From 703bdc2fe789264b7b4410431845dfe16c9d8b92 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Volkan=20Yaz=C4=B1c=C4=B1?= Date: Fri, 20 Oct 2023 15:57:05 +0200 Subject: [PATCH] Update `logging-parent` to version `10.2.0` and implement SBOM (apache/logging-log4j2#1707) --- pom.xml | 28 ++++------------ src/changelog/.0.x.x/add-sbom.xml | 24 ++++++++++++++ src/changelog/.0.x.x/add-website.xml | 2 +- .../.0.x.x/logging-parent-update.xml | 4 +-- .../.0.x.x/update_org_ow2_asm_asm_bom.xml | 2 +- src/changelog/0.1.0/.release.xml | 2 +- ...rovide_Maven_plugin_to_inline_location.xml | 2 +- ...2-673_Maven_Shade_resource_transformer.xml | 2 +- src/site/_release-notes/_0.x.x.adoc | 3 +- src/site/index.adoc | 32 +++++++++++++++++++ 10 files changed, 72 insertions(+), 29 deletions(-) create mode 100644 src/changelog/.0.x.x/add-sbom.xml diff --git a/pom.xml b/pom.xml index b09be1b..73d0ac7 100644 --- a/pom.xml +++ b/pom.xml @@ -15,7 +15,7 @@ ~ See the License for the specific language governing permissions and ~ limitations under the License. --> - + @@ -149,24 +153,6 @@ process-resources false - - - - keep - - diff --git a/src/changelog/.0.x.x/add-sbom.xml b/src/changelog/.0.x.x/add-sbom.xml new file mode 100644 index 0000000..3a9235e --- /dev/null +++ b/src/changelog/.0.x.x/add-sbom.xml @@ -0,0 +1,24 @@ + + + + + Started generating CycloneDX SBOM with the recent update of `logging-parent` to version `10.2.0` + diff --git a/src/changelog/.0.x.x/add-website.xml b/src/changelog/.0.x.x/add-website.xml index 1de2aa9..591b561 100644 --- a/src/changelog/.0.x.x/add-website.xml +++ b/src/changelog/.0.x.x/add-website.xml @@ -1,7 +1,7 @@ Started publishing https://logging.apache.org/log4j/transform[the project website] diff --git a/src/changelog/.0.x.x/logging-parent-update.xml b/src/changelog/.0.x.x/logging-parent-update.xml index 26fb730..82437f5 100644 --- a/src/changelog/.0.x.x/logging-parent-update.xml +++ b/src/changelog/.0.x.x/logging-parent-update.xml @@ -1,9 +1,9 @@ - Migrated to `logging-parent` 10.1.1 and adopted its CI and `pom.xml` infrastructure + Migrated `logging-parent` to version `10.2.0` and adopted its CI and `pom.xml` infrastructure diff --git a/src/changelog/.0.x.x/update_org_ow2_asm_asm_bom.xml b/src/changelog/.0.x.x/update_org_ow2_asm_asm_bom.xml index 5ac15cb..8fa5e2d 100644 --- a/src/changelog/.0.x.x/update_org_ow2_asm_asm_bom.xml +++ b/src/changelog/.0.x.x/update_org_ow2_asm_asm_bom.xml @@ -1,7 +1,7 @@ Update `org.ow2.asm:asm-bom` to version `9.6` diff --git a/src/changelog/0.1.0/.release.xml b/src/changelog/0.1.0/.release.xml index f51cb70..d082eec 100644 --- a/src/changelog/0.1.0/.release.xml +++ b/src/changelog/0.1.0/.release.xml @@ -17,5 +17,5 @@ --> diff --git a/src/changelog/0.1.0/LOG4J2-3638_Provide_Maven_plugin_to_inline_location.xml b/src/changelog/0.1.0/LOG4J2-3638_Provide_Maven_plugin_to_inline_location.xml index 6a3986a..6c67752 100644 --- a/src/changelog/0.1.0/LOG4J2-3638_Provide_Maven_plugin_to_inline_location.xml +++ b/src/changelog/0.1.0/LOG4J2-3638_Provide_Maven_plugin_to_inline_location.xml @@ -17,7 +17,7 @@ --> diff --git a/src/changelog/0.1.0/LOG4J2-673_Maven_Shade_resource_transformer.xml b/src/changelog/0.1.0/LOG4J2-673_Maven_Shade_resource_transformer.xml index bcdd328..277e99a 100644 --- a/src/changelog/0.1.0/LOG4J2-673_Maven_Shade_resource_transformer.xml +++ b/src/changelog/0.1.0/LOG4J2-673_Maven_Shade_resource_transformer.xml @@ -17,7 +17,7 @@ --> diff --git a/src/site/_release-notes/_0.x.x.adoc b/src/site/_release-notes/_0.x.x.adoc index 560662d..4f7c4b6 100644 --- a/src/site/_release-notes/_0.x.x.adoc +++ b/src/site/_release-notes/_0.x.x.adoc @@ -43,9 +43,10 @@ This is the second release of the project. ==== Added +* Started generating CycloneDX SBOM with the recent update of `logging-parent` to version `10.2.0` * Started publishing https://logging.apache.org/log4j/transform[the project website] ==== Changed -* Migrated to `logging-parent` 10.1.1 and adopted its CI and `pom.xml` infrastructure +* Migrated `logging-parent` to version `10.2.0` and adopted its CI and `pom.xml` infrastructure * Update `org.ow2.asm:asm-bom` to version `9.6` diff --git a/src/site/index.adoc b/src/site/index.adoc index dedb768..4ae4b4d 100644 --- a/src/site/index.adoc +++ b/src/site/index.adoc @@ -57,6 +57,38 @@ In accordance with the Apache Software Foundation's release https://infra.apache See xref:#release-instructions[the release instructions] for details. +[#maven-bom] +=== Maven Bill of Materials (BOM) + +To keep your {project-name} module versions aligned, a https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#bill-of-materials-bom-poms[Maven Bill of Materials (BOM) POM] is provided for your convenience. + +To use this with Maven, add the dependency listed below to your `pom.xml` file. +Note that the `` nesting and the `import` instruction. +This will _import_ all modules bundled with the associated Log4j release to your `dependencyManagement`. +As a result, you don't have to specify versions of the imported modules (`log4j-weaver`, etc.) while using them as a ``. + +.`pom.xml` snippet importing `log4j-transform-bom` +[source,subs="+attributes"] +---- + + + + org.apache.logging.log4j + log4j-transform-bom + {project-version} + import + pom + + + +---- + +[#cyclonedx-sbom] +=== CycloneDX Software Bill of Materials (SBOM) + +Starting with version `0.2.0`, {project-name} distributes https://cyclonedx.org/capabilities/sbom/[CyclenoDX Software Bill of Materials (SBOM)] along with each deployed artifact. +This is streamlined by `logging-parent`, see https://logging.apache.org/logging-parent/latest/#cyclonedx-sbom[its website] for details. + [#support] == Support