Skip to content

Commit db05880

Browse files
jlhuerfanorjlhuerfanor
committed
NEXUS-42442: Switched to declarative pipeline syntax
 - Added Dockerfile.sbom-deployer to include missing tools - Include missing headers to files required by licence-check step - Using dockerizedRunPipeline function to dockerize the script.
1 parent 9571127 commit db05880

13 files changed

+146
-113
lines changed

‎CONTRIBUTORS.md

+8-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
<!--
22
3-
Copyright (c) 2016-present Sonatype, Inc.
3+
Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
4+
Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
5+
"Sonatype" is a trademark of Sonatype, Inc.
6+
7+
-->
8+
<!--
49
510
Licensed under the Apache License, Version 2.0 (the "License");
611
you may not use this file except in compliance with the License.
@@ -14,6 +19,8 @@
1419
See the License for the specific language governing permissions and
1520
limitations under the License.
1621
22+
-->
23+
1724
-->
1825
A lot of awesome people have contributed to this project! Here they are:
1926

‎Dockerfile

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
1-
# Copyright (c) 2016-present Sonatype, Inc.
21
#
2+
# Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
3+
# Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
4+
# "Sonatype" is a trademark of Sonatype, Inc.
5+
#
6+
37
# Licensed under the Apache License, Version 2.0 (the "License");
48
# you may not use this file except in compliance with the License.
59
# You may obtain a copy of the License at

‎Jenkinsfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/*
22
* Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
3-
* Includes the third-party code listed at http://links.sonatype.com/products/nexus/attributions.
3+
* Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
44
* "Sonatype" is a trademark of Sonatype, Inc.
55
*/
66
@Library(['private-pipeline-library', 'jenkins-shared']) _

‎Jenkinsfile-sbom-release

+99-100
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1-
@Library(['private-pipeline-library', 'jenkins-shared']) _
1+
/*
2+
* Copyright (c) 2011-present Sonatype, Inc. All rights reserved.
3+
* Includes the third-party code listed at http://links.sonatype.com/products/clm/attributions.
4+
* "Sonatype" is a trademark of Sonatype, Inc.
5+
*/
26

3-
import com.sonatype.jenkins.pipeline.OsTools
7+
@Library(['private-pipeline-library', 'jenkins-shared']) _
48

59
import groovy.json.JsonSlurper
610

@@ -18,103 +22,6 @@ properties([
1822
])
1923
])
2024

21-
22-
node('ubuntu-zion') {
23-
def buildDir = "./.sbom-build/job-${env.BUILD_NUMBER}"
24-
def ubiImageName = ''
25-
def ubiImageVersion = ''
26-
def nexusVersion = ''
27-
def dockerImageVersion = ''
28-
def ubiSbomAvailable = true
29-
30-
try {
31-
stage('Inspect Release Image') {
32-
// Get RedHat UBI version
33-
sh "docker pull sonatype/nexus3:${params.docker_nexus3_tag}"
34-
35-
nexusVersion = sh(script: "docker inspect sonatype/nexus3:${params.docker_nexus3_tag} \
36-
| jq -r '.[0].Config.Labels.version' ",
37-
returnStdout: true).trim()
38-
dockerImageVersion = sh(script: "docker inspect sonatype/nexus3:${params.docker_nexus3_tag} \
39-
| jq -r '.[0].Config.Labels.release' ",
40-
returnStdout: true).trim()
41-
42-
def ubiImageId = sh(script: "docker inspect sonatype/nexus3:${params.docker_nexus3_tag} \
43-
| jq -r '.[0].Config.Labels.\"base-image-ref\"' \
44-
| sed -En 's/^.+image=(.+)\$/\\1/p'",
45-
returnStdout: true).trim()
46-
47-
ubiImageName = sh(script: "curl -s -X 'GET' '${REDHAT_CONTAINER_API_URL_BASE}/images/id/${ubiImageId}' -H 'accept: application/json' \
48-
| jq -r '.brew.build' \
49-
| sed -En 's/(ubi[0-9]+-minimal)-container-([0-9]+\\.[0-9]+-[0-9]+\\.?[0-9]*)/\\1-\\2/p'",
50-
returnStdout: true).trim()
51-
52-
ubiImageVersion = sh(script: "curl -s -X 'GET' '${REDHAT_CONTAINER_API_URL_BASE}/images/id/${ubiImageId}' -H 'accept: application/json' \
53-
| jq -r '.brew.build' \
54-
| sed -En 's/ubi[0-9]+-minimal-container-([0-9]+\\.[0-9]+-[0-9]+\\.?[0-9]*)/\\1/p'",
55-
returnStdout: true).trim()
56-
}
57-
stage('Download SBOMs') {
58-
sh "mkdir -p ${buildDir}/spdx && mkdir -p ${buildDir}/cyclonedx"
59-
60-
// Get nexus-internal SBOM
61-
getComponentSbom(buildDir, "nexus-internal", nexusVersion)
62-
// Get nxrm-db-migrator SBOM
63-
getComponentSbom(buildDir, "nxrm-db-migrator", nexusVersion)
64-
// Get docker-nexus3 SBOM
65-
getComponentSbom(buildDir, "docker-nexus3", dockerImageVersion)
66-
// Get UBI Minimal SBOM
67-
ubiSbomAvailable = getUbiImageSbom(buildDir, ubiImageName, ubiImageVersion)
68-
69-
sh "echo 'Available SPDX SBOMS' && ls ${buildDir}/spdx"
70-
sh "echo 'Available CycloneDx SBOMS' && ls ${buildDir}/cyclonedx"
71-
}
72-
73-
stage('Merge supported sboms') {
74-
def pythonEnvDir = "${buildDir}/.spdxmerge"
75-
76-
sh """#!/bin/bash
77-
if ! [ -d "${buildDir}/SPDXMerge" ]; then
78-
git clone https://github.com/philips-software/SPDXMerge.git '${buildDir}/SPDXMerge'
79-
fi
80-
"""
81-
82-
sh """#!/bin/bash
83-
if mkdir -p '${pythonEnvDir}' && python3 -m venv '${pythonEnvDir}' && ls '${pythonEnvDir}' && . '${pythonEnvDir}/bin/activate'; then
84-
if python3 -m pip install -r '${buildDir}/SPDXMerge/requirements.txt' \
85-
&& python3 -m pip install setuptools \
86-
&& python3 '${buildDir}/SPDXMerge/spdxmerge/SPDXMerge.py' --docpath '${buildDir}/spdx' --outpath '${buildDir}/' \
87-
--name "docker-nexus3-aggregate" --mergetype "1" --author "Sonatype Inc." --email "[email protected]" \
88-
--docnamespace "https://sonatype.sonatype.app/platform/ui/links/application/docker-nexus3/report/b0c5f7f12ac84b439ded3ff255bd5eef" \
89-
--filetype J \
90-
&& mv '${buildDir}/merged-SBoM-deep.json' '${buildDir}/spdx/docker-nexus3-aggregate-${dockerImageVersion}-spdx.json'; then
91-
echo 'Merge completed!'
92-
else
93-
echo 'Merge failed!'
94-
FAILED=1
95-
fi
96-
97-
deactivate
98-
fi
99-
100-
exit \${FAILED:-0}
101-
"""
102-
}
103-
104-
stage('Publish SBOMs') {
105-
if (ubiSbomAvailable) {
106-
publishComponent(buildDir, "ubi-minimal", ubiImageVersion, false)
107-
}
108-
publishComponent(buildDir, "nexus-internal", nexusVersion)
109-
publishComponent(buildDir, "nxrm-db-migrator", nexusVersion)
110-
publishComponent(buildDir, "docker-nexus3", dockerImageVersion)
111-
publishComponent(buildDir, "docker-nexus3-aggregate", dockerImageVersion, false)
112-
}
113-
} finally {
114-
OsTools.runSafe(this, "rm -rf '${buildDir}'")
115-
}
116-
}
117-
11825
def getComponentSbom(String buildDir, String componentName, String componentVersion) {
11926
def componentInfo = getComponentInfo(componentName)
12027
def componentId = componentInfo.applications[0].id
@@ -192,4 +99,96 @@ def publishComponent(String buildDir, String componentName, String componentVers
19299
]) {
193100
sh(publishCommand)
194101
}
195-
}
102+
}
103+
104+
def mergeSpdxComponents(String buildDir, String finalComponentName, String finalComponentVersion, String finalNamespace) {
105+
def pythonEnvDir = "${buildDir}/.spdxmerge"
106+
107+
sh """#!/bin/bash
108+
if ! [ -d "${buildDir}/SPDXMerge" ]; then
109+
git clone https://github.com/philips-software/SPDXMerge.git '${buildDir}/SPDXMerge'
110+
fi
111+
"""
112+
113+
sh """#!/bin/bash
114+
if mkdir -p '${pythonEnvDir}' && python3 -m venv '${pythonEnvDir}' && ls '${pythonEnvDir}' && . '${pythonEnvDir}/bin/activate'; then
115+
if python3 -m pip install -r '${buildDir}/SPDXMerge/requirements.txt' \
116+
&& python3 -m pip install setuptools \
117+
&& python3 '${buildDir}/SPDXMerge/spdxmerge/SPDXMerge.py' --docpath '${buildDir}/spdx' --outpath '${buildDir}/' \
118+
--name "docker-nexus3-aggregate" --mergetype "1" --author "Sonatype Inc." --email "[email protected]" \
119+
--docnamespace "${finalNamespace}" \
120+
--filetype J \
121+
&& mv '${buildDir}/merged-SBoM-deep.json' '${buildDir}/spdx/${finalComponentName}-${finalComponentVersion}-spdx.json'; then
122+
echo 'Merge completed!'
123+
else
124+
echo 'Merge failed!'
125+
FAILED=1
126+
fi
127+
128+
deactivate
129+
fi
130+
131+
exit \${FAILED:-0}
132+
"""
133+
}
134+
135+
dockerizedRunPipeline(
136+
skipVulnerabilityScan: true,
137+
pathToDockerfile: "./build-images/Dockerfile.sbom-deployer",
138+
prepare: {
139+
withSonatypeDockerRegistry() {
140+
sh "docker pull sonatype/nexus3:${params.docker_nexus3_tag}"
141+
env['nexusVersion'] = sh(script: "docker inspect sonatype/nexus3:${params.docker_nexus3_tag} \
142+
| jq -r '.[0].Config.Labels.version' ",
143+
returnStdout: true).trim()
144+
env['dockerImageVersion'] = sh(script: "docker inspect sonatype/nexus3:${params.docker_nexus3_tag} \
145+
| jq -r '.[0].Config.Labels.release' ",
146+
returnStdout: true).trim()
147+
env['ubiImageId'] = sh(script: "docker inspect sonatype/nexus3:${params.docker_nexus3_tag} \
148+
| jq -r '.[0].Config.Labels.\"base-image-ref\"' \
149+
| sed -En 's/^.+image=(.+)\$/\\1/p'",
150+
returnStdout: true).trim()
151+
}
152+
},
153+
run: {
154+
def buildDir = "./.sbom-build/job-${env.BUILD_NUMBER}"
155+
def ubiImageName = sh(script: "curl -s -X 'GET' '${REDHAT_CONTAINER_API_URL_BASE}/images/id/${env.ubiImageId}' -H 'accept: application/json' \
156+
| jq -r '.brew.build' \
157+
| sed -En 's/(ubi[0-9]+-minimal)-container-([0-9]+\\.[0-9]+-[0-9]+\\.?[0-9]*)/\\1-\\2/p'",
158+
returnStdout: true).trim()
159+
def ubiImageVersion = sh(script: "curl -s -X 'GET' '${REDHAT_CONTAINER_API_URL_BASE}/images/id/${env.ubiImageId}' -H 'accept: application/json' \
160+
| jq -r '.brew.build' \
161+
| sed -En 's/ubi[0-9]+-minimal-container-([0-9]+\\.[0-9]+-[0-9]+\\.?[0-9]*)/\\1/p'",
162+
returnStdout: true).trim()
163+
164+
// Download SBOMs
165+
sh "mkdir -p ${buildDir}/spdx && mkdir -p ${buildDir}/cyclonedx"
166+
167+
// Get nexus-internal SBOM
168+
getComponentSbom(buildDir, "nexus-internal", env.nexusVersion)
169+
// Get nxrm-db-migrator SBOM
170+
getComponentSbom(buildDir, "nxrm-db-migrator", env.nexusVersion)
171+
// Get docker-nexus3 SBOM
172+
getComponentSbom(buildDir, "docker-nexus3", env.dockerImageVersion)
173+
// Get UBI Minimal SBOM
174+
def ubiSbomAvailable = getUbiImageSbom(buildDir, ubiImageName, ubiImageVersion)
175+
176+
sh "echo 'Available SPDX SBOMS' && ls ${buildDir}/spdx"
177+
sh "echo 'Available CycloneDx SBOMS' && ls ${buildDir}/cyclonedx"
178+
179+
// Merge supported sboms
180+
def dockerImageNamespace = sh(script: "cat ${buildDir}/spdx/docker-nexus3-${env.dockerImageVersion}-spdx.json | jq -r '.documentNamespace'", returnStdout: true).trim()
181+
mergeSpdxComponents(buildDir, "docker-nexus3-aggregate", env.dockerImageVersion, dockerImageNamespace)
182+
183+
// Publish SBOMs
184+
if (ubiSbomAvailable) {
185+
publishComponent(buildDir, "ubi-minimal", ubiImageVersion, false)
186+
}
187+
publishComponent(buildDir, "nexus-internal", env.nexusVersion)
188+
publishComponent(buildDir, "nxrm-db-migrator", env.nexusVersion)
189+
publishComponent(buildDir, "docker-nexus3", env.dockerImageVersion)
190+
publishComponent(buildDir, "docker-nexus3-aggregate", env.dockerImageVersion, false)
191+
192+
sh "rm -rf '${buildDir}'"
193+
}
194+
)

‎README.md

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
<!--
22
3-
Copyright (c) 2016-present Sonatype, Inc.
3+
Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
4+
Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
5+
"Sonatype" is a trademark of Sonatype, Inc.
46
7+
-->
8+
<!--
59
Licensed under the Apache License, Version 2.0 (the "License");
610
you may not use this file except in compliance with the License.
711
You may obtain a copy of the License at
@@ -15,7 +19,6 @@
1519
limitations under the License.
1620
1721
-->
18-
1922
# Sonatype Nexus Repository Docker: sonatype/nexus3
2023

2124
[![Join the chat at https://gitter.im/sonatype/nexus-developers](https://badges.gitter.im/sonatype/nexus-developers.svg)](https://gitter.im/sonatype/nexus-developers?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)

‎SECURITY.md

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
<!--
22
3-
Copyright (c) 2011-present Sonatype, Inc. All rights reserved.
4-
Includes the third-party code listed at http://links.sonatype.com/products/clm/attributions.
3+
Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
4+
Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
55
"Sonatype" is a trademark of Sonatype, Inc.
66
77
-->
8-
98
# Reporting Security Vulnerabilities
109

1110
## When to report

‎build-images/Dockerfile.sbom-deployer

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM docker-all.repo.sonatype.com/python:3.12
2+
3+
RUN apt-get update && apt-get install -y jq curl

‎build_red_hat_image.sh

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
#!/usr/bin/env bash
22
#
3-
# Copyright (c) 2017-present Sonatype, Inc.
3+
# Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
4+
# Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
5+
# "Sonatype" is a trademark of Sonatype, Inc.
46
#
7+
58
# Licensed under the Apache License, Version 2.0 (the "License");
69
# you may not use this file except in compliance with the License.
710
# You may obtain a copy of the License at

‎header.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
2+
Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
3+
"Sonatype" is a trademark of Sonatype, Inc.

‎rh-docker/help.md

+7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
<!--
2+
3+
Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
4+
Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
5+
"Sonatype" is a trademark of Sonatype, Inc.
6+
7+
-->
18
% NEXUS(1) Container Image Pages
29
% Sonatype
310
% December 15, 2017

‎rh-docker/uid_entrypoint.sh

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
#!/bin/sh
22
#
3-
# Copyright:: Copyright (c) 2017-present Sonatype, Inc. Apache License, Version 2.0.
3+
# Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
4+
# Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
5+
# "Sonatype" is a trademark of Sonatype, Inc.
46
#
7+
58
# arbitrary uid recognition at runtime - for OpenShift deployments
69
USER_ID=$(id -u)
710
if [[ ${USER_UID} != ${USER_ID} ]]; then

‎rh-docker/uid_template.sh

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
#!/bin/sh
22
#
3-
# Copyright:: Copyright (c) 2017-present Sonatype, Inc. Apache License, Version 2.0.
3+
# Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
4+
# Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
5+
# "Sonatype" is a trademark of Sonatype, Inc.
46
#
7+
58
# arbitrary uid recognition at runtime - for OpenShift deployments
69
sed "s@${USER_NAME}:x:${USER_UID}:@${USER_NAME}:x:\${USER_ID}:@g" /etc/passwd > /etc/passwd.template

‎scripts/BaseImageReference.groovy

+1-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
/*
22
* Copyright (c) 2016-present Sonatype, Inc. All rights reserved.
3-
* Includes the third-party code listed at http://links.sonatype.com/products/nexus/attributions.
3+
* Includes the third-party code listed at http://links.sonatype.com/products/nxrm/attributions.
44
* "Sonatype" is a trademark of Sonatype, Inc.
55
*/
6-
76
interface BaseImageReference
87
{
98
String getReference()

0 commit comments

Comments
 (0)