tree 4d799219448499b0b1f2be0ee6cfa5ce74542a6d
parent 22ffe868c4e6c062c8a5260f0815f26b7504237e
author Søren Gjesse <sgjesse@google.com> 1698239717 +0200
committer Søren Gjesse <sgjesse@google.com> 1698239717 +0200

Add spdx-gradle-plugin to generate the R8 SBOM

This is using the plugins extension point to provide the download location
from the origin.json which is present in the downloaded dependencies in
third_party/dependencies and third_party/dependencies_new.

The spdx-gradle-plugin currently needs some patches to
work with the R8 project. These changes are in a GitHub fork intended
for upstream merging.

For now the plugin is built from that fork, which is given version
0.2.0-r8-patch01.

To support depending on this locally built plugin the
create_local_maven_with_dependencies.py script has been updated to also
be able to pull from a local repository until the official plugin version
can be used.

An additional third_party/dependencies_plugin has been added for Gradle
plugin dependencies.

The steps to build the plugin:

Pull the spdx-gradle-plugin fork https://github.com/spdx/spdx-gradle-plugin
and build it locally from 567d00cec5f3244ba657189ca1a4d08a823ce1b3 (branch
r8-patch01).

Build:

  ./gradlew -Dmaven.repo.local=/tmp/spdx-gradle-plugin publishToMavenLocal

Update third_party/dependencies_plugin:

  tools/create_local_maven_with_dependencies.py \
    --no-upload \
    --studio <studio-path> \
    --plugin-deps \
    --include-maven-local /tmp/spdx-gradle-plugin

Bug: b/280466318
Change-Id: I980ab44afded4704ed43565cb5f19abd1314b16e