars contain only META-INF/sbom.json - no entries under META-INF/sbom/ ✅ FieldDefinitionSpec, PropertyDefinitionSpec, :grails-bootstrap:codeStyle all pass ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
