refactoring/527_spdx-sbom (#542)

#527: SPDX SBOM.

---

Co-authored-by: Christoph Pirkl <4711730+kaklakariada@users.noreply.github.com>

Author: redcatbear

.github/workflows/build.yml

@@ -91,6 +91,14 @@ jobs:
             !product/target/openfasttrace-*-sources.jar
           if-no-files-found: error
 
+      - name: Upload SPDX SBOM
+        uses: actions/upload-artifact@v7
+        if: ${{ env.DEFAULT_OS == matrix.os && env.DEFAULT_JAVA == matrix.java }}
+        with:
+          name: openfasttrace-spdx
+          path: product/target/site/*.spdx3.json
+          if-no-files-found: error
+
       - name: Run self-trace
         run: ./oft-self-trace.sh
 

.github/workflows/github_release.sh

@@ -13,18 +13,21 @@ project_version=$(grep "<revision>" "$pom_file" | sed --regexp-extended 's/\s*<r
 readonly project_version
 echo "Read project version '$project_version' from $pom_file"
 
-# Calculate checksum
 readonly artifact_path="$base_dir/product/target/openfasttrace-${project_version}.jar"
-echo "Calculate sha256sum for file '$artifact_path'"
-file_dir="$(dirname "$artifact_path")"
-readonly file_dir
-file_name=$(basename "$artifact_path")
-readonly file_name
-cd "$file_dir"
-readonly checksum_file_name="${file_name}.sha256"
-sha256sum "$file_name" > "$checksum_file_name"
-readonly checksum_file_path="$file_dir/$checksum_file_name"
-cd "$base_dir"
+readonly sbom_path="$base_dir/product/target/site/org.itsallcode.openfasttrace_openfasttrace-${project_version}.spdx3.json"
+
+calculate_checksum() {
+    local file_path="$1"
+    local checksum_file_path="${file_path}.sha256"
+    readonly file_path checksum_file_path
+    echo "Calculating SHA-256 checksum for '$file_path'"
+    (cd "$(dirname "$file_path")" && sha256sum "$(basename "$file_path")") > "$checksum_file_path"
+}
+
+calculate_checksum "$artifact_path"
+readonly artifact_checksum_path="${artifact_path}.sha256"
+calculate_checksum "$sbom_path"
+readonly sbom_checksum_path="${sbom_path}.sha256"
 
 
 # Create GitHub release
@@ -39,8 +42,11 @@ echo "Git tag      : $tag"
 echo "Title        : $title"
 echo "Changes file : $changes_file"
 echo "Artifact file: $artifact_path"
-echo "Checksum file: $checksum_file_path"
+echo "Artifact checksum: $artifact_checksum_path"
+echo "SBOM file    : $sbom_path"
+echo "SBOM checksum: $sbom_checksum_path"
 
-release_url=$(gh release create --latest --title "$title" --notes "$notes" --target main "$tag" "$artifact_path" "$checksum_file_path")
+release_url=$(gh release create --latest --title "$title" --notes "$notes" --target main "$tag" \
+    "$artifact_path" "$artifact_checksum_path" "$sbom_path" "$sbom_checksum_path")
 readonly release_url
 echo "Release URL: $release_url"

SECURITY.md

@@ -15,3 +15,7 @@ If you discover a potential security issue, please report it privately via [GitH
 - **Disclose** the details publicly once a fix is available and users have had time to update.
 
 While we don't offer bug bounties, we'd be happy to publicly acknowledge your contribution in the advisory.
+
+## Software Bill of Materials (SBOM)
+
+Starting with version 4.10.0, each GitHub release includes an SPDX Software Bill of Materials (SBOM) for the OpenFastTrace product JAR and a SHA-256 checksum for the SBOM.

api/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-api</artifactId>
     <name>OpenFastTrace API</name>
+    <description>Public API of OpenFastTrace</description>
     <parent>
         <relativePath>../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

core/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-core</artifactId>
     <name>OpenFastTrace Core</name>
+    <description>OpenFastTrace core logic (specification items, linking and base modules for importers, exporters and reporters)</description>
     <parent>
         <relativePath>../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

doc/changes/changes_4.10.0.md

@@ -0,0 +1,17 @@
+# OpenFastTrace 4.10.0, released 2026-08-??
+
+Code name: Lifecycle Information and SPDX3 SBOM
+
+## Summary
+
+The project lifecycle documentation now describes planned deprecations and removals in OFT 5.0.0, including migration guidance for the SpecObject format and short coverage tags.
+
+Each release now includes an SPDX 3 SBOM for the product JAR and a SHA-256 checksum for the SBOM.
+
+## Feature
+
+* #542: CI and releases now provide an SPDX 3 SBOM.
+
+## Documentation
+
+* #579: Documented planned deprecations and removals.

doc/developer_guide.md

@@ -237,6 +237,21 @@ This project is configured to produce exactly the same artifacts each time when
 
 The build will use the last Git commit timestamp as timestamp for files in `.jar` archives.
 
+## SBOM
+
+The project generates an [SPDX](https://spdx.dev/) SBOM using the [SPDX Maven Plugin](https://github.com/spdx/spdx-maven-plugin).
+
+The SPDX plugin runs during Maven's `package` phase and creates an SBOM for each Maven module. The product SBOM describes the product and its production dependencies.
+
+Build OFT and create the SBOMs with a single command:
+
+```shell
+mvn package
+```
+
+> [!IMPORTANT]
+> OFT does not include third-party packages in the production JAR. The JRE is provided by the machine on which OFT runs. Therefore, the product SBOM contains only OFT modules. Test dependencies are excluded because they are not relevant to OFT users.
+
 ## Creating a Release
 
 **NOTE**: This currently only works for release version numbers, not SNAPSHOT versions.

exporter/common/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-exporter-common</artifactId>
     <name>OpenFastTrace Exporters Utils</name>
+    <description>Common logic for OpenFastTrace exporters</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

exporter/specobject/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-exporter-specobject</artifactId>
     <name>OpenFastTrace Specobject Exporter</name>
+    <description>Specobject (ReqM2 exchange format) exporter</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>

importer/lightweightmarkup/pom.xml

@@ -4,6 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>openfasttrace-importer-lightweightmarkup</artifactId>
     <name>OpenFastTrace Lightweight Markup Importer Base</name>
+    <description>Base module for OpenFastTrace importers based on lightweight markup languages (e.g., Markdown and RST)</description>
     <parent>
         <relativePath>../../openfasttrace-mc-deployable-parent/pom.xml</relativePath>
         <groupId>org.itsallcode.openfasttrace</groupId>