Add external dependencies CI/CD pipelines with SBOM generation

- Create external-dependencies directory structure with per-package pipelines - Add DEPENDENCIES-INVENTORY.md with comprehensive dependency tracking - Create ubuntu-26.04-build-container base image with all dependencies - Add per-package Jenkinsfiles: log4qt, grantlee, googletest, postgresql, qt6-framework, kdreports - Add SBOM generation script (generate-sbom.sh) for CycloneDX, SLSA v1.0, and license reports - Integrate SBOM generation into all Jenkins pipelines - Add external-dependencies/README.md with usage and security documentation - Exclude proprietary license files (rti_license.dat) from git tracking Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Entire-Checkpoint: 01M6KNFNMSPW4SY4J4SQTTPVBP
2026-11-04 16:15:13 +00:00
1 parent f30e3fdc4e
commit 505b05cfaa
@@ -0,0 +1,132 @@
+# Ubuntu 26.04 Qt6 Build Container
+
+Base build container for Qt6-migrated Legatus project on Ubuntu 26.04 with Qt 6.10.2.
+
+## Components
+
+- **Base Image:** Ubuntu 26.04 (resolute)
+- **Qt Version:** 6.10.2
+- **Compiler:** GCC 13 (Ubuntu default)
+- **Build Tools:** CMake, Ninja, Clang
+
+## Included Dependencies
+
+### Qt6 Modules (via aqtinstall)
+- Qt6 Core
+- Qt6 Multimedia
+- Qt6 SerialPort
+- Qt6 ImageFormats
+- Qt6 WebSockets
+- Qt6 WebEngine
+- Qt6 PDF
+- Qt6 WebView
+- Qt5 Compatibility
+- Qt6 WebChannel
+- Qt6 Positioning
+- Qt6 Location
+- Qt6 Sensors
+- Qt6 SVG (via apt: libqt6svg6-dev)
+
+### Third-Party Libraries
+- KDReports 2.3.0
+- Log4Qt 2.0.0
+- Grantlee (Qt6 build)
+- GoogleTest (Ubuntu package)
+
+### Development Tools
+- build-essential
+- cmake
+- ninja-build
+- clang
+- pkg-config
+- git
+- python3 + pip
+- aqtinstall
+
+### System Libraries
+- PostgreSQL 18 (client libraries)
+- VLC media library
+- Boost
+- Botan cryptography
+- GeographicLib
+- Poppler PDF
+- KDE Frameworks 6 (text template)
+
+## Usage
+
+### Pull Pre-built Image
+
+```bash
+docker pull harbor.sl.defence-elec.de/proxydockerhub/legatus-build-container:ubuntu26-qt6.10.2
+```
+
+### Build Locally
+
+```bash
+docker build -t legatus-build-container:ubuntu26-qt6.10.2 .
+```
+
+### Run Container
+
+```bash
+docker run -it --rm \
+  -v $(pwd):/repo \
+  -v /repo/external/rti_connext_dds-7.7.0:/opt/RTI \
+  -v /repo/external/ArcGIS:/opt/ArcGIS \
+  -e DDS_PATH=/opt/RTI \
+  -e ARCGIS_SDK_ROOT=/opt/ArcGIS/MapsSDK_Qt_300.0.0 \
+  legatus-build-container:ubuntu26-qt6.10.2 \
+  bash
+```
+
+## Environment Variables
+
+| Variable | Purpose | Example |
+|----------|---------|---------|
+| `DDS_PATH` | RTI Connext DDS installation | `/opt/RTI` |
+| `ARCGIS_SDK_ROOT` | ArcGIS Maps SDK root | `/opt/ArcGIS/MapsSDK_Qt_300.0.0` |
+| `QT_QPA_PLATFORM` | Qt platform plugin | `offscreen` (for headless) |
+| `CMAKE_PREFIX_PATH` | Qt6 installation path | `/opt/Qt/6.10.2/gcc_64` |
+
+## Proxy Configuration
+
+For air-gapped environments, set:
+
+```bash
+export http_proxy=http://proxy.internal:8080
+export https_proxy=http://proxy.internal:8080
+export no_proxy=localhost,127.0.0.1,.sl.defence-elec.de
+```
+
+## Verification
+
+```bash
+# Check Qt6 version
+qmake6 --version
+
+# Check KDReports
+pkg-config --modversion KDReports-qt6
+
+# Check Log4Qt
+pkg-config --modversion Log4Qt
+
+# Check Grantlee
+grantlee-view --version
+```
+
+## SBOM
+
+Software Bill of Materials available at:
+- `sbom/ubuntu26-qt6-build-container-sbom.json` (CycloneDX)
+- `sbom/ubuntu26-qt6-build-container-provenance.json` (SLSA)
+- `sbom/ubuntu26-qt6-build-container-licenses.md`
+
+## License
+
+- Ubuntu: GPL
+- Qt6: LGPL/GPL/Commercial
+- KDReports: GPL/Commercial
+- Log4Qt: LGPL
+- Grantlee: LGPL
+
+See individual component licenses for details.