Metadata Directly In SBOM

[Scanteianu]

also includes changes from #4121 but this is the way @andrew-m-leonard suggested for configure args in #3917 .

[github-actions]

Thank you for creating a pull request!
If you have not done so already, please familiarise yourself with our Contributing Guidelines and FAQ, even if you have contributed to the Adoptium project before. GitHub actions will now run a set of jobs against your PR that will lint and unit test your changes. Keep an eye out for the results from these on the latest commit you submitted. For more information, please see our testing documentation.

[Scanteianu]

so far...
added "configure_args" as "configure.txt", added CONFIGURE_ARGS as "CONFIGURE_ARGS"
unsure where to find "BUILD_CONFIGURATION_param", "openjdk_source",

@sxa @andrew-m-leonard might be useful to go through the metadata file, see what we need and what we don't. I would appreciate pointers to where to get the keys we need that we don't have

[andrew-m-leonard]

I would prefer to keep #4121 in it's own PR, so changes are indepenedent

[Scanteianu]

the idea was that hopefully #4121 would go first, and then the diff of this PR would just be the changes here (will update branch). When they go in, they would be independent changes (I'm assuming squash-and-merge policy), so can be independently reverted or cherrypicked

[sxa]

Looks like the wsl one has been merged so we should be able to rebase this on top of master now too get those changes "removed" from this PR 😀

[Scanteianu]

the diff is now updated, so if it's squashed and merged only the relevant changes will be in this pr

[andrew-m-leonard]

Although we don't strictly have a naming convention yet for the SBOM properties, i think we should follow roughly what's already there, and use a property name with lowercase , no spaces and use underscores, eg."configure_args", "configure_txt"

[andrew-m-leonard]

so far... added "configure_args" as "configure.txt", added CONFIGURE_ARGS as "CONFIGURE_ARGS" unsure where to find "BUILD_CONFIGURATION_param", "openjdk_source",

@sxa @andrew-m-leonard might be useful to go through the metadata file, see what we need and what we don't. I would appreciate pointers to where to get the keys we need that we don't have

We already have "openjdk source" SHA:

temurin-build/sbin/build.sh

Line 1102 in d1c15a6

addSBOMComponentPropertyFromFile "${javaHome}" "${classpath}" "${sbomJson}" "${componentName}" "OpenJDK Source Commit" "${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[TARGET_DIR]}/metadata/openjdkSource.txt"

and "Build Config" :

temurin-build/sbin/build.sh

Line 1117 in d1c15a6

addSBOMComponentProperty "${javaHome}" "${classpath}" "${sbomJson}" "${componentName}" "Build Config" "${built_config}"

it does raise the issue of naming convention for these things.... maybe best to look at that in the "restructuring issue"

[sxa]

it does raise the issue of naming convention for these things.... maybe best to look at that in the "restructuring issue"

Yeah I suggest that we don't use spaces for the new Configure Args value as part of this PR, but we should look at the others as part of any future restructure (and definitely if we end up publishing an XML one - let's get that right from the start).