feat: web UI SBOMs

CHANGELOG.md

@@ -8,6 +8,9 @@ All notable changes to this project will be documented in this file.
 
 - airflow, superset, druid, nifi: Add SBOMs for the frontend (npm) dependencies ([#1600]).
 - nifi: Backport NIFI-15958 to log periodic progress while waiting for the content archive scan and provenance re-index, for `2.6.0`, `2.7.2`, and `2.9.0` ([#1611]).
+- hbase: Add an SBOM for the web UI (npm) dependencies, which are unpacked from webjars and therefore not covered by the CycloneDX Maven plugin ([#1620]).
+- trino: Add SBOMs for the web UI, both for the two npm projects behind it and for the pre-built JavaScript vendored into the source tree ([#1620]).
+- hadoop, spark: Add SBOMs for the pre-built JavaScript that is vendored into the source tree for the HDFS and Spark web UIs ([#1620]).
 
 ### Changed
 
@@ -29,6 +32,7 @@ All notable changes to this project will be documented in this file.
 [#1600]: https://github.com/stackabletech/docker-images/pull/1600
 [#1611]: https://github.com/stackabletech/docker-images/pull/1611
 [#1616]: https://github.com/stackabletech/docker-images/pull/1616
+[#1620]: https://github.com/stackabletech/docker-images/pull/1620
 
 ## [26.7.0] - 2026-07-21
 

boil.toml

@@ -6,6 +6,13 @@ DELETE_CACHES = "true"
 # CycloneDX specification version used for the SBOMs generated by cdxgen.
 # 1.6 is the lowest version cdxgen 13 accepts as a generation target.
 CDXGEN_SPEC_VERSION = "1.6"
+# Node version used to run cdxgen in the builders that need it. It is unrelated to any product
+# and to the Node version that a product uses to build its frontend, so it is configured once
+# here instead of per product version. Products that pin `cdxgen-nodejs-version` in their own
+# boil-config.toml override this value.
+# Find the latest release here: https://github.com/nodejs/node/releases
+# renovate: datasource=node-version packageName=node
+CDXGEN_NODEJS_VERSION = "24.19.0"
 
 [metadata]
 documentation = "https://docs.stackable.tech/home/stable/"

hadoop/hadoop/Dockerfile

@@ -12,6 +12,7 @@ ARG AZURE_STORAGE_VERSION
 ARG AZURE_KEYVAULT_CORE_VERSION
 ARG ANALYTICSACCELERATOR_S3_VERSION
 ARG STACKABLE_USER_UID
+ARG CDXGEN_SPEC_VERSION
 
 WORKDIR /stackable
 
@@ -21,8 +22,9 @@ COPY --chown=${STACKABLE_USER_UID}:0 shared/protobuf/stackable/patches/${PROTOBU
 RUN <<EOF
 microdnf update
 # libstdc++ is a runtime dependency for boost,
-# automake and libtool are needed to build protobuf
-microdnf install libstdc++ automake libtool
+# automake and libtool are needed to build protobuf,
+# python3 runs shared/sbom/vendored_js.py, see the invocation further down
+microdnf install libstdc++ automake libtool python3
 microdnf clean all
 rm -rf /var/cache/yum
 mkdir /opt/protobuf
@@ -67,6 +69,8 @@ WORKDIR /build
 COPY --chown=${STACKABLE_USER_UID}:0 hadoop/hadoop/stackable/patches/patchable.toml /build/src/hadoop/hadoop/stackable/patches/patchable.toml
 COPY --chown=${STACKABLE_USER_UID}:0 hadoop/hadoop/stackable/patches/${PRODUCT_VERSION} /build/src/hadoop/hadoop/stackable/patches/${PRODUCT_VERSION}
 COPY --chown=${STACKABLE_USER_UID}:0 hadoop/hadoop/stackable/fuse_dfs_wrapper /build
+COPY --chown=${STACKABLE_USER_UID}:0 shared/sbom/vendored_js.py /build/vendored_js.py
+COPY --chown=${STACKABLE_USER_UID}:0 hadoop/hadoop/stackable/vendored-js/${PRODUCT_VERSION}.json /build/vendored-js.json
 USER ${STACKABLE_USER_UID}
 # Hadoop Pipes requires libtirpc to build, whose headers are not packaged in RedHat UBI, so skip building this module
 # Build from source to enable FUSE module, and to apply custom patches.
@@ -115,6 +119,18 @@ cp -r hadoop-dist/target/hadoop-${NEW_VERSION} /stackable/hadoop-${NEW_VERSION}
 sed -i "s/${NEW_VERSION}/${ORIGINAL_VERSION}/g" hadoop-dist/target/bom.json
 mv hadoop-dist/target/bom.json /stackable/hadoop-${NEW_VERSION}/hadoop-${NEW_VERSION}.cdx.json
 
+# Create the SBOM of the third-party JavaScript that is checked into the source tree, mostly
+# for the HDFS web UI. These are pre-built files without any package manifest, so no SBOM
+# generator can discover them and they are instead recorded in vendored-js.json. That manifest
+# pins the SHA-256 of every file it describes, so this fails the build if a Hadoop upgrade
+# changed any of them and the recorded versions have to be revisited.
+python3 /build/vendored_js.py bom \
+  /build/vendored-js.json \
+  . \
+  "/stackable/hadoop-${NEW_VERSION}/hadoop-webapps-${NEW_VERSION}.cdx.json" \
+  "${ORIGINAL_VERSION}" \
+  "${CDXGEN_SPEC_VERSION}"
+
 # HDFS fuse-dfs is not part of the regular dist output, so we need to copy it in ourselves
 cp hadoop-hdfs-project/hadoop-hdfs-native-client/target/main/native/fuse-dfs/fuse_dfs /stackable/hadoop-${NEW_VERSION}/bin
 

hadoop/hadoop/stackable/vendored-js/3.3.6.json

@@ -0,0 +1,124 @@
+{
+  "name": "hadoop-webapps",
+  "scan-dirs": [
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps",
+    "hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/webapps",
+    "hadoop-tools/hadoop-sls/src/main/html"
+  ],
+  "libraries": [
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/bootstrap-3.4.1/js/bootstrap.js",
+      "purl": "pkg:npm/bootstrap@3.4.1",
+      "license": "MIT",
+      "sha256": "dbd2a35e72edc7d6bde483481a912f1c38aa57fab2747d9b071d317339ee03a2"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/bootstrap-3.4.1/js/bootstrap.min.js",
+      "purl": "pkg:npm/bootstrap@3.4.1",
+      "license": "MIT",
+      "sha256": "9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/bootstrap-3.4.1/js/npm.js",
+      "purl": "pkg:npm/bootstrap@3.4.1",
+      "license": "MIT",
+      "note": "Part of the Bootstrap distribution, it only requires the other Bootstrap files. It is unchanged from 3.3.0 to 3.4.1, so hashing cannot tell those releases apart and the version comes from the directory it sits in.",
+      "sha256": "c7aa82a1aa7d45224a38d926d2adaff7fe4aef5bcdafa2a47bdac057f4422c2d"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/bootstrap-3.4.1/js/bootstrap-editable.min.js",
+      "purl": "pkg:npm/x-editable@1.5.0",
+      "license": "MIT",
+      "note": "Version taken from the file header. x-editable has a single npm release, 1.5.1, so 1.5.0 was never published there, but advisories are matched against version ranges, so the npm purl is still the useful identity.",
+      "sha256": "8e4041866b100f3afe72c70c1dd5d6405729ba0e327f07e14c4023d9d657753c"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/d3-v4.1.1.min.js",
+      "purl": "pkg:npm/d3@4.1.0",
+      "license": "BSD-3-Clause",
+      "note": "The file name claims 4.1.1, but the file is byte-identical to build/d3.min.js of npm d3 4.1.0 and its header says 4.1.0.",
+      "sha256": "3181906226d79dd39f94bfb7267fce2d077809cc3a23f23e87ea3f02ffae799d"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/dust-full-2.0.0.min.js",
+      "purl": "pkg:npm/dustjs-linkedin@2.0.1",
+      "license": "MIT",
+      "note": "The file is byte-identical in dustjs-linkedin 2.0.1 through 2.2.10, so the release it was taken from cannot be determined by hashing and the lowest is recorded. The file name claims 2.0.0, which is the version of the dust build it contains rather than a release that ships this file.",
+      "sha256": "f11ba668337b8b61319b430164f631648b41949887bb8a7b9cc515f87bba3e3b"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/dust-helpers-1.1.1.min.js",
+      "purl": "pkg:npm/dustjs-helpers@1.1.1",
+      "license": "MIT",
+      "note": "Version taken from the file name. The 1.1.1 release ships only the unminified dist/dust-helpers-1.1.1.js, so there is no published minified file to compare this copy with.",
+      "sha256": "ff65ffc9e919f9ab7922d82db9ea9d7840a7543001ccba2a8c4f11195a08a7f6"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/jquery-3.6.0.min.js",
+      "purl": "pkg:npm/jquery@3.6.0",
+      "license": "MIT",
+      "sha256": "80f04717f32ea0320c5e8618fbacedd1fee3a8775ad8292140a6113551d4b5b0",
+      "note": "The file is dist/jquery.min.js of the 3.6.0 release minus its trailing newline, so the code is that release unchanged."
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/jquery.dataTables.min.js",
+      "purl": "pkg:npm/datatables.net@1.10.7",
+      "license": "MIT",
+      "sha256": "7a101ba1668e04321dd15acb478546de82bea05c8887749c8532427577e5df7a",
+      "note": "Version taken from the file header. datatables.net on npm starts at 1.10.9, so there is no 1.10.7 tarball to compare with."
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/dataTables.bootstrap.js",
+      "purl": null,
+      "name": "datatables.net-bs",
+      "note": "The DataTables Bootstrap 3 integration. It carries no version and matches no published tarball, so it is recorded without a version.",
+      "sha256": "205a054048f80cde368d980a57a66112d2f548c89b8f7a0202b23d06ba624627"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/moment.min.js",
+      "purl": "pkg:npm/moment@2.22.1",
+      "license": "MIT",
+      "sha256": "853e11d64268a12da71524bc7e1bb1f960243f3eee045f7839f796f1d23670e0",
+      "note": "The file is min/moment.min.js of the 2.22.1 release with a \"//! moment.js\" banner added, so the code is that release unchanged."
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/json-bignum.js",
+      "purl": null,
+      "name": "json-bignum",
+      "note": "Vendored from https://github.com/datalanche/json-bignum without a version and modified, so it matches no published tarball.",
+      "sha256": "243931ed9a223e3eabb3d7634d3ae9c735f5aa2ec6c5ba6ff54ce18c5dc47236"
+    },
+    {
+      "file": "hadoop-tools/hadoop-sls/src/main/html/js/thirdparty/jquery.js",
+      "purl": "pkg:npm/jquery@3.5.1",
+      "license": "MIT",
+      "sha256": "416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37"
+    },
+    {
+      "file": "hadoop-tools/hadoop-sls/src/main/html/js/thirdparty/d3.v3.js",
+      "purl": "pkg:npm/d3@3.2.7",
+      "license": "BSD-3-Clause",
+      "note": "The file is d3.js of the 3.2.7 release with a BSD-3-Clause banner added and one trailing space removed, so the code is that release unchanged.",
+      "sha256": "2085bd03d15690b448e136c590d6982ed7397e730407fed1d414304c81761315"
+    },
+    {
+      "file": "hadoop-tools/hadoop-sls/src/main/html/js/thirdparty/bootstrap.min.js",
+      "purl": null,
+      "name": "bootstrap",
+      "license": "Apache-2.0",
+      "note": "Bootstrap 2.x, which was Apache-2.0 licensed. The file carries no version and npm has no 2.x release at all, jumping from 0.0.2 to 3.1.1, so no version is recorded. Its header says \"Copyright 2012 Twitter, Inc.\".",
+      "sha256": "eabb9d96942adad6cbfbf964a4fe53c5bc585dd330cb829665ee15bbf2ca4f1d"
+    }
+  ],
+  "own": [
+    "hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/webapps/router/explorer.js",
+    "hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/webapps/router/federationhealth.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/datanode/dn.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/hdfs/dfshealth.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/hdfs/explorer.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/journal/jn.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/secondary/snn.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/dfs-dust.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/rest-csrf.js"
+  ]
+}

hadoop/hadoop/stackable/vendored-js/3.4.2.json

@@ -0,0 +1,125 @@
+{
+  "name": "hadoop-webapps",
+  "scan-dirs": [
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps",
+    "hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/webapps",
+    "hadoop-tools/hadoop-sls/src/main/html"
+  ],
+  "libraries": [
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/bootstrap-3.4.1/js/bootstrap.js",
+      "purl": "pkg:npm/bootstrap@3.4.1",
+      "license": "MIT",
+      "sha256": "dbd2a35e72edc7d6bde483481a912f1c38aa57fab2747d9b071d317339ee03a2"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/bootstrap-3.4.1/js/bootstrap.min.js",
+      "purl": "pkg:npm/bootstrap@3.4.1",
+      "license": "MIT",
+      "sha256": "9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/bootstrap-3.4.1/js/npm.js",
+      "purl": "pkg:npm/bootstrap@3.4.1",
+      "license": "MIT",
+      "note": "Part of the Bootstrap distribution, it only requires the other Bootstrap files. It is unchanged from 3.3.0 to 3.4.1, so hashing cannot tell those releases apart and the version comes from the directory it sits in.",
+      "sha256": "c7aa82a1aa7d45224a38d926d2adaff7fe4aef5bcdafa2a47bdac057f4422c2d"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/bootstrap-3.4.1/js/bootstrap-editable.min.js",
+      "purl": "pkg:npm/x-editable@1.5.0",
+      "license": "MIT",
+      "note": "Version taken from the file header. x-editable has a single npm release, 1.5.1, so 1.5.0 was never published there, but advisories are matched against version ranges, so the npm purl is still the useful identity.",
+      "sha256": "8e4041866b100f3afe72c70c1dd5d6405729ba0e327f07e14c4023d9d657753c"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/d3-v4.1.1.min.js",
+      "purl": "pkg:npm/d3@4.1.0",
+      "license": "BSD-3-Clause",
+      "note": "The file name claims 4.1.1, but the file is byte-identical to build/d3.min.js of npm d3 4.1.0 and its header says 4.1.0.",
+      "sha256": "3181906226d79dd39f94bfb7267fce2d077809cc3a23f23e87ea3f02ffae799d"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/dust-full-2.0.0.min.js",
+      "purl": "pkg:npm/dustjs-linkedin@2.0.1",
+      "license": "MIT",
+      "note": "The file is byte-identical in dustjs-linkedin 2.0.1 through 2.2.10, so the release it was taken from cannot be determined by hashing and the lowest is recorded. The file name claims 2.0.0, which is the version of the dust build it contains rather than a release that ships this file.",
+      "sha256": "f11ba668337b8b61319b430164f631648b41949887bb8a7b9cc515f87bba3e3b"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/dust-helpers-1.1.1.min.js",
+      "purl": "pkg:npm/dustjs-helpers@1.1.1",
+      "license": "MIT",
+      "note": "Version taken from the file name. The 1.1.1 release ships only the unminified dist/dust-helpers-1.1.1.js, so there is no published minified file to compare this copy with.",
+      "sha256": "ff65ffc9e919f9ab7922d82db9ea9d7840a7543001ccba2a8c4f11195a08a7f6"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/jquery-3.6.0.min.js",
+      "purl": "pkg:npm/jquery@3.6.0",
+      "license": "MIT",
+      "sha256": "80f04717f32ea0320c5e8618fbacedd1fee3a8775ad8292140a6113551d4b5b0",
+      "note": "The file is dist/jquery.min.js of the 3.6.0 release minus its trailing newline, so the code is that release unchanged."
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/jquery.dataTables.min.js",
+      "purl": "pkg:npm/datatables.net@1.11.5",
+      "license": "MIT",
+      "sha256": "2e288f534e4f2a5b1f4d17cc62149068ab6ef1a8dac45832b387e000719f28a3",
+      "note": "Version taken from the file header. The npm release ships a jquery.dataTables.min.js of the same version, but compiled by Closure with different symbol names, so the two are not byte-identical."
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/dataTables.bootstrap.js",
+      "purl": null,
+      "name": "datatables.net-bs",
+      "note": "The DataTables Bootstrap 3 integration. It carries no version and matches no published tarball, so it is recorded without a version.",
+      "sha256": "205a054048f80cde368d980a57a66112d2f548c89b8f7a0202b23d06ba624627"
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/moment.min.js",
+      "purl": "pkg:npm/moment@2.29.4",
+      "license": "MIT",
+      "sha256": "9aec203698e15111ceda22d99911f578505e16d9dd92f17be8d31ca4e29f6990",
+      "note": "Version taken from the file header. The npm release ships a min/moment.min.js of the same version, but minified with different variable names, so the two are not byte-identical."
+    },
+    {
+      "file": "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/json-bignum.js",
+      "purl": null,
+      "name": "json-bignum",
+      "note": "Vendored from https://github.com/datalanche/json-bignum without a version and modified, so it matches no published tarball.",
+      "sha256": "243931ed9a223e3eabb3d7634d3ae9c735f5aa2ec6c5ba6ff54ce18c5dc47236"
+    },
+    {
+      "file": "hadoop-tools/hadoop-sls/src/main/html/js/thirdparty/jquery.js",
+      "purl": "pkg:npm/jquery@3.5.1",
+      "license": "MIT",
+      "sha256": "416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37"
+    },
+    {
+      "file": "hadoop-tools/hadoop-sls/src/main/html/js/thirdparty/d3.v3.js",
+      "purl": "pkg:npm/d3@3.2.7",
+      "license": "BSD-3-Clause",
+      "note": "The file is d3.js of the 3.2.7 release with a BSD-3-Clause banner added and one trailing space removed, so the code is that release unchanged.",
+      "sha256": "2085bd03d15690b448e136c590d6982ed7397e730407fed1d414304c81761315"
+    },
+    {
+      "file": "hadoop-tools/hadoop-sls/src/main/html/js/thirdparty/bootstrap.min.js",
+      "purl": null,
+      "name": "bootstrap",
+      "license": "Apache-2.0",
+      "note": "Bootstrap 2.x, which was Apache-2.0 licensed. The file carries no version and npm has no 2.x release at all, jumping from 0.0.2 to 3.1.1, so no version is recorded. Its header says \"Copyright 2012 Twitter, Inc.\".",
+      "sha256": "eabb9d96942adad6cbfbf964a4fe53c5bc585dd330cb829665ee15bbf2ca4f1d"
+    }
+  ],
+  "own": [
+    "hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/webapps/router/explorer.js",
+    "hadoop-hdfs-project/hadoop-hdfs-rbf/src/main/webapps/router/federationhealth.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/datanode/dn.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/hdfs/dfshealth.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/hdfs/explorer.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/journal/jn.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/secondary/snn.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/dfs-dust.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/histogram-hostip.js",
+    "hadoop-hdfs-project/hadoop-hdfs/src/main/webapps/static/rest-csrf.js"
+  ]
+}