Merge pull request #7930 from corda/merge-release/os/4.12-release/os/4.13-2025-05-06-48

ENT-12844: Merging forward updates from release/os/4.12 to release/os/4.13 - 2025-05-06

buildSrc/src/main/groovy/corda.common-publishing.gradle

@@ -36,6 +36,40 @@ if (System.getenv('CORDA_ARTIFACTORY_USERNAME') != null || project.hasProperty('
                 }
             }
         }
+
+        // Publish the default jar for fat-jar sub-modules that do not currently publish their dependencies.
+        // These are not for external consumption.
+        // We must generate a jar which has a pom.xml with a full dependency list for vulnerability tools to evaluate.
+        // Only do this for builds done within R3.
+        def projectDict = [
+                "testing:testserver": "corda-testserver",
+                "tools:explorer": "corda-tools-explorer",
+                "opentelemetry:opentelemetry-driver": "corda-opentelemetry-driver",
+                "tools:network-builder": "corda-tools-network-builder",
+                "node:capsule": "corda"
+        ]
+        def lookupName = "${project.parent.name}:${project.name}".toString()
+
+        if (projectDict.containsKey(lookupName)) {
+            pluginManager.apply('maven-publish')
+            def jarName = projectDict[lookupName]
+            publishing {
+                publications {
+                    "$jarName-jarPublication"(MavenPublication) {
+                        from components.java
+                        artifactId = "$jarName-thin-with-deps"
+                        pom {
+                            name = "$jarName-thin-with-deps"
+                            description = "Corda ${project.name} for vulnerability checking."
+                        }
+                    }
+                }
+            }
+
+            jar {
+                archiveClassifier = 'R3-internal'
+            }
+        }
     }
 } else {
     logger.info("External user - using standard maven publishing")

node/capsule/build.gradle

@@ -21,6 +21,9 @@ dependencies {
     capsuleRuntime "com.typesafe:config:$typesafe_config_version"
     compileOnly "com.typesafe:config:$typesafe_config_version"
     testRuntimeOnly "com.typesafe:config:$typesafe_config_version"
+    
+    // 'implementation' for the benefit of the security-scannable POM file
+    implementation "com.typesafe:config:$typesafe_config_version"
 
     // Capsule is a library for building independently executable fat JARs.
     // We only need this dependency to compile our Caplet against.
@@ -31,7 +34,7 @@ dependencies {
     testImplementation "junit:junit:$junit_version"
 }
 
-jar.enabled = false
+jar.enabled = true
 
 capsule {
     version capsule_version

opentelemetry/opentelemetry-driver/build.gradle

@@ -18,7 +18,7 @@ shadowJar {
 }
 
 jar {
-    enabled = false
+    enabled = true
 }
 
 publishing {
@@ -26,7 +26,6 @@ publishing {
         shadow(MavenPublication) { publication ->
             artifactId 'corda-opentelemetry-driver'
             artifact shadowJar
-            from components.java
         }
     }
 }

tools/network-builder/build.gradle

@@ -88,7 +88,7 @@ tasks.register('buildNetworkBuilder') {
 }
 
 jar {
-    enabled = false
+    enabled = true
 }
 
 publishing {