asmhatreandClaude Sonnet 5.5
809272f7dc
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf
59 lines
2.9 KiB
Bash
Executable File
59 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Regenerates every file in output/. Needs JDK 25, Maven 3.9, python3 and network access to api.osv.dev.
|
|
# Spring Boot 4.2.0-RC1 is a release candidate, so the first run downloads it from Maven Central.
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
rm -rf output && mkdir output
|
|
JAR=target/sbom-1.0.0.jar
|
|
TOOLS="java -Djarmode=tools -jar $JAR"
|
|
|
|
# Tests write 05 and 06 (and need the SBOM the build puts into target/classes).
|
|
mvn -B -q clean test >/dev/null 2>&1 || { echo "tests failed"; exit 1; }
|
|
|
|
# A jar built with SBOM generation switched off.
|
|
mvn -B -q clean package -DskipTests -Dcyclonedx.skip=true >/dev/null 2>&1
|
|
cp $JAR /tmp/sbom-without.jar
|
|
{
|
|
echo '$ unzip -p sbom-without.jar META-INF/MANIFEST.MF | grep -i sbom'
|
|
unzip -p /tmp/sbom-without.jar META-INF/MANIFEST.MF | grep -i sbom || echo '(no matching line)'
|
|
echo '$ java -Djarmode=tools -jar sbom-without.jar sbom'
|
|
java -Djarmode=tools -jar /tmp/sbom-without.jar sbom 2>&1
|
|
echo "exit code: $?"
|
|
} > output/02-no-sbom.txt
|
|
|
|
# The normal build.
|
|
mvn -B -q clean package -DskipTests >/dev/null 2>&1
|
|
{
|
|
echo '$ java -Djarmode=tools -jar sbom-1.0.0.jar help'
|
|
$TOOLS help 2>&1
|
|
echo
|
|
echo '$ java -Djarmode=tools -jar sbom-1.0.0.jar help sbom'
|
|
$TOOLS help sbom 2>&1
|
|
} > output/01-jarmode-help.txt
|
|
|
|
{
|
|
echo '$ unzip -p sbom-1.0.0.jar META-INF/MANIFEST.MF | grep -i sbom'
|
|
unzip -p $JAR META-INF/MANIFEST.MF | grep -i sbom
|
|
$TOOLS sbom > /tmp/from-command.json; echo "exit code of 'sbom': $?"
|
|
echo '$ java -Djarmode=tools -jar sbom-1.0.0.jar sbom (first 120 characters)'
|
|
head -c 120 /tmp/from-command.json; echo
|
|
$TOOLS sbom --destination /tmp/from-destination.json >/dev/null 2>&1; echo "--destination exit code: $?"
|
|
unzip -p $JAR META-INF/sbom/application.cdx.json > /tmp/from-zip.json
|
|
echo "bytes: command $(wc -c < /tmp/from-command.json), --destination $(wc -c < /tmp/from-destination.json), unzip $(wc -c < /tmp/from-zip.json)"
|
|
echo "SHA-256 of the three files: $(sha256sum /tmp/from-command.json /tmp/from-destination.json /tmp/from-zip.json | cut -d' ' -f1 | sort -u | wc -l) distinct value(s)"
|
|
} > output/03-sbom-command.txt
|
|
|
|
bash scripts/commands-by-version.sh > output/11-jarmode-commands-by-version.txt
|
|
python3 scripts/analyse.py inspect /tmp/from-command.json > output/04-inspect.txt
|
|
python3 scripts/analyse.py compare /tmp/from-command.json $JAR > output/07-sbom-against-jar.txt
|
|
python3 scripts/analyse.py licences /tmp/from-command.json > output/08-licences.txt
|
|
{ echo "scanned: $(date -u +%Y-%m-%d)"; python3 scripts/analyse.py scan /tmp/from-command.json; } > output/09-osv-scan-clean.txt
|
|
|
|
# The same build with one old library added.
|
|
mvn -B -q clean package -DskipTests -Pvulnerable >/dev/null 2>&1
|
|
java -Djarmode=tools -jar $JAR sbom > /tmp/vulnerable.json
|
|
{ echo "scanned: $(date -u +%Y-%m-%d)"; python3 scripts/analyse.py scan /tmp/vulnerable.json; } > output/10-osv-scan-vulnerable.txt
|
|
|
|
mvn -B -q clean package -DskipTests >/dev/null 2>&1
|
|
echo "done: $(ls output | wc -l) files in output/"
|