Skip to content

/ sw360

Latest release
sw360-11.0.0-M1
Latest release

@mcjaeger mcjaeger released this Sep 15, 2020 · 51 commits to master since this release

The changes for this release incorporate a larger jump from the previous release, because it changes the sw360 infrastructure to the following versions:

  • From Couchdb 1.X to Couchdb 2.X and Couchdb Lucene 2.1
  • From Java 8 to Java 11 - tested with the OpenJDK
  • From Liferay Community Edition 7.2.1 to 7.3.3
  • From thrift 0.11 to 0.13

Accordingly, also the vagrant project has changed: the current latest master of sw360/sw360vagrant builds with Java-11-based versions of sw360 (onwards from commit 0269392 at https://github.com/sw360/sw360vagrant).

Apart from the changes to the infrastructure, a number of nice new features are introduced, including:

  • A Japanese language file for SW360
  • Multiple values for external ids for the same keys
  • A completely new health check service for better monitoring of an sw360 installation
  • Improvements on project handling

For corrections and further changes on the infrastructure, please refer to the listed commits below.

Migrations

For existing installations, a data migration is required. Please go to the readme file in scripts/migrations to see more information:

https://github.com/eclipse/sw360/blob/master/scripts/migrations/README.md

For running the migrations scripts, you will need python and the couchdb package.

Credits

The following users have contributed to the source code since the last release (in order of appearance):

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

And many thanks to all the other contributions in presentation, issues, discussions!

Features

  • 60f82182 feat(ProjectReleaseRelation): Added new Field comment, createdOn, createdBy in ProjectReleaseRelation
  • c4342f38 feat(ui): Added link to project button from project detail view
  • 137b46a7 feat(language): add Japanese properties
  • 4d4184d3 feat(ProjectUI):Added Expand/Collapse All and Search in AttachmentUsageTable
  • 1b4f2362 feat(project-report): Layout and content update in project report
  • 1ee05b59 feat(ComponentUI): Added new filters in Advance search
  • 30ce4db1 feat(ExternalIds): Change file permission
  • 2442e1f2 feat(ExternalIds): Change file permission and fix typo of special character
  • 753d3889 feat(ExternalIds): Add comments to Component, Release and Project rest APIs
  • 0049dd3b feat(ExternalIds): Add byExternalIds views migration scripts, and upgrade to new version 11.0.0-SNAPSHOT
  • bb2f2950 feat(ExternalIds): 1. Handle EscapeXml for external id value, 2. Fix "Upon update of existing project or Component or Release without any change in External IDs"
  • 6ec67338 feat(REST): Whitelisting field in REST API response
  • 5ee02f75 feat(EditProjectUI): Release table in edit project page should be sorted and omit vendor name
  • c0bf7132 feat(CRView): Clearing Request Comments enhancements

Corrections

  • 73894c08 fix(resource-server): Resolve logback conflict
  • 40f4a3aa fix(ui): Prevent resubmission of form for Project, Component, Vendor, Moderation inorder to prevent loss of data.
  • 6b484677 fix(ui): Fixed download license disclosure error upon selection of corrupted attachment
  • b8446dc1 fix(license): Fixed the NullPointerException and addressed code duplication
  • a92d2677 fix(byExternalIdView): Fixed the byExternalIds view not working if the value is number
  • f62a685f fix(Language_ja): change datatables.lang's URL
  • d65be244 fix(ImportSPDXBOM): Set Default value[Default_Category] to categories field of Component if found null or empty
  • fda56f18 Fix: 'Download license archive' button in Admin>'import & Export' page is not working #906
  • 56eb7074 Fix: import spdx information #927 #915 and change quotes
  • 538b1aa7 fix(license): Fixed the license loading issue

Infrastructure

  • c0685187 chore(script): Added support to uninstall the current thrift version
  • 14b1a4af chore(deps): Bump jackson-databind in /backend/src/src-fossology
  • 4f7234cc chore(java): Support for Liferay 7.3.3 GA4
  • d4c6983c chore(java): Fixed Deployment issues
  • 5d484ee1 chore(java): Updated Spring version
  • d247a0ff chore(java): updating test deps for java 11
  • 3a5958b6 chore(java): migrating to openjdk java version 11
  • c5f82e0e chore(logging): Added a library containing the log4j2 classes
  • aa6d5ae0 chore(logging): Fixed test failures caused by NoClassDefFound errors
  • fe659050 chore(logging): Updated OSGi package imports
  • 68b91bcc chore(logging): More tweaks of logging dependencies
  • e4060da6 chore(logging): Switched logging configuration to log4j2 format
  • ebc8f852 chore(logging): Upgraded from log4j 1 to log4j 2
  • 7866a852 chore(logging): Removed unused dependency to logback
  • 465fc5fa chore(couchdb): Support CouchDb Lucene 2.1.0 with CouchDb 2.1.2 and backward compatibility
  • bbabafd7 chore(Portlet): Rename Moderation portlet to Requests
  • f512b867 chore(changelog): fixing formatting
  • a6d07505 chore(release): changing pom file for 10.0.0-SNAPSHOT
Assets 2
sw360-10.0.0-M1

@mcjaeger mcjaeger released this Jul 13, 2020 · 126 commits to master since this release

Again, another data model change, new major version. Please see the script 018_remove_unwanted_field_from_clearing_request.py in the directory scripts/migrations to change the data model accordingly. The script is necessary for existing clearing request records; not executing the script will lead to malfunction of the sw360 application.

The update improves also runtime stability, because the escaping when displaying quotes has been improved: previously, special characters such as quotes have compromised the rendering of the page. Now, the content is rendered in a correct way.

Further improvements include:

  • The ability to split releases from a component and assign this release to another component. This is the opposite case of merging components. On one hand it can undo mistaken component merges. On the other hand, user input, creating a release at the wrong component, can be corrected now.
  • a new REST endpoint to request all details from a larger list in one REST call.
  • a new REST endpoint to delete attachments from the REST API

More features include the ability to search for IDs when linking releases to projects or enhancements to the clearing request structures.

Features

  • ef6170e1 feat(attachments): Evaluate check status before deletion.
  • ea6d31ad feat(CRUI): Modifications in Clearing Request table in moderation tab.
  • 90dbdb52 feat(attachments): Updated REST documentation.
  • 220f991f feat(attachments): ComponentController can now delete attachments.
  • 5f504aef feat(attachments): ReleaseController now supports deleting attachments.
  • 2930cea5 feat(attachments): Added function to prepare deleting attachments.
  • 8adb9147 feat(attachments): Implemented ThriftAttachmentServiceProvider.
  • daa3b3fb feat(attachments): Introduced ThriftServiceProvider interface.
  • 5783cc3b feat(rest): Whitelisting project 'state' and 'phaseOutSince' field.
  • fc0c7e43 feat(ui/search): Search using rel. id and added link to the release in the search result.
  • 2ec0e6d9 feat(REST): Added new allDetails Parameter to List Projects and List Releases API to fetch records with all details.
  • c0bf7132 feat(CRView): Clearing Request Comments enhancements.
  • 8528ecfe feat(SplitComponentUI): Move Component data like releases and attachments from Source Component to Target Component.

Corrections

  • 9c01170b fix(escapeXML): Added missing escapeXML, to prevent js script execution and rendering break due to single or double quotes, Added missing escapeXml to merge-split Component, merge releases, license details view, list-details-edit view of project, component and release.
  • 887533ba fix(ProjectModeration): Fixed isWriteActionAllowedOnProject check for project update, Fixed incorrect value for Visibility in Edit Project view which has existing moderation request.
Assets 2
sw360-9.0.0-M1

@mcjaeger mcjaeger released this Jun 23, 2020 · 158 commits to master since this release

This release brings new features which also change the data model. Therefore, a major version step is justified. Major new features are:

  • Support for custom field layout using the referring Liferay mechanism, fully transparent with the REST API using additional data fields
  • Changelog for changed data for projects, components and releases
  • Reordered sections in detail view
  • A completely new view Clearing Status offering tree and list view

Besides bug fixes and features correct bugs so far. In order to fix a bug with the REST API, note that a migration script should be executed. It corrects a missing value for the status of the release which is also now automatically set when creating releases using the REST API (and not only in the Web user interface).

Features

  • a2e65103 feat(PreferenceUI): Enabled Email notification for CR
  • 49311164 feat(ProjectUI): Custom Field for Additional data in Project
  • 1d3423cb feat(ReadmeOss): Filter linked project from ReadmeOss based on selection
  • 03000401 feat(ProjectUI): Unified view of Linked Project and Releases, Clearing status, Linked Release Hierarchy. View includes tree view and list view
  • 89714248 feat: Support custom fields in additionalData group in Component and Release page
  • 04b57fd1 feat(ChangeLogs): Revision history of Document

Corrections

  • fb09ccee fix(MigrationScript): Update releases with empty clearingState to default value - NEW_CLEARING
  • 7bbd4235 fix(ClearingStatus): Tree View Release name getting truncated, Sort for Project mainline state and Clearing State in List View fixed , added search filter
  • 4c7b0e72 fix(ClearingStatusView): Fixed uneven button height, console error related to createVulnerabilityTable, takes lot of time to load Clearing status list view for large dataset.
  • d1c3731f fix(ChangelogBasicInfoUI): Applied generic style and reordered the metadatas for Basic Info.
  • 78bff1ba fix(UI): Clearing Request and Obligations fixes
  • 79f5c9d4 fix(mergeComponent): Prevent multiple releases with same name and version for a component, which may occur during merge component
  • a4b44107 fix: Resolve conflict
  • cd4cba10 fix(Changelog): Fixed missing fields like componentType in Changelog history
  • 3ee65c9b fix(REST): Added default value(NEW_CLEARING) for Clearing status while create and update Release
  • 67875856 fix(spreadsheet-export): Project spreadsheet export returns blank spreadsheet
  • b91b9e2d fix(ui): Release overview from component details
  • cd29922a fix(UI): Clearing Request bug fix and improvements

Infrastructure

  • 79850290 chore(deps): Bump spring-security-core in /frontend/sw360-portlet
  • e1aabab1 chore(deps-dev): Bump dom4j in /backend/src/src-licenseinfo
Assets 2
sw360-8.2.0-M1

@mcjaeger mcjaeger released this Apr 22, 2020 · 207 commits to master since this release

Although there are only few commits listed below for this release, the change from 8.1 to 8.2 is huge: sw360 supports now an UI which can be extended with different languages.

With the initial pull request, the English and Vietnamese languages is supported. More languages can be supported. For this, a translation file must be added. Please see README_LANG.md in the root level of the project directory for more details.

Many thanks to the colleagues at Toshiba for providing this big feature to the community.

Features

  • 8bd91be feat: SW360 support multi-language update after review
  • 994ad5c feat: SW360 support multi-language

Corrections

  • ae45236 fix(mergeUI): Provided fix for error message on merge component, release, vendor.
Assets 2
sw360-8.1.0-M1

@mcjaeger mcjaeger released this Mar 17, 2020 · 217 commits to master since this release

A version upgrade is justified, because of a number of new features have been integrated: FOSSology scans can be now triggered over the SW360 REST API. By this feature, an upload, for example from sw360antenna, could also trigger the FOSSology scan right away. It requires FOSSology being integrated with sw360.

Another new endpoint is the query for SHA1 values of a file to check if that attachment is actually already found at some release. With this endpoint, one would not need to search for release names and version before making a new entry, but just search for the source code attachment using its SHA1 value to check if an upload has been performed already.

A third new feature is the ability to agree on a clearing job for the software components of a project or product. A project owner can now send to a clearing expert a request to perform the clearing of software components right from SW360.

Features

  • bb9f2ba feat(REST): Trigger FOSSology process and check status
  • 99e23dc feat(ObligationUI): Added new status fields for Obligation
  • d025c4a feat(rest): Attachement sha1 improvement
  • 9a53e7b feat(ProjectUI): Project Clearing Report

Corrections

  • 7bd1fd5 fix(UI/REST): Remove Trailing and leading whitespace for all fields in component, release and project
  • a2a4b16 fix(components): components listing limited to 200 entries both in UI and excel spreadseet
  • 0de1db1 fix(vulerability): vulnerability view breaks at backslash in description
  • 83e6f28 fix(REST): Updated upload attachment documentation

Chores

Assets 2
sw360-8.0.1-M1

@mcjaeger mcjaeger released this Feb 28, 2020 · 240 commits to master since this release

There is some small but very relevant bug in 8.0.0, which prevents the user from creating records in special conditions. Therefore, version 8.0.0 is deprecated and replaced by version 8.0.1.

Corrections

  • c20fa46 fix(component/release): Add component and release error in UI
Assets 2
Pre-release
sw360-8.0.0-M1
Pre-release

@mcjaeger mcjaeger released this Feb 23, 2020 · 245 commits to master since this release

It is not really that we like to ignore minor releases, but release 8 is coming because:

  • changes in the DB for external id handling, pls see migration script: scripts/migrations/016_update_byExternalIds_component_view.py
  • changes in the Thrift API, allowing for SPDX BOM import pls see: libraries/lib-datahandler/src/main/thrift/projects.thrift

And as a larger, very important feature, there is the SPDX BOM import there in a first version, adding two modes:

  • Import a project with linked releases from a SPDX BOM file
  • Import a list of components and releases from a SPDX BOM file

Moreover a very important feature or fix has been provided for ensuring that malformed REST requests do not lead to failure in the application. Previously, providing wrong typed references (for example: linking releases to a project) was accepted by the application and can lead to malfunction then. The following list lists the detailed changes since 7.0.1:

New Features

  • 712ba79 feat(rest): validate the linked document ids in the payload before updating it in the DB
  • f90fcc4 feat(bomImport): implement SPDX BOM import for projects and releases
  • 24999ce feat(AddProjectReleaseRelation): add a project release relation for source code snippets
  • 48de678 feat(REST): Patch Releases to Project

Corrections

  • d34d454 fix(ReleaseUI): fixed reload report in FOSSology Process
  • 336534a fix(REST): fixed search component by external id
  • bc28c54 fix(EditReleaseUI): Fixed missing functionality of button to delete release to release relation
  • e437a5b fix(spreadsheet-export): fixed the secuence of values based on headers
  • 4c0d5c9 fix(thrift): add should return ID on duplicate
  • 1d65e70 fix(html): fix minor bugs and styling
  • b7a83d6 fix(ui): saving attachment usage issue for source code bundle and others
Assets 2
sw360-7.0.1-M1

@mcjaeger mcjaeger released this Jan 30, 2020 · 270 commits to master since this release

After tagging 7.0.0, we found two bugs to be corrected to provide a sound SW360. Therefore, here a new tagged version of sw360. Everyone should use 7.0.1-M1 instead of 7.0.0.

Adding rolling version since last tag will prepare automated tagging with incrementing patch level, retaining manual tagging for major and minor version only.

Corrections

  • 0dcd109 fix(ProjectUI: fixed blank / non-responsive screen on project
  • da677b5 fix(ui): fix issue #762

Infrastructure

  • a37e24d chore(readme): adding some more badges
  • f1a7c63feat(chore): adding rolling versions based on commit count
Assets 2
Pre-release
sw360-7.0.0-M1
Pre-release

@mcjaeger mcjaeger released this Jan 22, 2020 · 280 commits to master since this release

Unfortunately this release has a bug, please consider the previous release or wait for 7.0.1.

The main reason for release version 7 is to have the license upgrade from EPL-1.0 to EPL-2.0. All contributing parties have submitted their consent by e-mail and on most cases also approved the referring pull request (#756).

Another change which justifies a major version jump is the required view update in the couchdb. Please see https://github.com/eclipse/sw360/blob/master/scripts/migrations/README.md for more information when migrating from an older version. The view update allows users to configure the My Projects portlet.

New Features

  • 9b92795 feat(docs): relicensing from EPL-1.0 to EPL-2.0
  • 66a4126 feat(Component/ReleaseUI): Added button to remove selected vendor for component and release
  • 860aa3e feat(ProjectMigration): script to migrate a project field to new value
  • bd99641 feat(REST): Add parameter to GET release by name
  • 322c45d feat(WelcomePageUI): display configurable content for guidelines on welcome page
  • abac231 feat(fossology-pull-report): Added the button to pull the already generated report from fossology
  • 062c899 feat(HomePageUI): Listing of MyProjects is made configurable
  • 9849cb0 feat(licenseinfo): Added filter to exclude releases based on selected relationship

Corrections

  • 2a52475 fix(ProjectUI): Show proper error msg ,when loading of project fails due to access or dependency not found
  • 752bd78 fix(ProjectUI): fixed 'Project is temporarily unavailable' issue due to obligation feature
  • b32afd5 fix(ReleaseUI/REST): prevent cyclic link in release
  • 0d2647d fix(licenseinfo): White page while downloading license disclosure

Infrastructure

  • d22aaaf test: add script to start temporary couchdb with docker
  • df54014 chore(cleanup): drop unused and outdated code related to the codescoop integration
Assets 2
sw360-6.0.0-M1

@mcjaeger mcjaeger released this Jan 6, 2020 · 314 commits to master since this release

This release covers as the biggest change the new integration with the FOSSology REST API. It replaces the previous integration using an ssh login. It requires a migration of the couchdb database. More information about the scripts can be found in scripts/migrations/README.md.

Apart from changing the integration with FOSSology from ssh to the REST API, the entire data structure has been changed to be tool agnostic: A data structure for external tool requests replaces the info for the FOSSology upload. In future, albeit not supported today by the UI, also other tools could be integrated using the same data structure.

Warning Although the was much care for migrating existing data. It may happen with old datasets where source code attachments have been transferred to FOSSology using the ssh integration, the migration fails. For those datasets, the data must be changed manually. For example, just remove the status values.

Warning Migrations run per default in dry run mode, meaning that no changes are written to the database. After you have reviewed the changes (and checked that the scripts runs), you must change the DRY_RUN variable accordingly to False.

Two notable more features are provided by this release:

  • Management for project obligations
  • Merging release and vendor records added

New Features

  • 653a7e3 feat(ProjectUI): added project obligation logic on change of accepted license file
  • 648755a feat(REST): Added parameter to GET project by Group and Tag
  • 8eae7d3 feat(rest): get attachmentUsages for a project
  • b8549de feat(REST): linked release hierarchy is included in the response
  • 1bc03f9 feat(Project-UI) License Obligation tracker at Project Level
  • 1f506f2 feat(Rest): New end points for project/component/release usage summary
  • 176557a feat(moderation): Moderation requests to all clearing admin irrespective of their group
  • 82977a0 feature(merge): add wizard for merging vendors
  • e476f39 feat(rest): Added support to add role category fields while creating project
  • 86afeef feat(Projects): enabled Project/Release mainline state change only for clearing admins
  • 578f53c feat(fossology-rest): replaced ssh communication to fossology with REST
  • d19f658 feat(external-tool-request): added general datastructure for external tool requests
  • 71535e6 feat(Authorization): Added support to read keystore from central configuration
  • 43bd667 feature(release): add release merge wizard

Corrections

  • ca88b44 fix(ProjectUI): Added options to generate ReadmeOSS for main project only or main project with subprojects.
  • 51bc423 fix(rest): Error getting component/project with unknown creator
  • 7814e7e fix(ProjectUI): Obligation view for changes in linked release attachment
  • 255f54e fix(ui): Added missing tooltip
  • 00c3110 fix(businessrules): NPE in clearingStateSummaryComputer
  • 6bb0cc2 fix(project): Keep release mainline state as it is while cloning project
  • 7b488d5 fix(projectUI): NPE in SW360Utils.getApprovedClxAttachmentForRelease
  • 7181861 fix(LicenseInfo): NPE in ProjectPortlet.prepareLicenseInfo and downloadLicenseInfo
  • 7df48da fix(rest): License information generation based on attachment usages from rest.
  • 466185e fix(project): prevent cyclic link in linked projects
  • dcc4192 fix(projectUI): NPE in ProjectDatabaseHandler.setReleaseRelations
  • 6f02ae7 fix(component): incorrect release edit link in component edit page
  • 20211c9 fix(component): component merge not working
  • e1921d7 Fix(Project UI): Removed 'Unknown' from Project Clearing Team dropdown
  • 16c3452 fix(REST): added support for createdComment field for uploadAttachements
  • 2e0d776 fix(Project/Admin): Set to default text feature is not working correctly for Obligation
  • aa71a06 fix(Componnet): ComponentType field should be mandatory
  • c7a0737 fix(links): Fixed the incorrect links
Assets 2
You can’t perform that action at this time.