Add manufacturer information to SBOM metadata

src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java

@@ -18,8 +18,11 @@
  */
 package org.cyclonedx.maven;
 
+import java.util.stream.Collectors;
 import org.apache.commons.io.FileUtils;
 import org.apache.maven.artifact.Artifact;
+import org.apache.maven.model.Developer;
+import org.apache.maven.model.Organization;
 import org.apache.maven.model.Plugin;
 import org.apache.maven.model.PluginExecution;
 import org.apache.maven.plugin.AbstractMojo;
@@ -42,6 +45,8 @@
 import org.cyclonedx.model.LifecycleChoice;
 import org.cyclonedx.model.Lifecycles;
 import org.cyclonedx.model.Metadata;
+import org.cyclonedx.model.OrganizationalContact;
+import org.cyclonedx.model.OrganizationalEntity;
 import org.cyclonedx.model.Property;
 import org.cyclonedx.parsers.JsonParser;
 import org.cyclonedx.parsers.Parser;
@@ -355,13 +360,93 @@ public void execute() throws MojoExecutionException {
 
             final Component rootComponent = metadata.getComponent();
             componentMap.remove(rootComponent.getPurl());
+            setManufacturer(project, rootComponent);
 
             projectDependenciesConverter.cleanupBomDependencies(metadata, componentMap, dependencyMap);
 
             generateBom(analysis, metadata, new ArrayList<>(componentMap.values()), new ArrayList<>(dependencyMap.values()));
         }
     }
 
+    protected void setManufacturer(MavenProject mavenProject, Component projectBomComponent) {
+        getLog().debug("setManufacturer for " + mavenProject.getGroupId() + ":" +
+            mavenProject.getArtifactId() + ":" + mavenProject.getVersion());
+        List<Developer> developers = mavenProject.getDevelopers();
+        Organization organization = mavenProject.getOrganization();
+        if (organization != null || (developers != null && !developers.isEmpty())) {
+            projectBomComponent.setManufacturer(createManufacturer(organization, developers));
+        }
+    }
+
+    OrganizationalEntity createManufacturer(Organization organization, List<Developer> developers) {
+        OrganizationalEntity manufacturer = new OrganizationalEntity();
+        if (organization != null) {
+            if (isNotNullOrEmpty(organization.getName())) {
+                manufacturer.setName(organization.getName());
+            }
+            if (isNotNullOrEmpty(organization.getUrl())) {
+                addUrl(manufacturer, organization.getUrl());
+            }
+        }
+        if (developers != null) {
+            DeveloperInformation information = createListOfContacts(developers);
+            if (!information.getContacts().isEmpty()) {
+                manufacturer.setContacts(information.getContacts());
+            }
+            if (manufacturer.getName() == null) {
+                manufacturer.setName(information.getOrganization());
+            }
+            for (String url : information.getUrls()) {
+                addUrl(manufacturer, url);
+            }
+        }
+        getLog().debug("Set manufacturer information name=" + manufacturer.getName());
+        return manufacturer;
+    }
+
+    DeveloperInformation createListOfContacts(List<Developer> developers) {
+        DeveloperInformation developerInformation = new DeveloperInformation();
+        for (Developer developer : developers) {
+            OrganizationalContact contact = new OrganizationalContact();
+            if (isNotNullOrEmpty(developer.getName())) {
+                contact.setName(developer.getName());
+            }
+            if (isNotNullOrEmpty(developer.getEmail())) {
+                contact.setEmail(developer.getEmail());
+            }
+            developerInformation.addOrganizationalContact(contact);
+            developerInformation.setOrganization(developer.getOrganization());
+            developerInformation.addUrl(developer.getOrganizationUrl());
+            developerInformation.addUrl(developer.getUrl());
+        }
+        return developerInformation;
+    }
+
+    void addUrl(OrganizationalEntity manufacturer, String url) {
+        List<String> urls = manufacturer.getUrls();
+        if (urls == null) {
+            urls = new ArrayList<>();
+        }
+        urls.add(url);
+        manufacturer.setUrls(urls);
+    }
+
+    /**
+     * @param text Some text
+     * @return {@code true} if there is any text
+     */
+    boolean isNotNullOrEmpty(String text) {
+        return text != null && !text.trim().isEmpty();
+    }
+
+    /**
+     * @param text Some text
+     * @return {@code true} if there is any text
+     */
+    boolean isNullOrEmpty(String text) {
+        return !isNotNullOrEmpty(text);
+    }
+
     private Property newProperty(String name, String value) {
         Property property = new Property();
         property.setName(name);

src/main/java/org/cyclonedx/maven/CycloneDxAggregateMojo.java

@@ -129,6 +129,7 @@ protected String extractComponentsAndDependencies(final Set<String> topLevelComp
             final Map<String, Dependency> projectDependencies = bomDependencies.getDependencies();
 
             final Component projectBomComponent = convertMavenDependency(mavenProject.getArtifact());
+            setManufacturer(mavenProject, projectBomComponent);
             components.put(projectBomComponent.getPurl(), projectBomComponent);
             topLevelComponents.add(projectBomComponent.getPurl());
 

src/main/java/org/cyclonedx/maven/CycloneDxPackageMojo.java

@@ -68,6 +68,7 @@ protected String extractComponentsAndDependencies(Set<String> topLevelComponents
 
             final Component projectBomComponent = convertMavenDependency(mavenProject.getArtifact());
             components.put(projectBomComponent.getPurl(), projectBomComponent);
+            setManufacturer(mavenProject, projectBomComponent);
             topLevelComponents.add(projectBomComponent.getPurl());
 
             populateComponents(topLevelComponents, components, bomDependencies.getArtifacts(), null);

src/main/java/org/cyclonedx/maven/DeveloperInformation.java

@@ -0,0 +1,69 @@
+/*
+ * Copyright (c) Giesecke+Devrient Mobile Security GmbH 2018-2024
+ */
+package org.cyclonedx.maven;
+
+import java.util.ArrayList;
+import java.util.List;
+import org.cyclonedx.model.OrganizationalContact;
+
+/**
+ * Help class for parse a list of developers
+ */
+class DeveloperInformation {
+
+    private final List<OrganizationalContact> contacts = new ArrayList<>();
+    private String organization;
+    private final List<String> urls = new ArrayList<>();
+
+    /**
+     * Add contact information
+     *
+     * @param contact The contact
+     */
+    void addOrganizationalContact(OrganizationalContact contact) {
+        contacts.add(contact);
+    }
+
+    /**
+     * If Maven section "<organization>" is missing, see if we can find any organization information from
+     * a developers section
+     * @param organization The organization name
+     */
+    void setOrganization(String organization) {
+        if (this.organization == null && organization != null) {
+            this.organization = organization;
+        }
+    }
+
+    /**
+     * Add a defined url
+     * @param url The url
+     */
+    void addUrl(String url) {
+        if (url != null) {
+            urls.add(url);
+        }
+    }
+
+    /**
+     * @return List of contacts
+     */
+    public List<OrganizationalContact> getContacts() {
+        return contacts;
+    }
+
+    /**
+     * @return First organization name if found
+     */
+    public String getOrganization() {
+        return organization;
+    }
+
+    /**
+     * @return List of configured urls
+     */
+    public List<String> getUrls() {
+        return urls;
+    }
+}

src/test/java/org/cyclonedx/maven/BaseCycloneDxMojoTest.java

@@ -0,0 +1,169 @@
+package org.cyclonedx.maven;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import org.apache.maven.model.Developer;
+import org.apache.maven.model.Organization;
+import org.apache.maven.project.MavenProject;
+import org.cyclonedx.model.Component;
+import org.cyclonedx.model.Dependency;
+import org.cyclonedx.model.OrganizationalContact;
+import org.cyclonedx.model.OrganizationalEntity;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+class BaseCycloneDxMojoTest {
+
+    /**
+     * Minimal test class that can create an instance of BaseCycloneDxMojo
+     * so we can do some unit testing.
+     */
+    private static class BaseCycloneDxMojoImpl extends BaseCycloneDxMojo {
+
+        @Override
+        protected String extractComponentsAndDependencies(Set<String> topLevelComponents,
+            Map<String, Component> components, Map<String, Dependency> dependencies) {
+            return "";
+        }
+    }
+
+    @Test
+    @DisplayName("Using developers information only")
+    void setManufacturer1() {
+        BaseCycloneDxMojoImpl mojo = new BaseCycloneDxMojoImpl();
+        List<Developer> developers = new ArrayList<>();
+        Developer developer = new Developer();
+        developer.setName("Developer");
+        developers.add(developer);
+        developer = new Developer();
+        developer.setEmail("[email protected]");
+        developers.add(developer);
+        developer = new Developer();
+        developer.setOrganization("My Organization");
+        developers.add(developer);
+        developer = new Developer();
+        developer.setOrganizationUrl("http://foo.com");
+        developers.add(developer);
+        Component projectBomComponent = new Component();
+        MavenProject mavenProject = new MavenProject();
+        mavenProject.setDevelopers(developers);
+        mojo.setManufacturer(mavenProject, projectBomComponent);
+        OrganizationalEntity manufacturer = projectBomComponent.getManufacturer();
+        assertNotNull(manufacturer);
+        assertEquals(4, manufacturer.getContacts().size());
+        assertEquals("Developer", manufacturer.getContacts().get(0).getName());
+        assertEquals("My Organization", manufacturer.getName());
+    }
+
+    @Test
+    @DisplayName("Using developers information  with empty organization")
+    void setManufacturer2() {
+        BaseCycloneDxMojoImpl mojo = new BaseCycloneDxMojoImpl();
+        List<Developer> developers = new ArrayList<>();
+        Developer developer = new Developer();
+        developer.setName("Developer");
+        developers.add(developer);
+        developer = new Developer();
+        developer.setEmail("[email protected]");
+        developers.add(developer);
+        developer = new Developer();
+        developer.setOrganization("My Organization");
+        developers.add(developer);
+        developer = new Developer();
+        developer.setOrganizationUrl("http://foo.com");
+        developers.add(developer);
+        Component projectBomComponent = new Component();
+        MavenProject mavenProject = new MavenProject();
+        mavenProject.setDevelopers(developers);
+        mavenProject.setOrganization(new Organization());
+        mojo.setManufacturer(mavenProject, projectBomComponent);
+        OrganizationalEntity manufacturer = projectBomComponent.getManufacturer();
+        assertNotNull(manufacturer);
+        assertEquals(4, manufacturer.getContacts().size());
+        assertEquals("Developer", manufacturer.getContacts().get(0).getName());
+        assertEquals("My Organization", manufacturer.getName());
+    }
+
+    @Test
+    @DisplayName("Using developers and organization information")
+    void setManufacturer3() {
+        BaseCycloneDxMojoImpl mojo = new BaseCycloneDxMojoImpl();
+
+        MavenProject mavenProject = new MavenProject();
+        List<Developer> developers = new ArrayList<>();
+        Developer developer = new Developer();
+        developer.setName("Developer 2");
+        developer.setEmail("[email protected]");
+        developer.setOrganization("My Organization");
+        developer.setOrganizationUrl("http://foo.com");
+        developers.add(developer);
+        mavenProject.setDevelopers(developers);
+
+        Organization organization = new Organization();
+        organization.setName("My Company");
+        organization.setUrl("http://example.com");
+        mavenProject.setOrganization(organization);
+
+        Component projectBomComponent = new Component();
+        mojo.setManufacturer(mavenProject, projectBomComponent);
+        OrganizationalEntity manufacturer = projectBomComponent.getManufacturer();
+        assertNotNull(manufacturer);
+        assertEquals(1, manufacturer.getContacts().size());
+        assertEquals("Developer 2", manufacturer.getContacts().get(0).getName());
+        assertEquals("My Company", manufacturer.getName());
+    }
+
+    @Test
+    @DisplayName("Using organization information only")
+    void setManufacturer4() {
+        BaseCycloneDxMojoImpl mojo = new BaseCycloneDxMojoImpl();
+
+        MavenProject mavenProject = new MavenProject();
+        List<Developer> developers = new ArrayList<>();
+        Organization organization = new Organization();
+        organization.setName("My Organization");
+        organization.setUrl("http://example.org");
+        mavenProject.setOrganization(organization);
+
+        mavenProject.setDevelopers(developers);
+        mavenProject.setOrganization(organization);
+
+        Component projectBomComponent = new Component();
+        mojo.setManufacturer(mavenProject, projectBomComponent);
+        OrganizationalEntity manufacturer = projectBomComponent.getManufacturer();
+        assertNotNull(manufacturer);
+        assertNull(manufacturer.getContacts());
+        assertEquals("My Organization", manufacturer.getName());
+    }
+
+    @Test
+    @DisplayName("Verify addUrl")
+    void addUrl() {
+        BaseCycloneDxMojoImpl mojo = new BaseCycloneDxMojoImpl();
+        OrganizationalEntity manufacturer = new OrganizationalEntity();
+        assertNull(manufacturer.getUrls());
+        mojo.addUrl(manufacturer, "http://foo.com");
+        assertNotNull(manufacturer.getUrls());
+        assertEquals(1, manufacturer.getUrls().size());
+        mojo.addUrl(manufacturer, "http://example.com");
+        assertEquals(2, manufacturer.getUrls().size());
+    }
+
+
+    @Test
+    @DisplayName("Verify that check of String content works")
+    void isNotNullOrEmpty() {
+        BaseCycloneDxMojoImpl mojo = new BaseCycloneDxMojoImpl();
+        String value = null;
+        assertFalse(mojo.isNotNullOrEmpty(value));
+        value = "";
+        assertFalse(mojo.isNotNullOrEmpty(value));
+        value = "null";
+        assertTrue(mojo.isNotNullOrEmpty(value));
+    }
+
+}