lifemaps/qt6-migration-pipeline
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
505b05cfaa1d177595b589507fb1d1f7df24b7eb
qt6-migration-pipeline/external-dependencies/DEPENDENCIES-INVENTORY.md
T
torstenandCopilot 505b05cfaa Add external dependencies CI/CD pipelines with SBOM generation 
- Create external-dependencies directory structure with per-package pipelines
- Add DEPENDENCIES-INVENTORY.md with comprehensive dependency tracking
- Create ubuntu-26.04-build-container base image with all dependencies
- Add per-package Jenkinsfiles: log4qt, grantlee, googletest, postgresql, qt6-framework, kdreports
- Add SBOM generation script (generate-sbom.sh) for CycloneDX, SLSA v1.0, and license reports
- Integrate SBOM generation into all Jenkins pipelines
- Add external-dependencies/README.md with usage and security documentation
- Exclude proprietary license files (rti_license.dat) from git tracking

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Entire-Checkpoint: 01M6KNFNMSPW4SY4J4SQTTPVBP
2026-11-04 16:15:13 +00:00

388 lines
14 KiB
Markdown
Raw Blame History

# External Dependencies Inventory
This document inventories all external dependencies for the Qt6-migrated Legatus project, following Ubuntu 26.04 standards with independently versioned, reproducible CI/CD pipelines.
## Dependency Classification
| Category | Description | Examples |
|----------|-------------|----------|
| **OS/Base Image** | Ubuntu 26.04 base container | ubuntu:26.04 |
| **APT Packages** | Ubuntu packages via apt-get | build-essential, cmake, libboost-dev |
| **Upstream Binaries** | Pre-built binaries via package managers | Qt6 (aqtinstall) |
| **Source-Built** | Built from source in container | KDReports, Log4Qt, Grantlee |
| **Proprietary** | Commercial licenses, runtime-mounted | RTI Connext DDS, ArcGIS Maps SDK |
---
## Complete Dependency Inventory
### 1. Base Image
| Dependency | Version | Source | License | SBOM Required |
|------------|---------|--------|---------|---------------|
| Ubuntu Base Image | 26.04 (resolute) | harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04 | GPL | Yes |
**CI/CD Pipeline:** `external-dependencies/ubuntu-26.04-build-container/`
---
### 2. Qt6 Framework
| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| Qt6 Core | 6.10.2 | aqtinstall (Qt mirrors) | LGPL/GPL/Commercial | `aqt install-qt linux desktop 6.10.2 linux_gcc_64` |
| Qt6 Multimedia | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtmultimedia |
| Qt6 SerialPort | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtserialport |
| Qt6 ImageFormats | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtimageformats |
| Qt6 WebSockets | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtwebsockets |
| Qt6 WebEngine | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtwebengine |
| Qt6 PDF | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtpdf |
| Qt6 WebView | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtwebview |
| Qt5 Compatibility | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qt5compat |
| Qt6 WebChannel | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtwebchannel |
| Qt6 Positioning | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtpositioning |
| Qt6 Location | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtlocation |
| Qt6 Sensors | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtsensors |
| Qt6 SVG | 6.10.2 | Ubuntu apt | LGPL/GPL/Commercial | Package: libqt6svg6-dev |
**CI/CD Pipeline:** `external-dependencies/qt6-framework/`
**Installation Command:**
```bash
pip3 install --break-system-packages --quiet aqtinstall
aqt install-qt linux desktop 6.10.2 linux_gcc_64 \
-m qtmultimedia qtserialport qtimageformats qtwebsockets qtwebengine \
qtpdf qtwebview qt5compat qtwebchannel qtpositioning qtlocation qtsensors \
--outputdir /opt/Qt
```
**Notes:**
- Qt6 SVG is NOT available via aqtinstall; provided by libqt6svg6-dev apt package
- Requires proxy configuration for air-gapped environments
- Qt6Location requires Qt6Positioning as dependency
---
### 3. KDReports
| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| KDReports | 2.3.0 (kdreports-2.3.0 tag) | https://github.com/KDAB/KDReports | GPL/Commercial | Source build via CMake |
**CI/CD Pipeline:** `external-dependencies/kdreports/`
**Installation:**
```bash
git clone --depth 1 --branch kdreports-2.3.0 https://github.com/KDAB/KDReports.git /tmp/KDReports
cd /tmp/KDReports
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=/usr/local \
-DCMAKE_PREFIX_PATH=/opt/Qt/6.10.2/gcc_64 \
-DKDReports_QT6=ON ..
cmake --build . -j$(nproc)
cmake --install .
```
**Notes:**
- Qt6 support via `-DKDReports_QT6=ON` flag
- Header alias required: `ln -sfn KDReports-qt6 /usr/local/include/KDReports`
- Legacy sources use `<KDReports/...>` includes
---
### 4. Log4Qt
| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| Log4Qt | 2.0.0 (v2.0.0 tag) | https://github.com/MEONMedical/Log4Qt | LGPL | Source build via CMake |
**CI/CD Pipeline:** `external-dependencies/log4qt/`
**Installation:**
```bash
git clone --depth 1 --branch v2.0.0 https://github.com/MEONMedical/Log4Qt.git /tmp/Log4Qt
cd /tmp/Log4Qt
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=/usr/local \
-DCMAKE_PREFIX_PATH=/opt/Qt/6.10.2/gcc_64 ..
cmake --build . -j$(nproc)
cmake --install .
```
**Notes:**
- Qt6 support in v2.0.0 tag
- Logging framework for Qt applications
---
### 5. Grantlee
| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| Grantlee | master branch (Qt6) | https://github.com/steveire/grantlee | LGPL | Source build via CMake |
**CI/CD Pipeline:** `external-dependencies/grantlee/`
**Installation:**
```bash
git clone --depth 1 https://github.com/steveire/grantlee.git /tmp/grantlee
cd /tmp/grantlee
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=/usr/local \
-DCMAKE_PREFIX_PATH=/opt/Qt/6.10.2/gcc_64 \
-DGRANTLEE_BUILD_WITH_QT6=ON ..
cmake --build . -j$(nproc)
cmake --install .
```
**Notes:**
- Ubuntu `grantlee5-devel` is Qt5-based; must build Qt6 version from source
- Qt6 support via `-DGRANTLEE_BUILD_WITH_QT6=ON` flag
- Template engine for Qt
---
### 6. GoogleTest
| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| GoogleTest | Ubuntu package version | Ubuntu apt | BSD 3-Clause | `apt-get install libgtest-dev libgmock-dev` |
**CI/CD Pipeline:** `external-dependencies/googletest/`
**Installation:**
```bash
apt-get update
apt-get install -y --no-install-recommends libgtest-dev libgmock-dev
```
**Notes:**
- Provided by Ubuntu 26.04 repositories
- Version depends on Ubuntu release
---
### 7. PostgreSQL
| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| PostgreSQL Client | 18 | Ubuntu apt | PostgreSQL License | `apt-get install libpq-dev postgresql-server-dev-all` |
| PostgreSQL Server | 18 | Ubuntu apt | PostgreSQL License | `apt-get install postgresql-18` (optional) |
**CI/CD Pipeline:** `external-dependencies/postgresql/`
**Installation:**
```bash
# Client libraries (required for build)
apt-get update
apt-get install -y --no-install-recommends libpq-dev postgresql-server-dev-all
# Server (optional, for local testing)
apt-get install -y --no-install-recommends postgresql-18
```
**Notes:**
- Client libraries required for Qt SQL module
- Server optional for local development/testing
- Default roles: postgres, ctc_sv
- Default databases: lts_ets_pro, dbAdmin
---
### 8. APT Packages (Complete List)
| Package | Purpose | Required For |
|---------|---------|--------------|
| build-essential | Compiler toolchain | All C++ builds |
| cmake | Build system | CMake-based builds |
| ninja-build | Build backend | Faster builds |
| clang | Alternative compiler | Optional |
| gnupg | GPG signing | Package verification |
| curl | HTTP client | Downloads |
| jq | JSON processor | Scripting |
| openssh-client | SSH client | Git over SSH |
| pkg-config | Build configuration | Dependency discovery |
| libgl1-mesa-dev | OpenGL | Qt GUI |
| libxkbcommon-x11-0 | Keyboard handling | Qt GUI |
| libfontconfig1 | Font configuration | Qt GUI |
| libdbus-1-3 | D-Bus messaging | Qt D-Bus |
| libpulse0 | Audio | Qt Multimedia |
| libxcb-glx0 | X11 GLX | Qt GUI |
| libxcb-cursor0 | X11 cursor | Qt GUI |
| libbz2-dev | BZip2 compression | Compression |
| libpoppler-dev | PDF library | PDF support |
| libpoppler-qt6-dev | PDF Qt6 bindings | PDF in Qt6 |
| libboost-dev | Boost libraries | Boost support |
| libgeographiclib-dev | Geographic calculations | Geospatial |
| libbotan-3-dev | Cryptography | Security |
| libssl-dev | SSL/TLS | Security |
| libxml2-dev | XML parsing | XML support |
| libicu-dev | Unicode support | Internationalization |
| libqt6svg6-dev | SVG support | Qt SVG |
| unzip | Archive extraction | Downloads |
| python3 | Python runtime | Scripts |
| python3-venv | Python virtualenv | Python isolation |
| python3-pip | Python package manager | aqtinstall |
| libkf6texttemplate-dev | KDE text templates | KDE Frameworks 6 |
| libqt6core6 | Qt6 Core library | Qt6 runtime |
| libqt6gui6 | Qt6 GUI library | Qt6 runtime |
| libqt6widgets6 | Qt6 Widgets library | Qt6 runtime |
| libqt6sql6 | Qt6 SQL library | Database access |
| libqt6sql6-psql | Qt6 PostgreSQL driver | PostgreSQL |
| libqt6test6 | Qt6 Test library | Unit tests |
| qt6-base-dev | Qt6 base development | Qt6 dev |
| qt6-l10n-tools | Qt6 localization | i18n |
| qt6-serialport-dev | Qt6 SerialPort dev | Serial communication |
| qt6-svg-dev | Qt6 SVG development | SVG support |
| qt6-tools-dev-tools | Qt6 tools | Qt6 dev |
| qt6-tools-dev | Qt6 tools development | Qt6 dev |
| qt6-websockets-dev | Qt6 WebSockets dev | WebSocket support |
| libvlc-dev | VLC media library | Multimedia |
| vlc-plugin-base | VLC plugins | Multimedia |
| rpm | RPM packaging | RPM builds |
**Installation Command:**
```bash
apt-get update
apt-get install -y --no-install-recommends \
build-essential cmake libboost-dev libkf6texttemplate-dev \
libqt6core6 libqt6gui6 libqt6widgets6 libqt6sql6 libqt6sql6-psql libqt6test6 \
qt6-base-dev qt6-l10n-tools qt6-serialport-dev qt6-svg-dev \
qt6-tools-dev-tools qt6-tools-dev qt6-websockets-dev \
libgtest-dev libpq-dev postgresql-server-dev-all \
libvlc-dev vlc-plugin-base git python3-pip \
[additional packages as needed]
```
---
### 9. Proprietary Dependencies (Runtime-Mounted)
| Dependency | Version | Source | License | Mount Path |
|------------|---------|--------|---------|------------|
| RTI Connext DDS | 7.7.0 Pro | RTI Commercial License | Commercial | /opt/RTI (container) /repo/external/rti_connext_dds-7.7.0 (host) |
| ArcGIS Maps SDK for Qt | 300.0.0 | Esri Commercial License | Commercial | /opt/ArcGIS (container) /repo/external/ArcGIS (host) |
**Notes:**
- **NOT installed in container** - mounted at runtime via Docker volumes
- RTI license file: `/repo/external/rti_connext_dds-7.7.0/rti_license.dat`
- ArcGIS SDK path: `/repo/external/ArcGIS/MapsSDK_Qt_300.0.0/ArcGIS_Maps_SDK_Qt_300.0.0/qt300.0.0/sdk`
- Environment variables:
- `DDS_PATH=/opt/RTI` (container)
- `ARCGIS_SDK_ROOT=/opt/ArcGIS/MapsSDK_Qt_300.0.0` (container)
**Docker Mount Example:**
```bash
docker run -v /repo/external/rti_connext_dds-7.7.0:/opt/RTI \
-v /repo/external/ArcGIS:/opt/ArcGIS \
[other options] \
build-container
```
---
## Dependency Graph
```
ubuntu:26.04 (base)
├── APT Packages (build-essential, cmake, etc.)
│ └── GoogleTest (libgtest-dev)
│ └── PostgreSQL (libpq-dev)
├── Python 3 + pip
│ └── aqtinstall
│ └── Qt6 Framework (6.10.2)
│ ├── KDReports (2.3.0) - requires Qt6
│ ├── Log4Qt (2.0.0) - requires Qt6
│ └── Grantlee (master) - requires Qt6
└── Runtime Mounts (proprietary)
├── RTI Connext DDS 7.7.0 Pro
└── ArcGIS Maps SDK 300.0.0
```
---
## SBOM Generation Requirements
Each CI/CD pipeline must generate:
1. **CycloneDX SBOM** (Software Bill of Materials)
- Format: JSON
- Includes: All direct and transitive dependencies
- Location: `sbom/<package>-<version>-sbom.json`
2. **Provenance Manifest**
- Format: SLSA v1.0
- Includes: Build instructions, source URLs, commit hashes, checksums
- Location: `sbom/<package>-<version>-provenance.json`
3. **License Compliance Report**
- Format: Markdown/JSON
- Includes: License types, compatibility analysis, attribution requirements
- Location: `sbom/<package>-<version>-licenses.md`
---
## Version Pinning Strategy
| Dependency Type | Pinning Method | Update Frequency |
|-----------------|----------------|------------------|
| Ubuntu Base Image | Tag: 26.04 | Quarterly |
| APT Packages | Ubuntu 26.04 repository freeze | Security updates only |
| Qt6 Framework | Version: 6.10.2 (pinned in aqtinstall) | Per Qt LTS release |
| KDReports | Git tag: kdreports-2.3.0 | As needed |
| Log4Qt | Git tag: v2.0.0 | As needed |
| Grantlee | Git commit hash (master branch) | As needed |
| GoogleTest | Ubuntu package version | Ubuntu updates |
| PostgreSQL | Ubuntu package version (18) | Ubuntu updates |
| Proprietary | License version (RTI 7.7.0, ArcGIS 300.0.0) | Per license agreement |
---
## Security Considerations
1. **No Secrets in Containers**
- Proprietary licenses mounted at runtime
- No credentials committed to Git
- Use Jenkins credentials for registry access
2. **Air-Gapped Environment Support**
- Internal Nexus repository: `remote-repo.sl.defence-elec.de:8081`
- Internal Harbor registry: `harbor.sl.defence-elec.de`
- Proxy configuration via environment variables
3. **Checksum Verification**
- All git clones use `--depth 1` with specific tags/commits
- SBOM includes SHA256 checksums
- APT packages signed by Ubuntu keys
4. **License Compliance**
- LGPL components dynamically linked
- Commercial licenses runtime-mounted
- Attribution in SBOM
---
## Next Steps
1. Create per-package CI/CD pipelines:
- `external-dependencies/<package>/Dockerfile`
- `external-dependencies/<package>/Jenkinsfile`
- `external-dependencies/<package>/README.md`
2. Generate SBOMs for each package
3. Create build container pipeline:
- `external-dependencies/ubuntu-26.04-build-container/`
4. Update `new_docker_build.sh` with `--docker-mount-root` option
5. Verify no secrets or proprietary files committed
---
**Document Version:** 1.0
**Last Updated:** 2025-11-04
**Author:** Copilot (Qt6 Migration Pipeline)
Reference in new issue View Git Blame Copy Permalink