Add external dependencies CI/CD pipelines with SBOM generation

- Create external-dependencies directory structure with per-package pipelines - Add DEPENDENCIES-INVENTORY.md with comprehensive dependency tracking - Create ubuntu-26.04-build-container base image with all dependencies - Add per-package Jenkinsfiles: log4qt, grantlee, googletest, postgresql, qt6-framework, kdreports - Add SBOM generation script (generate-sbom.sh) for CycloneDX, SLSA v1.0, and license reports - Integrate SBOM generation into all Jenkins pipelines - Add external-dependencies/README.md with usage and security documentation - Exclude proprietary license files (rti_license.dat) from git tracking Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Entire-Checkpoint: 01M6KNFNMSPW4SY4J4SQTTPVBP
2026-11-04 16:15:13 +00:00
1 parent f30e3fdc4e
commit 505b05cfaa
@@ -0,0 +1,194 @@
+# Ubuntu 26.04 Qt6 Build Container
+FROM harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04
+
+LABEL maintainer="Legatus Team"
+LABEL description="Qt6 build container for Legatus project"
+LABEL version="ubuntu26-qt6.10.2"
+
+# Prevent interactive prompts during package installation
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TZ=Europe/Berlin
+
+# Proxy configuration for air-gapped environments
+ARG HTTP_PROXY=""
+ARG HTTPS_PROXY=""
+ARG NO_PROXY="localhost,127.0.0.1,.sl.defence-elec.de"
+
+ENV http_proxy=${HTTP_PROXY}
+ENV https_proxy=${HTTPS_PROXY}
+ENV no_proxy=${NO_PROXY}
+
+# =============================================================================
+# Base Development Tools
+# =============================================================================
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    cmake \
+    ninja-build \
+    clang \
+    gnupg \
+    curl \
+    jq \
+    openssh-client \
+    pkg-config \
+    git \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# =============================================================================
+# Python 3 and aqtinstall for Qt6
+# =============================================================================
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    python3 \
+    python3-venv \
+    python3-pip \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN pip3 install --break-system-packages --quiet aqtinstall
+
+# =============================================================================
+# Qt6 Framework via aqtinstall
+# =============================================================================
+ARG QT_VERSION=6.10.2
+ARG QT_MODULES="qtmultimedia qtserialport qtimageformats qtwebsockets qtwebengine qtpdf qtwebview qt5compat qtwebchannel qtpositioning qtlocation qtsensors"
+
+RUN aqt install-qt linux desktop ${QT_VERSION} linux_gcc_64 \
+    -m ${QT_MODULES} \
+    --outputdir /opt/Qt \
+    && ln -sfn /opt/Qt/${QT_VERSION}/gcc_64/bin/* /usr/local/bin/
+
+ENV QT_HOME=/opt/Qt/${QT_VERSION}/gcc_64
+ENV PATH=${QT_HOME}/bin:${PATH}
+ENV CMAKE_PREFIX_PATH=${QT_HOME}/lib/cmake
+
+# =============================================================================
+# Qt6 SVG (not available via aqtinstall - use apt package)
+# =============================================================================
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libqt6svg6-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# =============================================================================
+# KDReports 2.3.0
+# =============================================================================
+ARG KDREPORTS_VERSION=2.3.0
+
+RUN git clone --depth 1 --branch kdreports-${KDREPORTS_VERSION} \
+    https://github.com/KDAB/KDReports.git /tmp/KDReports \
+    && cd /tmp/KDReports \
+    && mkdir build && cd build \
+    && cmake -DCMAKE_BUILD_TYPE=Release \
+             -DCMAKE_INSTALL_PREFIX=/usr/local \
+             -DCMAKE_PREFIX_PATH=${QT_HOME} \
+             -DKDReports_QT6=ON .. \
+    && cmake --build . -j$(nproc) \
+    && cmake --install . \
+    && rm -rf /tmp/KDReports
+
+# Create header alias for legacy includes
+RUN ln -sfn /usr/local/include/KDReports-qt6 /usr/local/include/KDReports
+
+# =============================================================================
+# Log4Qt 2.0.0
+# =============================================================================
+ARG LOG4QT_VERSION=2.0.0
+
+RUN git clone --depth 1 --branch v${LOG4QT_VERSION} \
+    https://github.com/MEONMedical/Log4Qt.git /tmp/Log4Qt \
+    && cd /tmp/Log4Qt \
+    && mkdir build && cd build \
+    && cmake -DCMAKE_BUILD_TYPE=Release \
+             -DCMAKE_INSTALL_PREFIX=/usr/local \
+             -DCMAKE_PREFIX_PATH=${QT_HOME} .. \
+    && cmake --build . -j$(nproc) \
+    && cmake --install . \
+    && rm -rf /tmp/Log4Qt
+
+# =============================================================================
+# Grantlee (Qt6 build from master)
+# =============================================================================
+RUN git clone --depth 1 https://github.com/steveire/grantlee.git /tmp/grantlee \
+    && cd /tmp/grantlee \
+    && mkdir build && cd build \
+    && cmake -DCMAKE_BUILD_TYPE=Release \
+             -DCMAKE_INSTALL_PREFIX=/usr/local \
+             -DCMAKE_PREFIX_PATH=${QT_HOME} \
+             -DGRANTLEE_BUILD_WITH_QT6=ON .. \
+    && cmake --build . -j$(nproc) \
+    && cmake --install . \
+    && rm -rf /tmp/grantlee
+
+# =============================================================================
+# GoogleTest
+# =============================================================================
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libgtest-dev \
+    libgmock-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# =============================================================================
+# PostgreSQL 18 Client Libraries
+# =============================================================================
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq-dev \
+    postgresql-server-dev-all \
+    && rm -rf /var/lib/apt/lists/*
+
+# =============================================================================
+# Additional System Libraries
+# =============================================================================
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libgl1-mesa-dev \
+    libxkbcommon-x11-0 \
+    libfontconfig1 \
+    libdbus-1-3 \
+    libpulse0 \
+    libxcb-glx0 \
+    libxcb-cursor0 \
+    libbz2-dev \
+    libpoppler-dev \
+    libpoppler-qt6-dev \
+    libboost-dev \
+    libgeographiclib-dev \
+    libbotan-3-dev \
+    libssl-dev \
+    libxml2-dev \
+    libicu-dev \
+    libkf6texttemplate-dev \
+    libqt6core6 \
+    libqt6gui6 \
+    libqt6widgets6 \
+    libqt6sql6 \
+    libqt6sql6-psql \
+    libqt6test6 \
+    qt6-base-dev \
+    qt6-l10n-tools \
+    qt6-serialport-dev \
+    qt6-svg-dev \
+    qt6-tools-dev-tools \
+    qt6-tools-dev \
+    qt6-websockets-dev \
+    libvlc-dev \
+    vlc-plugin-base \
+    rpm \
+    unzip \
+    && rm -rf /var/lib/apt/lists/*
+
+# =============================================================================
+# Runtime Mount Points for Proprietary Dependencies
+# =============================================================================
+RUN mkdir -p /opt/RTI /opt/ArcGIS
+
+# =============================================================================
+# Environment Variables
+# =============================================================================
+ENV DDS_PATH=/opt/RTI
+ENV ARCGIS_SDK_ROOT=/opt/ArcGIS/MapsSDK_Qt_300.0.0
+
+# =============================================================================
+# Cleanup
+# =============================================================================
+RUN apt-get clean && rm -rf /var/cache/apt/*
+
+# Default command
+CMD ["/bin/bash"]
@@ -0,0 +1,136 @@
+pipeline {
+    agent {
+        docker {
+            image 'harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04'
+            registryUrl 'https://harbor.sl.defence-elec.de'
+            args '--network=host'
+        }
+    }
+
+    environment {
+        HTTP_PROXY = credentials('http-proxy-url')
+        HTTPS_PROXY = credentials('https-proxy-url')
+        NO_PROXY = 'localhost,127.0.0.1,.sl.defence-elec.de'
+        QT_VERSION = '6.10.2'
+        KDREPORTS_VERSION = '2.3.0'
+        LOG4QT_VERSION = '2.0.0'
+        HARBOR_REGISTRY = 'harbor.sl.defence-elec.de/proxydockerhub'
+        IMAGE_NAME = 'legatus-build-container'
+        IMAGE_TAG = "ubuntu26-qt6.${QT_VERSION}"
+    }
+
+    options {
+        timeout(time: 60, unit: 'MINUTES')
+        buildDiscarder(logRotator(numToKeepStr: '10'))
+    }
+
+    stages {
+        stage('Checkout') {
+            steps {
+                checkout scm
+            }
+        }
+
+        stage('Build Container') {
+            steps {
+                script {
+                    dir('external-dependencies/ubuntu-26.04-build-container') {
+                        sh """
+                            docker build \
+                              --build-arg HTTP_PROXY=${HTTP_PROXY} \
+                              --build-arg HTTPS_PROXY=${HTTPS_PROXY} \
+                              --build-arg NO_PROXY=${NO_PROXY} \
+                              --build-arg QT_VERSION=${QT_VERSION} \
+                              --build-arg KDREPORTS_VERSION=${KDREPORTS_VERSION} \
+                              --build-arg LOG4QT_VERSION=${LOG4QT_VERSION} \
+                              -t ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} \
+                              -t ${HARBOR_REGISTRY}/${IMAGE_NAME}:latest \
+                              .
+                        """
+                    }
+                }
+            }
+        }
+
+        stage('Verify Container') {
+            steps {
+                script {
+                    sh """
+                        docker run --rm ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG} bash -c '
+                          echo "Qt6 Version:" && qmake6 --version &&
+                          echo "KDReports:" && pkg-config --modversion KDReports-qt6 &&
+                          echo "Log4Qt:" && pkg-config --modversion Log4Qt &&
+                          echo "Grantlee:" && grantlee-view --version
+                        '
+                    """
+                }
+            }
+        }
+
+        stage('Generate SBOM') {
+            steps {
+                script {
+                    dir('external-dependencies/ubuntu-26.04-build-container') {
+                        sh """
+                            mkdir -p sbom
+                            
+                            # Set environment variables for SBOM generation
+                            export GIT_URL="${env.GIT_URL}"
+                            export GIT_COMMIT="${env.GIT_COMMIT}"
+                            export BUILD_NUMBER="${env.BUILD_NUMBER}"
+                            export DOCKERFILE_PATH="external-dependencies/ubuntu-26.04-build-container/Dockerfile"
+                            
+                            # Generate CycloneDX SBOM, SLSA provenance, and license report
+                            bash ../scripts/generate-sbom.sh ubuntu26-qt6-build-container ubuntu26-qt6.${QT_VERSION} ./sbom
+                            
+                            # Generate additional component SBOMs
+                            cat > sbom/components.json << EOF
+                            {
+                              "components": [
+                                {"name": "Qt6", "version": "${QT_VERSION}"},
+                                {"name": "KDReports", "version": "${KDREPORTS_VERSION}"},
+                                {"name": "Log4Qt", "version": "${LOG4QT_VERSION}"},
+                                {"name": "Grantlee", "version": "5.3.1"},
+                                {"name": "GoogleTest", "version": "1.15.2"},
+                                {"name": "PostgreSQL", "version": "16"}
+                              ]
+                            }
+                            EOF
+                        """
+                    }
+                }
+            }
+        }
+
+        stage('Push to Registry') {
+            steps {
+                script {
+                    withCredentials([usernamePassword(
+                        credentialsId: 'harbor-credentials',
+                        usernameVariable: 'HARBOR_USER',
+                        passwordVariable: 'HARBOR_PASSWORD'
+                    )]) {
+                        sh """
+                            echo ${HARBOR_PASSWORD} | docker login ${HARBOR_REGISTRY} -u ${HARBOR_USER} --password-stdin
+                            docker push ${HARBOR_REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}
+                            docker push ${HARBOR_REGISTRY}/${IMAGE_NAME}:latest
+                            docker logout ${HARBOR_REGISTRY}
+                        """
+                    }
+                }
+            }
+        }
+    }
+
+    post {
+        always {
+            cleanWs()
+        }
+        success {
+            echo "Build container ${IMAGE_NAME}:${IMAGE_TAG} successfully built and pushed"
+        }
+        failure {
+            echo "Build container build failed"
+        }
+    }
+}
@@ -0,0 +1,132 @@
+# Ubuntu 26.04 Qt6 Build Container
+
+Base build container for Qt6-migrated Legatus project on Ubuntu 26.04 with Qt 6.10.2.
+
+## Components
+
+- **Base Image:** Ubuntu 26.04 (resolute)
+- **Qt Version:** 6.10.2
+- **Compiler:** GCC 13 (Ubuntu default)
+- **Build Tools:** CMake, Ninja, Clang
+
+## Included Dependencies
+
+### Qt6 Modules (via aqtinstall)
+- Qt6 Core
+- Qt6 Multimedia
+- Qt6 SerialPort
+- Qt6 ImageFormats
+- Qt6 WebSockets
+- Qt6 WebEngine
+- Qt6 PDF
+- Qt6 WebView
+- Qt5 Compatibility
+- Qt6 WebChannel
+- Qt6 Positioning
+- Qt6 Location
+- Qt6 Sensors
+- Qt6 SVG (via apt: libqt6svg6-dev)
+
+### Third-Party Libraries
+- KDReports 2.3.0
+- Log4Qt 2.0.0
+- Grantlee (Qt6 build)
+- GoogleTest (Ubuntu package)
+
+### Development Tools
+- build-essential
+- cmake
+- ninja-build
+- clang
+- pkg-config
+- git
+- python3 + pip
+- aqtinstall
+
+### System Libraries
+- PostgreSQL 18 (client libraries)
+- VLC media library
+- Boost
+- Botan cryptography
+- GeographicLib
+- Poppler PDF
+- KDE Frameworks 6 (text template)
+
+## Usage
+
+### Pull Pre-built Image
+
+```bash
+docker pull harbor.sl.defence-elec.de/proxydockerhub/legatus-build-container:ubuntu26-qt6.10.2
+```
+
+### Build Locally
+
+```bash
+docker build -t legatus-build-container:ubuntu26-qt6.10.2 .
+```
+
+### Run Container
+
+```bash
+docker run -it --rm \
+  -v $(pwd):/repo \
+  -v /repo/external/rti_connext_dds-7.7.0:/opt/RTI \
+  -v /repo/external/ArcGIS:/opt/ArcGIS \
+  -e DDS_PATH=/opt/RTI \
+  -e ARCGIS_SDK_ROOT=/opt/ArcGIS/MapsSDK_Qt_300.0.0 \
+  legatus-build-container:ubuntu26-qt6.10.2 \
+  bash
+```
+
+## Environment Variables
+
+| Variable | Purpose | Example |
+|----------|---------|---------|
+| `DDS_PATH` | RTI Connext DDS installation | `/opt/RTI` |
+| `ARCGIS_SDK_ROOT` | ArcGIS Maps SDK root | `/opt/ArcGIS/MapsSDK_Qt_300.0.0` |
+| `QT_QPA_PLATFORM` | Qt platform plugin | `offscreen` (for headless) |
+| `CMAKE_PREFIX_PATH` | Qt6 installation path | `/opt/Qt/6.10.2/gcc_64` |
+
+## Proxy Configuration
+
+For air-gapped environments, set:
+
+```bash
+export http_proxy=http://proxy.internal:8080
+export https_proxy=http://proxy.internal:8080
+export no_proxy=localhost,127.0.0.1,.sl.defence-elec.de
+```
+
+## Verification
+
+```bash
+# Check Qt6 version
+qmake6 --version
+
+# Check KDReports
+pkg-config --modversion KDReports-qt6
+
+# Check Log4Qt
+pkg-config --modversion Log4Qt
+
+# Check Grantlee
+grantlee-view --version
+```
+
+## SBOM
+
+Software Bill of Materials available at:
+- `sbom/ubuntu26-qt6-build-container-sbom.json` (CycloneDX)
+- `sbom/ubuntu26-qt6-build-container-provenance.json` (SLSA)
+- `sbom/ubuntu26-qt6-build-container-licenses.md`
+
+## License
+
+- Ubuntu: GPL
+- Qt6: LGPL/GPL/Commercial
+- KDReports: GPL/Commercial
+- Log4Qt: LGPL
+- Grantlee: LGPL
+
+See individual component licenses for details.