Add external dependencies CI/CD pipelines with SBOM generation

- Create external-dependencies directory structure with per-package pipelines - Add DEPENDENCIES-INVENTORY.md with comprehensive dependency tracking - Create ubuntu-26.04-build-container base image with all dependencies - Add per-package Jenkinsfiles: log4qt, grantlee, googletest, postgresql, qt6-framework, kdreports - Add SBOM generation script (generate-sbom.sh) for CycloneDX, SLSA v1.0, and license reports - Integrate SBOM generation into all Jenkins pipelines - Add external-dependencies/README.md with usage and security documentation - Exclude proprietary license files (rti_license.dat) from git tracking Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Entire-Checkpoint: 01M6KNFNMSPW4SY4J4SQTTPVBP
2026-11-04 16:15:13 +00:00
1 parent f30e3fdc4e
commit 505b05cfaa
@@ -0,0 +1,155 @@
+#!/bin/bash
+set -euo pipefail
+
+# SBOM Generation Script for External Dependencies
+# Generates CycloneDX SBOM and SLSA v1.0 provenance for build artifacts
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PACKAGE_NAME="${1:-unknown}"
+PACKAGE_VERSION="${2:-unknown}"
+OUTPUT_DIR="${3:-${SCRIPT_DIR}/sbom}"
+
+mkdir -p "${OUTPUT_DIR}"
+
+echo "Generating SBOM for ${PACKAGE_NAME} v${PACKAGE_VERSION}..."
+
+# Generate CycloneDX SBOM
+generate_cyclonedx_sbom() {
+    local sbom_file="${OUTPUT_DIR}/${PACKAGE_NAME}-sbom.json"
+    
+    cat > "${sbom_file}" << EOF
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "metadata": {
+    "timestamp": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")",
+    "tools": [
+      {
+        "vendor": "jenkins",
+        "name": "sbom-generator",
+        "version": "1.0.0"
+      }
+    ],
+    "component": {
+      "type": "library",
+      "name": "${PACKAGE_NAME}",
+      "version": "${PACKAGE_VERSION}",
+      "purl": "pkg:generic/${PACKAGE_NAME}@${PACKAGE_VERSION}",
+      "bom-ref": "${PACKAGE_NAME}@${PACKAGE_VERSION}"
+    }
+  },
+  "components": [
+    {
+      "type": "library",
+      "name": "${PACKAGE_NAME}",
+      "version": "${PACKAGE_VERSION}",
+      "licenses": [
+        {
+          "license": {
+            "name": "See LICENSE file"
+          }
+        }
+      ],
+      "purl": "pkg:generic/${PACKAGE_NAME}@${PACKAGE_VERSION}",
+      "bom-ref": "${PACKAGE_NAME}@${PACKAGE_VERSION}"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "${PACKAGE_NAME}@${PACKAGE_VERSION}",
+      "dependsOn": []
+    }
+  ]
+}
+EOF
+    
+    echo "Generated CycloneDX SBOM: ${sbom_file}"
+}
+
+# Generate SLSA v1.0 provenance
+generate_slsa_provenance() {
+    local provenance_file="${OUTPUT_DIR}/${PACKAGE_NAME}-provenance.json"
+    local git_url="${GIT_URL:-unknown}"
+    local git_commit="${GIT_COMMIT:-unknown}"
+    local jenkins_build="${BUILD_NUMBER:-unknown}"
+    local dockerfile_path="${DOCKERFILE_PATH:-Dockerfile}"
+    
+    cat > "${provenance_file}" << EOF
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "subject": [
+    {
+      "name": "${PACKAGE_NAME}",
+      "digest": {
+        "sha256": "pending-build"
+      }
+    }
+  ],
+  "predicateType": "https://slsa.dev/provenance/v1",
+  "predicate": {
+    "buildDefinition": {
+      "buildType": "https://github.com/docker/build",
+      "externalParameters": {
+        "source": "${git_url}",
+        "commit": "${git_commit}",
+        "dockerfile": "${dockerfile_path}"
+      }
+    },
+    "runDetails": {
+      "builder": {
+        "id": "jenkins-${jenkins_build}"
+      },
+      "metadata": {
+        "invocationId": "jenkins-${jenkins_build}-${PACKAGE_NAME}",
+        "startedOn": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+      }
+    }
+  }
+}
+EOF
+    
+    echo "Generated SLSA provenance: ${provenance_file}"
+}
+
+# Generate license compliance report
+generate_license_report() {
+    local license_file="${OUTPUT_DIR}/${PACKAGE_NAME}-licenses.txt"
+    
+    cat > "${license_file}" << EOF
+License Compliance Report for ${PACKAGE_NAME} v${PACKAGE_VERSION}
+================================================================
+
+Generated: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
+
+Package: ${PACKAGE_NAME}
+Version: ${PACKAGE_VERSION}
+License: See package LICENSE file
+
+Dependencies:
+- Ubuntu 26.04 base (various licenses)
+- Build tools (GPL, LGPL, MIT)
+
+Compliance Status: REVIEW REQUIRED
+- Verify license compatibility with project
+- Ensure attribution requirements are met
+- Check for copyleft obligations
+
+Notes:
+- This is an automated report
+- Manual license review is required
+- Contact legal team for questions
+EOF
+    
+    echo "Generated license report: ${license_file}"
+}
+
+# Main execution
+generate_cyclonedx_sbom
+generate_slsa_provenance
+generate_license_report
+
+echo ""
+echo "SBOM generation complete for ${PACKAGE_NAME} v${PACKAGE_VERSION}"
+echo "Output directory: ${OUTPUT_DIR}"
+ls -la "${OUTPUT_DIR}/"