From 7afb4d9e0572a870e1fbf1358698fc825f40823f Mon Sep 17 00:00:00 2001 From: koseokmin Date: Sat, 22 Aug 2026 23:31:40 +0900 Subject: [PATCH] =?UTF-8?q?toolchain=EC=9D=84=20Eclipse=20Temurin=EC=9C=BC?= =?UTF-8?q?=EB=A1=9C=20=EA=B3=A0=EC=A0=95=ED=95=9C=EB=8B=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vendor를 적지 않으면 설치된 아무 JDK 21이나 잡히므로, 표준가이드가 정한 배포판(openjdk21u-jdk_x64_windows_hotspot_21.0.5)과 다른 것으로 조용히 빌드될 수 있다. SBOM의 JDK 항목도 그 전제 위에 있다. 폐쇄망에서는 toolchain 자동 다운로드가 동작하지 않으므로 빌드 머신에 Temurin이 미리 설치되어 있어야 한다. Co-Authored-By: Claude Opus 5 --- build.gradle | 4 ++ .../AXHUB_MCP_Server_SBOM_CycloneDX1.5.xlsx | Bin 16279 -> 0 bytes ...B_MCP_Tool_Service_SBOM_CycloneDX1.5.json} | 6 +-- ...UB_MCP_Tool_Service_SBOM_CycloneDX1.5.xlsx | Bin 0 -> 15627 bytes docs/sbom/README.md | 43 +++++------------- 5 files changed, 19 insertions(+), 34 deletions(-) delete mode 100644 docs/sbom/AXHUB_MCP_Server_SBOM_CycloneDX1.5.xlsx rename docs/sbom/{AXHUB_MCP_Server_SBOM_CycloneDX1.5.json => AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.json} (97%) create mode 100644 docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.xlsx diff --git a/build.gradle b/build.gradle index dc62c3b..dce87b1 100644 --- a/build.gradle +++ b/build.gradle @@ -72,9 +72,13 @@ tasks.named('check') { group = 'io.shinhanlife.dap.biz.mcp' version = '0.1.0' +// 표준가이드가 정한 배포판은 Eclipse Temurin(openjdk21u-jdk_..._hotspot_21.0.5)이다. +// 벤더를 적지 않으면 설치된 아무 JDK나 잡히므로, 가이드와 다른 배포판으로 조용히 빌드되는 것을 막는다. +// 폐쇄망에서는 toolchain 자동 다운로드가 동작하지 않으므로 빌드 머신에 Temurin이 미리 설치되어 있어야 한다. java { toolchain { languageVersion = JavaLanguageVersion.of(21) + vendor = JvmVendorSpec.ADOPTIUM } } diff --git a/docs/sbom/AXHUB_MCP_Server_SBOM_CycloneDX1.5.xlsx b/docs/sbom/AXHUB_MCP_Server_SBOM_CycloneDX1.5.xlsx deleted file mode 100644 index c38b6e0a6c7817870c4d07249cb53e061973a27f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 16279 zcmZ|01C%6Dwl!R~ZQHhO+qP|W*|yo$W!tuG+pg-W`g>;n_syGr?`5utT(MT3oe?)q z?0xUavlXO)K~Mky03ZO=T#$6dMr0*Y{v1vH*%1D0Cicb(PWBGY^o9-&bRM=gvNN*K z{R}W*yFE&7Eg6w`#c(3Lk-42Sbgm)Il(xa|H&-D1cAlQ2*oAZvL}bnBqIYzMw#-Z; zuma1(?|c*E1(5}Z-qnm-fzfqX@WuFezypQ0D*+*lFdUQnEwyKhbYkYNGpR!E^<0W% z1N#~*Ty^C56`MFv2q#{od{M~KoN3gc-%-jFsLHv=(A(|=sURAQgi00T^@zUgc3sN}km%=v_vJT8pd>gv?0l{FUm@Uq1F zvven$sSSK>QOQmoU!c`h$Td)R@U$^O)SaP&EOy8@KDWMvUw zOf0OMfXLAdt*^QQ%*e`5@;2uH9b{n^Cn`HHp86%5t-^peGaW09c4iwAzm_<@BGqPx z4nnucdQ{`&KWLLk>D4jy&4;{Z(h9Z0hwhD?KKI^ zOSg^2jNmId{18Nq7#mNMgkb+3aW;gBRM@LT+4d|R5Sp`(X;JZ$Qx4CEYdWLT(D3AY z4}&%OjpdFO`t4nHCK5zJ2F$XW+g_*=8NDVgOMn3m-!WvQfz6;O2x$+LiDjK#Z7h1? z<@3gkEwx}vn*t1R69Zp88ViA06-6z3eS*d#eCAiw36&VrB0ywyL9({+#``y$q2KG< ze5NyJT)0eub`01W1pd?ZWruQF;d?6mgS}Sf{A$)CbMq1bL1VtjpzV^+MGL49Ot9Qs zIU3V$KF@dwp@=0-aacWgat_&&>v+Yzsn_cjo%B#V)V=8e*}A0l!zNy0KA^F!o>rduiC z02MngGS^vsj5V%dI zCwZ4jh_h@UE^{H9I%US{6RW{?4YQc%@%jRN%VvebNx;ShGRJNZBMi3exW%g>iOsC) zN2C_wGs0xUa%w^gY<4UUHqb&Ep7W5KZ$$j9S;?BjXE1s>mEbzPoB)TIsK@^2yVFte zh&_0r98#HAg^n5^pSgMil6|K^6K0>SexXauHZ-v>;*01~hwx-&{AWxo;6<65kX^xQ zR(Zd|SonV8F+qXewc+s{d3ivwrw(^2R0nwje$TD5_gB0I^>X^t`OcKwv_0|`%(t); z`b-;XoFf%inkwlI~(%A+UHyYY4c52w>?>%oBKHFQ>-nz;Yr0E3BNBSyeU_r69sU)EhYcXhDxuZeZH8G&g2meu{2z0NcYQU&H3``wg=pz#? zdg^eJrlWr_mw2#IYT9I1L+OrbOQgivZ<&s4UNOFHTGywFJEN+7U)ycP+lVSR^QBoe zng@d@hX#!#VVsO!DpmM^soZ@+Ejg&l(Id*-jFg7ad2l@9D5uQi>Ch{tn%B57S18I$g!b=`Tw2 zBUDaro)ifsvK9uE5Z&qE<|fI?J$mJxCeSumg~?RW@>^pW?~Q4P(_w>a8(8lc znMSzSug^C!G61o{sJp#J{*5%7yV3hDkRa>#@<#FV)-H_CVueh6m}n*z^HNkLXAG3R;F7=*|HdM$#WO4mP6DVN zV@5Mu(V-j^&*s++Y;FHw?A}#W58!_ah-)*jEDSUNzyJjR0LH%r#NFP>+S$U?)Ww

BRDBT%mZ#-0c z#(w-XXl>C(T^4-UO3_0Oc%+s$mm>NdQ!{e)rkv7Bo>@gkoO$AJHPDy>bkF) zoBYY={kNAUh+7lfntuA5$G4UmH%R2p8EBHJg*tNb-smnaLqbggJ9oqh^r9EMRCx7i zFP=#H17rCR*MudT922>VEBMB)kk@I*sJI^2I zo%}2~`P&>+ho)>F%n=h|3wpD{b=hJQns2P$Zv<75x$E|cQ&6AiUFqJI@Up3*8BMG>KUR8&O`Nj%icB<(qmcnbRJ?eg4o z$(Z7$Fo}ij^yqe9aWOjpi7=x2;yg;;!X6}iz379(8PcksvTZp1hR}r8HG2SUHC{g( zD^RXKHUBo`yq+PC@+%m)-tiCs!@#v0JV1O$;S~=@Vi9qV;*q?W6HQGChwTI;tPUq> zT?XH7N8$1q=nA+u_JGBFi6sQT4R{Bl^WZq_b4&|zo3X{Bf^9r>SN|4t2>{1nJ7U@O za=&IQ*m>oESY(WLuGE8kenQ79NY8=>%7RW;^bJI8JR>wQ)S{E4qd4H3{b;uUUCn3?)MHhhs5Xi+3I z&T_!OreTdF#yjFvA_r9qiD1Wwn*oRU@Z;{tB3Cmc;5cJTwf$x$^2NIh$hIT3k4&H% zo`CHl6fO;by1+UE)Rmqr?27kmcM~+odszp4UV^GjACASEN3RTunq?nE1z$xtGZ-@% zR0v`&^d6_7-8qvZx>*Q_2`(~ffg926LeVm9BL~ePS={LX_m#rZO+(Vz+ELm~UQZ7G z@>~1s2q$h1ax|f@oNB?Zi)1|?Q*`GrMATk7S8OPOO`P3b+0%^6qtTG7#j>JaU~+yM zvRU}(fY|RY87EA4Gzp?*$JbYJ?C?03N5lY*bJdQ=W<#Rq{^Fw?*JA6PRS9aTJq6OX zF&e5!Q58NF$5^bW0j<^{P#0mn@T@L?Sss?4whJ*>n`Q+?ys7rUrx%dsbyMovuZw`s z;&V#QUy+gw1U|iB*j7!6r8kgC8VuxxId}jjbz2NoxXS~6{tqlVajj!|>TvM31O|q& zFSYjj`U~K$KSpE|;n@;9o0N75O3=P{U0=!9404B@*v96SzG%=r)y!r?U?X2Gi(fa5 z6G}cuEbc*ST#7T|fC<*)S=ytDGZM=e8p}(>@-_JM$3kR`GvtsoUHSyJbYfPd@P0iW zsHSXWmnL2HVI$QZxJeB+{#xyWG8_OTDJ#0#>z;~gFT5Ow>Ym~#p^+*sLS@ut=)(;# z7q!exX&2c!UK2qRO(jv~Tgq1*UX8CaV(*1ycUgU<~ z(P?c*Ue8o$l{{0+CV0$E!dM^Za&Tf^9yz5PpRmYpugjqMm?IJtYB9MA8jc|b7g`-W zN1RX&hD1f?s$fB5g~E7#@&^fn9u4hPVh`McGTF$crbH)@ES)QE=qs@+g)X0M^gU&0 z@0mH`Wx2PHoAnAcc`j{l&zJ}=_=TgsHLq6YY`7p(^3$8LSn6e?{zVi^Z1aVmfj`X@bU1{DwU%?2tqs zDuyd@%Y)<1-wVjKm9|B7f$i8W~%iEw{=?3>DSpra{Dw zn-$5e)ZB}w!j$9BoER09`Ds@fIZceWrUmakvy)Q12c3z>ZXWQ;Va4C!?+H zXm2(Lk(cndaj%uw))L?idmJ6r>O1O0>z&eJ^>x7Kf zIq}ukAASTHb!%cBDlvV8l91wV6*}#*v-hy&M)4>vVBbGGJPSw#^V09@+P4 zh$NbP+xhxy`DC|GoL*-p7KMjPWJ@9eQd*J%BX@5eLU!mq5to<;VK4_f4& z)^g7W-lbluyc%|vJ1kvStJTc?yFRu;Pikg=JBLnBFv$-~4;i-r_4;E6976(cJOvxd z1FUa(5cFq)x){xW^$ENbCtST~6!4z$YGia}vZ=s>$>>{2WudP}cM=tM=ZCu1j1$V9 zjBe%}m^Qz%CM_W0cK3AQ=~eKb+?FMgGSvmb>Wv&f#i1|TVn7Ig5JYW+88-7*jmP=* zsv(OSP(2h=B$~fvE@!gNV5fh03a4CklMN}8Q*iEAon?5e)x?l%RIrDV0^|6rT zZ`mTqYy~bn!rPdCD|BdxBGb6C$}}j;yGPYBGTAe}MRt27t6nt_u{}@w;iSxQNE%a6 zpukIPSvL8T75Fs>fs^3e{#eF=WMg4TPp@53eM2=4i*cLc+mBNh2YT|XnCawh*9kY3 z##k;_nmPi~BHU&RZ2O^J{KFN?YxUhX{oQj%HhG8KGEn7r?(=PL*kE$j&PWElY4a>U zCbqe0#?;dWIOY(OI(zSnazOKYzF&yix82>P|9{S)Ys6X#CjQji&@}$f88p*B>M&K= zn$Fmqi2>hIA!f$?$a6%F_y@#3F&lQ$-HRLCAK}VISwx&BV@@|UJ0b-ViYQP+e7_AO zO-zA6NxFHUev-FLJgrQrLfAfhdUdbz@U~fPEb*5u#B@Ndm@#Ws_XBlDOguGN?#(`hEnKkRMTp;A-cJ_Y%j`l=4t$sB{vt#$} zVLwy5bb4d`yqo6d6(pB@B4XL0S9`!@5tGZ@dDkx>zH)L!Gy0&KJdu~z>vJD&YOvo! zmf+#7n`qY6bI%E;Ybgzx+4p+$H=Jw2KL(@=jjd|05LE4MywzP!*24N~wkLNda6c8r z`t|+z;#-fM>SF)VV-LP7%g)cRy=>E8arE2Yth>w0t56OLzpyQ%ML)I0UYP%Q3#0wW zXW?^a^Vm9q!*X*9tbGAm7{1y(>i2@r&54zKKp`ODJajxTAPbPHsIk4)6VSN^;1=}hKo(v$M`I4B3jxt+{HR?$yty`uEyR~@WB8kzMU!e(W}Gs-ENl+IWGP*m$ER?hUG}u!!)?|njFuynP29LY72#a z)-sQGz1}w4#r1pR>otu_3l5+%o$eg%+qBBw!Wt3aW1;Rq3$wy1-^a%e#~c)IXkN4f z5I<&Fa7jM6rUBoZ#G%muCZ&r5EcjNyIr< zMC3s{be2xM8|Z|4#})EZ>G|N~AigTQOCPX-cDknv{UWW9R1)ip_Ys4^dwEfn@;v)< zEPB4KFZYLQSHatnIZcsBcXkQ{!IILQW!B%nH>gmGw_{vZX`_tzW8Bb*GsR<#?pn{t z!gr@NYSBu*dTJ_kwkl7ih&wv@KyTDCCmRyDJwNtQCMyU$_~^o+jqrzuAkabk;);yL zDbd$bSpl(|dzywo-z|NR2qw?T0ExFUXw7RWN@arr&)0WhpqtG1aG=#1FJ}&{HHem; zu-UdxISGQbh5v!Hq~D>Gdt2;Q5%j9z0L+UY0+(8x2u;Y z+#ri{Y<{mGm7b4}g2*aF$hy{{M?G70=}hTB3b@Waxbw4{GlS3BSi*K=qS85 z-tg)2IvXme%4UoXqvkg+QL>ap*a2cJor`O|UhJdXAZjoYTeknABE zvmvMYAlEQy5)XoGIU$HAQdd4))~=yc+sItRC~AuY#SKXqpinM#38ICFiUnB?5gAr3 zCSnQ*34u6|Mj|;9a4!~<^1 z18RK-k!i_Jt|1MHKhtM(+-Cb!F^vbXnbUj4o0;4M!aI*$O2p#S z&_vvcHhY#D^}Ny}&P;`>K>BPnw&T0#v4;cpw5whr&fz97=T=~LY|tj{N(rXFX4>zZ z-__LEhwi$S<2UW65Iy1{(!cQ#f&9uciVL$8Cp~iaQ66rBYETTreE>xxUBw7XjCAed zor1(q>{8ag;(WLB{N5gaF%yh?nBxnf3Wu~j@u_L(p;y**(zQ*|xK*6o_$%w$xXMJ| z<$j5-%2^wvFF&baJkTK-cEt??WCZ?5^`LBhK=5F+Lnx)t3L}ADcA5h95h+5DOOhaD zNm>*}I7RXVgcJd?F&!E_Cf0nPbNN!M=D- zz+x5(IS}&W3k#JLD%qGWS&dW+-m<%h)mOk85DI^{-44wkv^q@7LqNK@h_u4(7xRdY zIPa&~F|+;pQG4)oJ63DP7*S(+dz*!HZDkaEe?8qZVauuyM9b7npDu0c!_g6qO{P0E zJ0)Oa_4UwruYe8adc0BEHcrt&Bh81gt{eaOlQr^&RwXoCis>Lk?tF7z+Jq;wcBS3A z-avs2rI?TQjY3F{YabT(MWTOf&ZUIgHuH+5BP>i&!#0FK!hCN6GLgXTY09%=F--~* zHA9pfwO9(nFfzQxBZ3rBRcAjKka2)&WFT*1q!(75VBZ4<%IyRfas05Z09IStHXt8u zqcCF`Mqdb>(s<-4&PAOIjD$R7@TACt0PY+Sl4&DakTps$d}#9U{y_XOw@W?v>7f#Z z6#T4aOC%7NcxesD4C90`l8BIQ%Y;&m$DV=x;_#KV3RA&eOob>B+u9=MIt;g$FEo z+(b`F7inT}wW;w&TMc@=%EzsB$y^hsh3VrY*H)MveAmp5e$(nS~u8ptcj=SB`g;UqW$nlRePyYC`>Xty=l@vbLQ>*fv!fu#M zdWkgstQ&Jf$2Gl@3(Z(EK#W5=$TL5qI%-&3@iSzRCBv;C_f=%sC++$Q;jQw3@{nA+ zlZaj(SKxSRq_+t>fN5dt-c6ZUWz%llS3Yw-sX9K?bL+&`o;(%A8WS#`lMYW_eM@_( z+;+O;S@iXaH>dgOYUzmnigun{1GVQR*S6}Zv-RFrcb=VRWc7_MT%r9Y!s_H-JJ+HjJ zsq{MNG#=Jn#{_G9X|i@6cJ|tCCf%W=ci-|wbC*)Eh#L{fl!zG%`j}vPYnMeF>lQ`qf{qy})3_Kk?-zwLZ+KYgJi|sB4>c)b3qFQa;|~ zhM7V|@Y46(5Z3X5^z)7oy2T1FCUxTo<&mwVgxx%{JM+?WCbbtfVim0g_<#EG<~>@G zyIViFb z2wb}JnPr(dmu223+Qpw|1M)<1g_PDZE`kk?lmo$1YMbhZv91h45!5i2-PIwO9D{uWoN!F6LG+Sb)}!TWx6k>?yEv6wX(9pC6le8g7dWQ<(S}pA zDy;`><=IP$r@A5^nX|9N7qsTWsV93U)71jccl?T7-w8Z&&rf&3(S%QI1R>+1enad1 z(}nNGaa|Pz1nr~RH;YABL!do7^@t^_yjsJZe?I<0(q>yzMaZoy4b>!0bCsd~B5_G+ zE1<7CZG?ZT)xLebaajaRcDN%*kO*~b;|e>SgdYv z-z%;wDM7;ln?{SgFzQ9Vom>5%=s7+LNCB?9-!N6S^>VCXpLvPzV-rtHNMOtYp2A{-For-GK zow<}w{JF<>{jT$-SDw*1B_V+m(b07KgdQ z@MC1yG@y_8;<}3~aR9U;2d_HhL|DyJ&3?$!IOHikN`lp8$J3A&q&9#Z29TCX%6lZ5 za2)c8pg1NSV>F<)^fnMk0W{Q8WR;4ZSSqfRHs~}%Tb^h+oDn-kK!->{OoOB!+E~DK zF;pO2Ey%HJLpP^UyTgUOon_E2dk*S5PvA>FUm z-X{!P;XrHM<{izk)>5N5y9}?lH<%5hxGO7Y(#xfda)TN=jR8H~``5BTejI&)S^r-F z@ixw07OyFpf?cd4(L!(l<_wDQH_!zLj;S0a32+P{QVO=1VmN~NWe2XblHOm<7i4pN`EmxADHxJk?&ap3^z&RxoD_sVD5 zZ2Jx+r^tCiX=5UvL$xv&UX@C=bl6X+IAGLCXlF!aIA>_Z@)Rr~?c(BtWyN#aBe{X8 zFajL6RqtQ55Wxb6)H3TYaA<%%+)}kNp!#UI(3{HSKX&J;ipJi>5K?L-9F>U~a`uICylcFa) zL_kb$gxepKSjo_Ud@Ud)zVO3df*Ax#hW13z8k|2^WLOlCK&ffnbrA3n3z9uDn@tg} z!t3M+XgX)X_NmNTDTazph;^HniEJI?6^HFwGQ~tn)ezlMz3>Z{R||}Oa{u&#&wB;r zD=B?tSj4SMD>~IAUpwg|!xKv06m0Y>wqTCCTv2YwM4i)2lO6gg*DW!A_mJGGlJ3b% z^!j!%G^mRT`BpZq94n2U!Qp0L-J%>|%N}`CIP8Of{~8V!>+-#)oIsqYdKr@^fIYBX z2g%3xEOIzKUCM3k%V)uFPHaU84Uh1m3HUvaW*2^m&<9W-&^1h@gwi&zCx{TyRSQ(` zGw3N^(%5ddRF*(bl$3RO8WA71IBgReERcj?60>ZV8Kvr2fDM9_7-}6GgtD8NY;|7v z{UL$Q8@H87j+?TiIdmO@FEt&43RM(Hn%H>VP61@|bxr*D?Je)C;e=p0Z|f3j(mZqT3bBy)iF5Oa z7}q*`-1?Ezb@imp+~m~${jg4`em_?i_BCbS5j#*!i^zLbHdoKJNC|=6jfP8)0siOf z8BO2yBU=CG!dCUc!tGXw>I+p1oYd@u690Del9DXDVZb#IX+~xJ9 zf_ke;`wj=GM^B&DF>mFTgq^(HZ)w2&wH2q%3rL`Ej=vU7+3S)SAV)Sneeq$qFi7Lhyf(;|7@2xg# ziF#`g?(+#HJEu*OEo`K%I0K*8DNZfenTPK1w!%yaY%eFa1m||B=rf=y`lC%fJNDKy zTXfxg1f%Bg&ECITw81lw-r+E}EQLaz-EEzt9iL*vUax&Hj+Ye2j@3m@;&<`5F4|SO zT$R1v#x4;1@EMTnhCv)xD`Bu0Ks>#UeY-3NF<<~>wH}loprMxOy`EXpR*7AqX?5}As z*Q-9;$3%Ey-g-TwXoFaaS9OhtOlSzAi04d5Y@vXsX+j2>uy#d+K`R^F!)>trW(iJO z#W&*}6U@}7x}Bxl_CCyM`wOji_kp8>0f92VYqznAJX<&Hce-jA9WO`coSB{b0U<@O zIhUKMgyT}(?u;qz+J_(LyQS>Mxmiy~Hg%TAghD&BB0}mbZz+jyac*trdfXX1j9EJZ zn9=YTE`UDxga_MS3EMht-l(??-{AjQ0PTf(1OoWegT{^he-=QQ|JkXhxn_63hT?mp z4nd_L6R1T*X@yNM!7DfigiDg{;%P>+u0|8_Ymg)3?Oji)et$K(k_GzRCu@DW8Lo>m+lWb)fY7pNQRzIO<}MUkOJbQ?1Lk=AxBiB^=k>#Kt4*KEmp!aMXmrBiEu(~78F=wDP@ zVuLg{wN?SjTEjrxH(KOgc9VL}04$KhNLUNN!33Q`0@twK!oiLrgEg||XJ(jDWQIAD zt=T9=a97M%EqU-ZKFl)$5bFL!%RDN-5*8_Q)1s);9fR5~-Bp+l@Vgj*-}xYkoyEva zeg(;0e1T9kr7v~)eK42;Af(wEwS3dLW8ZJcMe-zS7|0w6bd)_Th!O+a%?JDRWaxLN z$@v(8P7#(6H-fY=Jg+F* zII#WX=# z7qCxLSs2zgTvt6#MXR=~15vJ4DRnPJofQA`PvaP8tJM=)!ZB-Pxt}cYWf7mOM-Ex1 zJ8a)3H(H20LF9^1BLb>@fX|CTBSM?9L%CbJP&<}OgJ5hkjWjZusA;2SJ(dvAN7+K` zoZ|IXGXs#YTMioJ>i%j0*_~(CKDB5yDyk)E-#g-uW4JEuK|+SDWQou8So{bv%7QbT ze*FDbMG7*II9E_!oi)6(KsT@an(1yyu*XK2TtE=6oD0&Jr5<9nQm!NT)3>Ilf^*s;o zECH-l;!=L(r2YmV;4_j*iNB3W=YUCh!NJomWH^wfE9|K3XKH_(L9YZQ4gd0Wrt&{5 zEXVRS^?X)BeD5OaL==Sz98O?wRzo$$tUQXFU?^KkAXVAOrC91TShItFzrmV6;X3>v z@Wl7ct%wjf*b0S;^}9sWoQL+yYjL25%ZFG_>{k@KbIRI6jT|+1 zcJQbG6A7_Jec0aApRjUW&0|Gv;6}jAIj7*XADjKk8!&aS(9nz@?zlXB!*9*#H5xmY zH3eflA1ybtv=Y3Siv)g^L>_A~jDrQcM77-!-)qmrN4)jgXd>UsXw}^0sXxcJ$-GoEk5a z362k9vW`%Z*XUP|HnZ}l=iUaxQ+&qW0_9vJdZ!fnwQM~n@#<&{;S<+>X%8_o`{!9? z_uJx%WxOasF=YVOyiN!b&vwTE_B7Gf)?Nri!LwW(OuN(od>aH`PV}Wk$RO3&t7fqh z!p!J(0M4O^znPo78R0j)+g4W`A^LdoA~ZGO41^MK=TiC0pevN&J6G5m|C6C&l8$he#95NPJy zC8A3ZKR{I#JJ`J~_Z>(O4yb`z5qr&n##jS?B8FEMO*36AtCz0%Pz?b}cC4r4gI1+Z z6NVd^sjcQufw=@2H2;L{jMM7h0YW){tLZ^NirI(kRK^-kDz7o*ewdlTf^D(4%qJYC zw8$64Dn)xtVl|W{h1D0iuY`5YGlOvF5AThoed8QSAj-__D6t2)h1c!;y@qwh?N6JFR zrV|J$6B5G41|300u>9^jb_`6r0&*mVL`FuAD7HL@pzc#}pP^Pelu>dEt=4USTMj6$ zGNFp30M?fdD{2~YWuWHgf%+o0h}wz}v+@95@o1}(kRQ+7yDS5aqlvbZnxnD>FY?nJ zBQUcfebkbimU7s}^0IX0+0GTJbwBd5O8^Mnv_L3X-NK?_gm4syWMXf1bT*ri_#C5e zfImQakt`A?jOBj5^G&L`WKhTY-P~_4dR+-|^!d1@<-xp^pGP5{;_6WM*uP{f<2%am zx3w0BR(W)~G$e<|eUJXAdzD<7N;l@l4WW;2f4Bcc6VP>Q(TKy$IFY&5XzX5I*m z<2UF?E2M!%6kzbIYErURZN3Hw-Lv80EXo4&XEa*5;1i zwP1o9#r!sh!24xX_Q{PRni zun7gS)vOb2x3Sql(&;Z7t|y0zCd!p#T_i5#J;B9?zLaiQEAEs9)jMQ@ z98Th8rNS-f!Ob(FflbSECt$8_{M%oyJ4?wA+5xUOtPif?2G@w72@{s)I{Y1rDYGa!6XC;0aQ6;F+VNZ7I!OKzx?f7aH7 zau|$7Fps#*>htI21Pl10x||QE{*3f>pV>O#?wOOUau3?7!CdHTMlj_iwXUjwH`JhC zsmy=k)~uVia4LuTC97W5->wvG#u@;H7z_4;gNA~B%tpyB(zD>gfReo=HxUrhJV__j zd(3+uWH=d(#-rFsN{Q-K$kAFFn$As*2dGa8svOAnXDuaWP_duWdBFwX#ISsybh!XV zJH&{i9ZDI{W7P0KU`K^IF?bolOoQ8iT1Cj%-Y!>Q%MA%<+C^Ybo39*M%6NTh(6VoD ztGPXYQ=cPYJC{BpdAcmsFIMHFO&6MBsJ!x^($CronF965>(C-=C#GJ6L(E{ElFtOV zlQ|BzkSjs|g|o7_+d{dkkz!*))nS#ictlIlh6sZ;Hisc~>sKpH!M5V%dWM+jg%q0d zDYd9mV&D#wGLf3AL~e?!D;&KESeYyga-zzr5@(`bjpj~y5sriH-ptUkl|)EKc)9Kq z-TBbrB{ulY>U+)~u%rQN%WSfxS*6YgTnImJrrxeQaJ$Cs74F2#?b*#BO0K?FC8n-X zCf=5xTRg=99{7BeZ-@swBBUy$F6}_{Q$U@|c{z7>T>TN0X1GSAk^iByW}H&I4^- z8>WIcaLCbhncAp3>HPCHpK>=(ZJAn9Bl$Bd1nezAWD@Z9)STc>UiW|DeiAF!iPN=n zINc2;JfuAdjegEu-5iO+1Z&3{Iukt0ZT(ZBxMUoKEG49w;clnq{h3}KU|2t=L(24&@x5G77B4o{BcK~;}_0qjENe(v`^n0EmWXlH;qZ79gP~lScAsk zFa7@Vo24yMBo_h#0LX&?0Q{M_{ljne54(Voy}k86h^8rNM}C6=VdOhy^4B1?rL>^d zl1k>Ofdq1`>pm*yb4YfrZ^G4VzkZK%eRRI$lHR+?PMptY+r*ZY_*WZ=*Yxvpt3o)} zuvx~5;F5tUM+q2?IMuzH7~7{Z9u~Y(7#4w6(oESx)TWe+Q5RO@wJ#qVMNp(fY|hwS zKrQsmorxJeMy<$?yC#IKt$Ns^Y8J%bVq&e&i)^R4i7@I3apR}& z4B5WOX95~?9kY{gp8bkDwz21xnPtZafNa#|FF%}r|WD=LWmjzu5mM8+{*M`@#g z{zcrq2Yot;wxf=678S zLZNU^wU^&5J`?;mvCZZ2zo$!SObu9tE#Jj~m5Pp=i!a^}Kg)7_GJP^8QGelty!d*_uDDQDA9o9B62Y8lh5xu0|=Ee`O(baZ~f{-og#y(@ z+|i3ZBVV?o!X~%0?u}%$S*^-=?Ai^Wgu4YwRkk>`Jr;WOK87%~-dTkeV*QgB_+AoW zT$p_6Px81P1l@&4EP1&d7_Bd$&<<$za|F#utq`=fWCpm0^j%jQwFDYbS4z{Lbl8y6 z(54Xz&7BIl5JwZxs1biylW^ZsAk%i6vwY{PF84q?dqe+@SEj}7#U4_MX>puX&d z4qnzRI?gk)cd?J#uuBpsGNMB2V6n3C=O4*SJlfy`Agf}9duSwsf>$z9{Gm$W12B>> zE?yDte;@{?%3=lV#F)1;(a#Mej_HbZX7vV=vW_K{`^QFhrJF0pkWLmSY&0^ij2bi- zLKHiZL*1iT4=m_ln)jm#j^iL$C70ACArCODeFb;$r?kW})qGTaHmNpo!ZVmcv~>2_ zoO%jf{^QWHQ$#O<#$1Uk2Yn4PM?O{iU%ZsqdzqB)PW}Sl)nC_ z9jcn8`{BfwudXkUf;1oy3c&wuIsP-a|9l1f8SVdRK>j=WZ@2HiVgUdG00;hi^nZDO z{|^7#4g2r#{Xakdzj$N+2Kd_z^=3H|lSczdJ(zjbi#I+5UgZ{O>6L z><|4L+Hnf-5+Y`Xsy<)4f0zfu04UH%tJ0N@4lKT-ZY z*Ze#5Z)yB@s3rS<2<86>{7Y*79jL_d|IYlsgy-+zzlrVN!Gv7@4E{f8?r)sGiQ?Zl dnB4y>Z74{C{wak60KoitBm7}iN1lHi{eS5%MC$+m diff --git a/docs/sbom/AXHUB_MCP_Server_SBOM_CycloneDX1.5.json b/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.json similarity index 97% rename from docs/sbom/AXHUB_MCP_Server_SBOM_CycloneDX1.5.json rename to docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.json index e4444dc..172949e 100644 --- a/docs/sbom/AXHUB_MCP_Server_SBOM_CycloneDX1.5.json +++ b/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.json @@ -11,13 +11,13 @@ "group": "io.shinhanlife.dap.biz.mcp", "name": "ax-hub-mcp-server", "version": "0.1.0", - "description": "AX HUB MCP Server (Spring Boot 3.5.11 / Java 21)", + "description": "AXHUB MCP&Tool Service 공통 스택 (Java 21 / Spring Boot 3.5.11)", "purl": "pkg:maven/io.shinhanlife.dap.biz.mcp/ax-hub-mcp-server@0.1.0" }, "properties": [ { "name": "axhub:scope", - "value": "MCP Java SDK 2.0.0과 그 런타임 전이 의존, 그리고 빌드 환경" + "value": "MCP Java SDK 2.0.0과 그 런타임 전이 의존, 그리고 빌드 환경. MCP Server와 Tool Service의 공통 스택에 적용된다" }, { "name": "axhub:source", @@ -153,7 +153,7 @@ }, { "name": "axhub:note", - "value": "문서 밖 $ref 조회는 ToolSchemaReferencePolicy가 차단(ADR-0011). joni·graal-js 미해석으로 pattern 검증이 java.util.regex(백트래킹)로 처리되어, ToolSchemaPatternPolicy가 반복 구조·수량자 개수·maxLength를 제한하고 patternProperties를 금지한다(ADR-0012). 둘 다 ToolMetadata 생성 시점 검사" + "value": "optional인 joni·graal-js를 해석하지 않아 pattern 검증에 JDK 정규식 엔진을 사용한다" } ] }, diff --git a/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.xlsx b/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..0b7d7a6d810a9d01ed39f116ee125a0886e20895 GIT binary patch literal 15627 zcmZ{L19T~uO#I?3PX-2c7vZohZ;9#yq#jGA-T zhgxfWtJYMI1_4C{005AH_CRD^u~Aux)Zb^*zc<9+n~A-#f|I?2GlQXn1HFf>jqI!} z%m5=S_+GD)TWe+%ehIt?Z&Y5_EWK-J3zcoi>&+D?zn!P&7)}v=Br$nQhUhK*p)CvZ zD4f6w$t&OFL}66np?3|_c3@0BHbMyjKFDB^?P@?M6D;S{erw&?61|wY>uj2kdjq#3 z`QW|=D|bBwLFE=MG~$UD8DBJtG*>ze*k`ozB${&G@r3;^6R=*04h)5VYeJU@@y^Zf zTc-gA0FeG?6O8ShO#f=bbdsXvZ`5ITchfMJ&??3-1z3OJzP5y&wnlQ;VaawY zN33@EDZ~#Z_s?I~?he&Ih2Vhn2lki}`aM|IcSH++h2ceX0V2)=)JB-ebgZt!49H5& z*Mif}DW4$OPH5^Rl%$gwL120jHCL_3R0Jf2IS-n(etfXpW0j#9#G~Vhew~2U;E=yB zudx3PonaW#KXLFMtSTf>BJ4$}C0FTzi&)g+KKMBE&2rZ@4b_$ zlS6_C4glm(001bzd&k3u!NtPV*7RR{roZ~*7rgqN5{LvO>ggvmO3B}pc zZL=veS<8^Ke>ip2S=88o67#Rj#v0T7PV-<7CO#p)j za171MDEQP0wnXg>BrWJ9tjtn1D_}!rjRii42N4Z#)xJNZcaE2^c;)(X&seAUTUG*< zUv*~BCjW9iJM^ap^yJt22mgFL z(pRa(c*{nTau@RHQx@!gv05D0aEpa6ULRmDIc(6li8y$`<~WUFL?M=)Kk#cw2dtNb|yLj zsTV(tQ!4AK$Wa6IJx^~?vi~$_((Jv>FKn5`hBod=d}_njmkW&-o3Gfy(EgJ}!TH-`Uce_IuvKg;ov{ zU-SOOXzd*_JME#j8m5g^R(eWfb*JgEQI*1ihCl)A5I z+mXA)&6$^x*bcp@lwd#jayIONz0b7{+U}d7ZhNveKmT^puUJ=n^Cb;$G~#Cw(RE>1 z#_XVQxTm*%hI#6U0xPPmO%*AvSgS$X>Mbqmo{0fn0Yq@EBJfWoRRbpN5fGY$A|II; z(Nl+$bRGSJ`J{u*GSg&^U8@G)B1i@yjfN4pLIP}yiI6wvmct( zWBIU1a_BI~62>VQWl}|VSjs&oG?GKAoV}tfEy(GZT?fabj&jOv$ZjnNz|8HPToqoX zOy*@jcj;iEXtg6Wk@sbFua-};b85VZ-Con(`wf1+JB*7X9Pym!-|Gt3_&shPyxJx6 zNXX=P4kH1%hys(O;)0`NFdr&hCnbQR08OWii~Il%GAY9i$asb6{t4Sog*H>o$K@|d z8yqI5w?KxB8dV1iMug#XaC4Jve`+0V=3B)q0Vc2~1O4imb$ zuQJ_<-9v65J?LeZOGoj!skg-2guyFzSDd+r-x%(k?bS9QTJ@>1g8#z2%jK}iy#u0m zj6y41;@9sR6%~L~Y1GqEEB`{4!_(w_8%UV_Yh|WP=ITGeF}Gw$O}oH(WFen`Jq=iYpe{UT|69h<|el&f*b{6*mz~ zk14Z-z4%ZL`peeG4P4#8P~7*c=w6_IcOZwW0wDZQ0Kf_%0D$=~2jXt;WbJHWYU<+5 z@b}?wFOsWe>AcB_{7$1$N`15>g6epi5U;g9Lpn1ONh8Os{04_il+7+`B{3oQ@y-s= zOOhB{|E5twiMw4}yJ{ep*Z8ZxExkd6UtLlwC+>REi8og!YPee`a$tOgIaEJQvj>^X zXZnVGm^+<#Az5uaq^*WSGm;Z8H}}+><7Hj4g({gdm4l0#y)t#oKX;PUn-A~1;`^Sp zkGuXih~&oP=C8GO}0*Rgxv(M(!buV!;-8En~3L2dXA(fQ?xk8TMT%W&e_NHczqUF?@Mx zn#)G#biKeghg!Ui&iR=w%=2jd@&;jdcK%^_+PYqgz<*L8Ks%Fv7$#D$7aEd$^z`x9 zBpY|fbF)N)irzxrk>1fH>2}e-{m}S&cHEmzIx04d$Wm;>`*FZ)97q4!hE0TQQOsB@kD4njizlvumE zA8%1l9=&-*>fc-46s4#wvaZ*aM|21fnbOGa07 z>}xqhNDAmV#J(b10?Vwi72ru2)8St63zP_BR>7t#e!2VUmq{rRylVrSXp2jBkG^U+ z#AbDY`#d7kEeTm4x)_{>y*7jbt7)PTLJlIjm#ZUxL`R*`P*E(X487c2DfeBtrt1_- z1pwPF%MYYZ-9I1N{Xon*H#{^a5y+~}3H$Z7l%JjT*#ej3&}5qw}jWyz` z48=8#iHac*JATc!I939-@atCFYK#4rUq-B9&xD0Tcr$?)Eo-GwFEm_rkm4{nylsEs zV^i%q=POYXC-RX1Qq>A3co>tF3<8oeg;(+bq_Za45IG|uUPe>NU}y427B-MnR@KFs z34{Y!8%%NecIA>4KJeasI9=QgzC zv~)urCS?f$KPE*aD+*vzLB;{h$vQxdg_mI zS<%5e8%DsLrga(dc!L#aN<7lc>TTNxOs`N+h%O*heF_;|sDcMR_#>>vM7%(H$o`P~o=vc|jx0^V$2-x-oEfF=1b zxSLd8ld6uD4DF-;<~xD;40W_g!`On-2kok-n%P_&kLW$8s?SH^*urhF#+QLq88+u; zfQVL-EPSGkGP7$Id-D<`>UgWx_pGSEXZCmsx@J;0D=v#UZsW`GWos=S5Z|!{Ob=uQg~R}B_SU`XX}=r# z8uK9%aEu^0Yxm$ZvLzjnQOdGS&;si5jmr)HfY?Di_u5(8ZL%|5)pf};LODb)c}LRX z^zSC-RS5fvhoufG9C>3-v@1+M-L#wr`BJa*)XCK1X!7H5&iD#`k|5UzZ&LF7!EwsQV)ti9ZdQB(wreD%F8MO z7#v7O1cr^!Y63pQQZ#qYEc-Znn!Cy9-blmO%FmFv`LsO)BtPL`8=C{@4Q1S-HA|m> z(q7_Zb}gAr(ggGOLuFtpZ1_c@$0nc4;6l@|lZ2Okgi`A0`(CJi0x)cr!e5%NgS~oV z;5Y8=xG=be+VyIl+ID~R+gp5a2{$%O9lVHfy%GW#4vg6W8^Jn8{Nuh%fbA|^4>aj* z9@h#+C>ZpJyS8lzEGnO!uk&Lz*#7(a}BY8|>eY7wIKmXoaBzCa!w zr?$T+nOVQ1d*-E@wk)(hDTy$vgX}$#326H(GL&V1PB=XB|9jAtj<^~L_d84DqxK(z zF6O_M?$tSe1zjy+pU{)aY^fDi(rf86N|HHp6nH$@Z;!ceNR`!bv{t0ta|^bYm4gy8b~4uY57(0)*G88cDIRQD^63UfRhxUd+nFl)^};-T zpYB2PZQypYIRBK5kKt#|wB5 zS~c6WZ{BrFrR!ba$$UL8^79Ik5517S*{4swz(SKyEEBxvBT6VU%nIAg4ETK9AHw>v z)MWa?5%lk$MOJ5*^;ianB;YLe)wg~7#6h=xF~r|9fwWoAgRALKX6bd!Q<5C)eLQjj zasld=Xg%kDcg?r4m+okJ@8#gwbJgZ|=&jZaZ}j@;W!cr?=T)RgMVQ~3$)0`K&Ys)7 zd&KYX>aqK*z3y<1n-F?~cwUND?g-#n7kGpCddvr-g|oAT!^?nTF|VsV8rn`4 z*8M2!xHa@e*rDmFaPZMM7%a8@eCPFRDU6 zvuYZjPN4tZ>Gei!{CsCYM?AaWorG<|Y&xy#GsB3t=%+bPwP&xy=lFGtAB6qaEG&T-`Oy$$O-vGKFv z{f^>N90Q@F@mJP@|rydkxEn&P3&jImbFr8i zKDAyQKM#G^%z{qv$qiUTXl5|KK4^p8JeT!v?@@q6IVMXSt{oGkGTqAZ4r!JOEsBsM zpwBYgRUb2T!cS)a4NlE~znyvIo--_s_VqP@m4tS)^6YjtQ9{An#NOPQzg-K9A7S~@ zj0=JBCtw*th<8)MuF4~gFwj4og_^z<)3j@Yz>hYSFS^Ys6wH8YqJ51aF+2NKKolkS7J#7U5yL5_X`tNT}HYl~GY( z4w9mz0I<`LFu5mj;vVfW^J@_)IvEbPIG9vmBYdzeWG>3D6PX(U?6Vb(n=?Z%R9sDDpZ3g zWMYxQq{khyR!N~$h-+8SIUbB@{l@H3I1i+@@dkg(sUft$p^+ zV4l-ih=oh-Oxw!78WU6cO%N$kjYP4p#xWSa^ae}X8d!5`sz`kuZ!KpSi4_M5w zn^>`J{+tkjdw#-*^dhTav&S5DXBaHSub=0-mHBU;G$V?&QE2{aTbr0nXP|EUy&JP@ zu1a4lX^Dq*iTJNy>pw4j`FAS;;mxg9vFXRq1^QI^Ho!nas@lXEj#O7bfMW?5-yp9i{02# zAT1SY!Lk{(*>0TQ!j;VCXzwY+)i1QC#7TP%YdA94b)W^>xxG0ha697(CI8{WNHRMq z7mKt3iBgf6F=v1k*3+kj0u)4R@Exx-#7L5KAyDC46*H(do#H*HFt|qnW5nuML9fA_ zCgK3pXdv-Sfp?-FPXSeZK@G2jZEdJ2Y0Cn(bC6T(OA&6pu%b9z7OvQJ0x5HV2}fGi znC#pa@)IQpa_9H{gcDu=zTd~->w+A}%cYRf#;{D~cU?VtEY?b-11`QBIN`JFn2 z+e0HB5DBmFOU;}c@{tBhvPCX<0z4<{?*bwmY{U-vR}l1pR~j~0{1sbURjYG@I`%oX zausf~-wAu{6n1z_p__w$+9l}Og0F1{3KMQ!a1ON`ARZNpQY^_8vSnRA=6)F39kzaT8XylB=aQ*9EgR{S** zzkhw~Mn~V#&m-VO$u-rY0Cg zSXEE%K#ypKD-y`60clx$sOB}3YoZ84(wzwJi3i3^$&3RU6(u^07$3H8z!ZE}HN$sK zD-Nr%q~n1Ct0Yt&RI$9bfk_4OBsVA_DWsl!VIKD7<`wJKVFJ8E&UbD$Wsz)g)&?q} zqVK^nYjoUI;K+zRy>fm3o0sOQtSE&~kYjVEojliu=@5QJYjDV;re@%hle87rLP1Qh z4?zw)gZAwCxRdH9zRu#?_-)%|klZ2YNuFLW_2#>qqq$n4*L^)r@9P#=Lh75T{Al6} zCV{XC{idCn%@be}>P&6HAZk2sV9o7H#_jHs5Juu{F0@cBiE&vDYFi!KDVghC**O#A z{fH7~41coD&?KEM8bt^M>P-%xKirSswfs%?`-_2AUOG%fgb{YoQv@~!FtQ-{x0sPH zoG=|Qo&t>#^CA~W985!FIWBw}LaqQA&HmyjOsc%m9a@dk|jbuMW{;>9Ws zW zhgfa@(hgzN3|5Z~aeHaasaqb>rFmkY^Qcf;Lyp5RC^s`9$Ec&HhL=9g_jII|uG_zS zw3+WrO7ATh&$PR`99^b4eQBGOJelaRG-`=HVA@EMu)$llLu+mW_gcRmTwZ|rAkXW` z59sWDv~*D2&2~xv1CJ+LWegs@o&*GoZ~R`Ok%qHq^6=Wg%!W7o?9z$48-c!H!br4& z-1Ri1gVgB50T+ypS=eDRj&KshoFaaFo$L#90|!OAWsh(hq`$Q zI+bvO7o%!-1SJeXNlzit`?-I8ZReyRdvzU+8yx_U*wt#+v%^bVac?m*W)U{(skv2+kS~yTtw(kp4#8qO1d2E;gE9DJuRa#^yz)?+EW#hnXh1%O%8Cntp53}-g22G_d8~x6pW#Qx)VpF~G z^CUB2M7&0va%V^oqlT}P6v8?9OgjOug#lN2Fo5#g1MheY!Fj&C7WoXaD|m-?U*;r| zX9-ZSka&$WOgx^NL5aCEBuwX;Rl9C8r1Yo+MzNSG!g&G4?NQN7op@VDO>#pV7pGXyr z!{Ez3#D5-8Y9UP1z`pv8O?KnCJX7jr4HsRjJ(-sSiFNr^)SnZpZa?ttcU}to^9PzyzAsxj%m+Vk~qnX1l*K~iarQk{ms6{ibOEq@e zNo0=%dyVr~`O{9U26{b5&#Wb^_bB|2+xoZb7EktVvx~d_Ut9!^FvULr9kbBS>FChG z4Z@%xW5AEtl@f}FQr=+1$liuvLW*D)hNQ9Wfzj-N9%!jc8a(1Ytc+cUdW?uk0gUE3 zLB^C?(}6aGWF*iVIH1Bl<}!8d;rG9X*Bh^mS&oOQv?Xi<(wCMANryTLG)-)zX^Rl1 z?H14N`8zt#T*2v&%tZ+^8$fy)_ofwg&MvMaE2B;LIr?b)in7zMiuqT&J6w8uB~6B@ zbjBtb>mhcs`+&3c2r8_EbkoX7R2!|ulq0kCM+wuv#@tkseTRNzgTP)r9vmIq6}!pz zV#tinV|49uqB5~aI)P3bok*LV*NRk6kMg;OVV|>&oMO>dh=2BE?Il8biY!$Fd_O}) z2#7uxE)S(YHbMy;2e%MB5H$oTkP)7yk|f+XWz!(Aa0=>3asvtC)Z|AmyX81qOh=+D zO9iJuz9s6@Lg0+dY`M)s3@L!BZnjsb2-itq4oX9`Emccon5$p12)Ly*X3BEEEfL%_ zp8&372ZY8KpeDtJ>MpV3#BDQXWggq@sxP$I-D<6@yNDdg2lwh1(X%bbxn&Db6b8Au zOzTV!R`YhC;URA~52zK3**KPSV;EnX>+xDzdf3waok+;a9$v0)hwcqk^#WN}4!XO^ z#bSuOm*#S9y$~ToYHfXKv9F8w`|!v!aQA|6`gG|$e`fV@F5Ko-ZdM4Qbaw2*k34t} z$4F1-_x*Ud3V+hfiqjo-BV+eTvfEcW^ZTB%_YQ2mUTtW5b7*!l#Bf|$0a??+!7jbz zbUWE@iQL&BL6>dEj&GW%#oqlS713nxqSO)Q-p!#~aH6UavOFbQ$n<6Q`0Aw~nU^m% z@2B6d6ohvw%eZQYX?*R8C)2^Sdn19iq%_)hp<36DCaQiK;8r7jFc1>t7tw5Shqc;V~|R-Kp00%j~0=7_H&o zw?7!CqTNfSduh4DVV~wSAFCH?vbSj1^;;>|N37yU2)>D)8fiE0Zt%6;T!ROj4e1|nCUhf!*zBe) zc)fRdZvuIZ~1SBJ2 z6sW?Q4h#%8{VcEbo~=6XWXq?#K?5I+Qk10b7TJ5fyj%gOfU!0+Y0<#;N>daAe-8HAl_tnfS`x$5|d#0V$d~@$)wq$K>Zm4@o zDw|c%u5FYW(0ccO&i-r&O4{_4T*$$2rG~EDpR9Oi`S6GXF)h&kmHM;O>!!Cf%!zJD z49!ovjJ+ZCB1l`mc7k>}S5qma_pbEUP$MiZ@}?0?rriq}Yxc&fkW^yj6F`|6N_A4o z=OFYt*&KHRIOFG6$Ac2rZzIq0Fl*N%#R6BKyF{O&C@>${f3tI9kL)gcV) zw&cALo%){AX|=!TMAR#>zka^Am7AasQtOej-Di@W%jIP?T+&+=EI#GJ9Y$*Vb#Ra5#6>s={j0bfPdUbne@2dVjxpqR*stoshiwr_jeGl&pMqV5zh_C*E~?s-PwQWLo19O%5b zA&HPeF}(YwGF~Dl@x0@jE7p}>z&>qNQF#AIea!?lo!W{HWQAIl)K4jz={g;rh3D&_mq`qgI8Q5Yg-de4Y%N5Zjd)JI;(1rBTR5O`9|uu!Vr%$`|A26|c8j7=eY|a?zpI_SXu@Z#}#BX+&$#&@9RNUy*{3 z;k&hmh#0q1B;GUP2qML(3eRu{2=?0)Dak?OUBP&D*745*-Mk8FXL=;T@0(!rfIzu> z1L^SKSzsdaH~DZN^H8`sJ@i;L6(Kp<`j86kKswA3ASlXb((Xr=dr8#FymB~MMRWQ1 z&)6bCtJO~*t1Vs9U3@7qT zr5&~XY+djf%xX~b$TweSYX8Hc3T$6f&qpPs*KXo2BvI(VkwlIbH8f+as-yTx#`5Jv zGL_9d%H=MDbvuOD8|;M>?!z}iPXgb(%1D8O?J(##ze^;|xky?MO9$B^=s3|(c#-AZ zn=#a|0uET-UwC)~-@oiN(@EU$5x9K`o!vVF!)B|;!f%v>U-QB02waqx#RglhhH3du zXK|p1$A?rw;#VBEd&<^IgAzS|c5tr%8wI&dbJ)>5khpqX^TmqBz>ScFYhJ-=KQ8B) zH(>f;v9X09!f|EfhTodWYbFf=-}DE&2p{Q*hXwtws=Ga0 zoQ5AHEw7#Ijm!B5J#g9x6*Tx+%UmjOwM-BtETIa(UeF0e{<70Kh%-aHz5P8DvhYzZ z9=1bj5TPBCFE{4WB6Ns){8_U^32}DpIso@j#NW(K-i+uI!EL)c9_qYt!Cb9+p{Rwq z2Xt=?N{~$Tj;@eOLh<|tZu%tWcoD=Ls#XQWqZd`^8u~n0^r_qCk>TH8JoTb6mSKSb z0MZEm(QB~&{o+a8*8YGU_Jc+U9M)an07J7OSA8#Qvkr|?O{e~<(Tb)5WphGOYT@mv zm~=C}Bytnz-AKDZBGCswY2lvmP>k2PW?ou##fsfy#f#_BHpxi>n}iXg>w<-7$}!q(dXHA5-SR zeV9Yid6vb2{noP>U9_>pj0fJu&U3bwpz*!hSH0T1{pl2C&q67m=;j{nztr|3BFFAS zbtz+yBv;fL^4!hNV#BrCTNV(FP+1fRVwa$RezS;*ROE_+>@IP-{Zx%3u1o?iKHQQb z2$~lKb&oUd6n8O2m`)X=4*mjkMFoEgx?Ru9q78ur>(ui(K@{nvXAY)rc9H=)f+}TX z)Lm?up#!V&Ig=1B+Kml-@}OWz&Xz80JPkJ?a#V4{L;hlS5g99aW}y>l@D3I0>*`3;VBo_w$J0gE$`crYoU1ZB33 zV4k&ZuMED(LIjtY$?=Y~!AHtM#-w)?bj)>Z-5R394e#uyy zl91n*`Bzy+Tt^daDK$rB3tp6mTP6?|MTY2QIW6Vz&6O4DsDG`OneaXO?cJ;8%2j%>HgAZ0bO(C; zC!2w<+logWW+#ZvwZ`JUSKH&i+B$xMjkZAOlMZAk9`EoIui6+RVGEvmc~_auzSdMRPEH*>qi4zZ=t`xlyZ z`WeRl%5*7U=Bf>+a2UqZxz#44fpc7hh?B+;>ChOMzeBcpr-u2iN_;|=qB^b5DxwC% z*|iQD+!kNx=?(Ncq((EYE^{}_aSE4MC|koe$^IiQCrCQuY18%OP|-xWYP_4&g`zj4 zKtKR1V6l|)aoGHbACL^cSF(B`zIi%F$I88g+l>9GdmE>p zONKY{uEl`2w-*xTv$VwL?0AdhQ&)KCS!e(-*~l!4pgoZ|l)}4$Cy@P#dE8s>LHkOl z(_alo_dd9M_!5bGFSqJWRamo2F39O5US1~LiV@N>8y48SGJgW@>c+qG;kvt=a;F{O zic1kEOCpXQ0SZUIe@US0I>mOEH?FEkqwFPh8wNZQvZU-#MV1D@V_ z$!hnY?OLqG{uV@2UNY)dL+$F=lK5&`5FM!JM>| z4C6LRc2S;%7Y0-urFls}Q0B=xY2M@B`=BE!=(HXsMp8=D&q9vY(lGRHa$kV^m7ptt zZNJu0VFi`=Ih_|?08Ng__e)m@V0J)`I@+O@1K&rF3qs*^yJ6V5ie4XRa!j(^|d z4s5+4}~gzBTt=ZNDEr=?Q1i)=Wp(JBi}CWTk;IHfAxEwqjZ>`jiBu)1+La_9}^o^6Cm#ZxT)>8#s=Cyf zxKE>{OJ0QYV5cuDYrTAx344WG@d|qmGsx1b&oznZYt+e?mB&_3aljp)kMa%4P-mo6rPQSzsD3J#a|JKg zo{f;U&X2K_W9c;7^|Szu~=;DA$YAcW^r04kzBFKM0Mz&tKgfiNc0x#~C^kKFVzev$Q6I zJHX{6**m;oynXFA8Vo%)UDUp#H9l%AUTs@-G4#{Ledc(?nmiLb4VU90dwWz*yOm9J zQFBj-9I@K{0CrC`+}gI4rPVXDnQUk}%bFbRZ=U7_aIRe549>D)j-36%o-=f01jigH ztmFJ#^cXqy$bmm#f3zB*G>b99ohX;QiXOf-M!tI%&mvVs9n}z9T$&^t{)s;Nx2^^y2el0sX1fm97T|3C_yQ6{J z3zH(K>TsJO4dyB-R9RsAX@0R|j0r{9sy=~Ds)%CJGh4wOO9ZhDNF~y$0c-$BStPMH zJbtdYp|@PGIgN(2O{=;*5 zj1Y4~5iF*+=%6n^YDEZZ$Y4>TxxKX;rH%$GV31n9BMTDwiq%biQqBXm}COL;dLS(6FZeS*-NCYn9!Zg;YGZpW9(}m&NzNA%YoKR|jxQGBmHOk2J|--l)fy8w zd1;@%I9jMc$88yt#W)%@eXs?MBV76c{@u)^FHxox0RaH=pa8({!0j)Q&tEm#M)vmB ze;JzQ15)x_A}mGQ9=l)|wIwUTGc z7o)eNT#UN0o34HN*eQdeB;s<%Zv*OJZf;G?7%=NZf^VAevXt|r7!8;I@6GOAy zcE=8I+9{{iJekW78~J_!_=;XfyJZu4O|ZD-Q;y`v2}9d58Vo}DhUkkI)2E(+bGEc? zOK4b;eu;^-Jub1I<|V!O%bY-Wwnnz_76kn#gHU z4z)C^y{@Vt@jDj3of8|!dL5;Y0r?m6^d0o;B-xHR%3JJnu!wRlhT-@-AMC-|Hxqct^P6SjO62T>|M zZYjBVJ$x_E^~v(doJvb3NM3)TCa9?8*Z9ReS>c^uTCAMIFk_zYX{lvQzwUn0le{#@ z2iw{80r&6231m8a{nxy${Ovig|23Tdn!5jUQ2(CB!^vE~lTe7FwMH)hSkgdXBS;C}E;{wPuN(%+*i}<4_eI~vfM};jOY26#i7_&N+iMaI}APIL1)ao2@ z9D8hxn0-uP7`?MfE2M@8FNp8SMDgMBWnU@cdl7XP@3H0Oc44(XfWtar)Xxz$qqIWN z+fx|f?=tpWZPXHJMO~>(ztZDCNyC^%DztPdIb-`T2^ zS-IcO?TCKqxvLd3_47{J2}7uERN-heP;Cnn!154 zmG@h_bETUn#+X4KFKjeAp^O$ZA4(iInM>2F*Z?BvV45G?49|HGqLN4El9&$^-m!`| z^i^77g?b^nA%{$xB=HekAx1jqY+gN;zTkd%#VN86Q7}~lB!SHcF*i0jk^*+{$&9%- z9Sg+inEN&0QX^#2QCzy?oVE^8WZ^*k3zDYS&zAz{&XAw!HuyK;@v=7%6MmU|2etV5 z_Y9ZDj%2=DdXfb0pKGI?Pt*GP?{;WvmhOj>AHKT2zzWhpz^H)#Ec5)`xqp8Ge)snO z7JdGS{!?N3FDw8M05teN(f_5l{1g7C1o0pE_uqg2e+Ux)B=}Q;@?Qikfy9viZS4M+ zAmvY%KWi%gVM+fj8~y(#^MA7ZU19kr%b#i0e^@ri{!f;_ldONT{JG5jhXs-L|77`l z(fudOpV8%iu>=6=GyTo-PptVT^iS9L4|JRL-yG%t0{-D@{sE4#{r8>!m*e>p{HJ02 t2b{|BH~2r8xj%XSG!*~v#B%~|_00D%4dMf`15kGTFi`+tJA<&yva literal 0 HcmV?d00001 diff --git a/docs/sbom/README.md b/docs/sbom/README.md index b09e16c..ba1cf46 100644 --- a/docs/sbom/README.md +++ b/docs/sbom/README.md @@ -1,15 +1,21 @@ -# SBOM — AX HUB MCP Server +# SBOM — AXHUB MCP&Tool Service -- 산출물: `AXHUB_MCP_Server_SBOM_CycloneDX1.5.json` (CycloneDX 1.5 정본), `AXHUB_MCP_Server_SBOM_CycloneDX1.5.xlsx` (검토용) -- 대상: `ax-hub-mcp-server@0.1.0` (Java 21 / Spring Boot 3.5.11) +- 산출물: `AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.json` (CycloneDX 1.5 정본), `AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.xlsx` (검토용) +- 대상: AXHUB MCP Server와 Tool Service의 공통 스택 (Java 21 / Spring Boot 3.5.11) +- 산출 기준 빌드: `ax-hub-mcp-server@0.1.0` - 생성 기준일: 2026-08-18 ## 대상 범위 +MCP Server와 Tool Service는 같은 기술 스택과 같은 MCP SDK를 쓰므로 이 SBOM을 공통으로 적용한다. `build.gradle`이 직접 선언한 오픈소스는 `io.modelcontextprotocol.sdk:mcp-json-jackson2:2.0.0` 하나이며, 이 SBOM은 그 **런타임 전이 의존 전체**와 **빌드 환경**을 담는다. Spring Boot starter 계열(web / validation / data-redis / actuator)은 glow f/w가 제공하는 플랫폼 구성이라 범위 밖이다. +다만 목록은 **MCP Server 빌드(`ax-hub-mcp-server@0.1.0`) 하나에서 산출했다.** Tool Service가 이 +스택 밖의 의존(예: DB 드라이버, 연계 라이브러리)을 추가하면 그만큼은 이 SBOM에 없으므로, 해당 +빌드에서 다시 산출해 합쳐야 한다. + | 구분 | 개수 | 내용 | |---|---|---| | 런타임 의존성 (scope: required) | 12 | 실행 산출물 classpath에 올라가는 라이브러리 | @@ -20,45 +26,20 @@ 공개 의무가 없다. JDK는 toolchain이 `languageVersion = 21`만 고정하고 벤더를 지정하지 않으므로, 실제 배포판이 정해지면 라이선스를 확정해 기재한다. -## 빌드 환경(scope: optional)과 제외 devDependencies의 차이 +## 제외 항목 -둘은 다르다. 혼동하지 않도록 구분해 둔다. +제외 항목과 사유는 엑셀 `Exclusions` 시트가 정본이다. 요약하면 다음과 같다. -- **빌드 환경 (scope: optional)** — BOM에 **수록한다**. JDK 21, Gradle 8.14.3처럼 빌드에 필요하지만 - 실행 산출물에는 들어가지 않는 것들이다. -- **제외 devDependencies** — BOM에 **수록하지 않는다**. Java에서는 `test` scope와 - `annotationProcessor`가 여기 해당한다. 선언 4건이다. +- **test scope와 annotationProcessor** — 선언 4건. 산출물에 포함되지 않는다. - `spring-boot-starter-test`, `com.squareup.okhttp3:mockwebserver:4.12.0`, `org.junit.platform:junit-platform-launcher` (test scope) - `org.springframework.boot:spring-boot-configuration-processor` (annotationProcessor) - -나머지 제외 항목과 사유는 엑셀 `Exclusions` 시트에 있다. 핵심은 세 가지다. - - `joni`, `graal-js`, `graal-sdk` — json-schema-validator의 `optional`. ECMA262 정규식 검증을 쓰지 않아 해석되지 않으므로 약 50MB가 빠진다. - `jakarta.servlet-api:6.1.0` — mcp-core의 `provided`. 산출물에 포함되지 않고 서블릿 컨테이너가 제공한다. - `mcp:2.0.0`(aggregate), `mcp-json-jackson3:2.0.0` — Jackson 3 경로를 쓰지 않아 선언하지 않는다. 자세한 배경은 [mcp-java-sdk-adoption.md](../mcp-java-sdk-adoption.md) 참고. -## 적용된 보안 통제 - -`com.networknt:json-schema-validator`는 schema의 `$ref`가 문서 밖을 가리키면 그 주소로 직접 조회를 -시도한다. `inputSchema`는 Tool Service 매니페스트에서 오므로, 통제가 없으면 매니페스트가 서버의 -outbound 호출 대상을 정하게 된다. - -`ToolSchemaReferencePolicy`가 `ToolMetadata` 생성 시점에 문서 밖 `$ref`·`$dynamicRef`와 2020-12가 아닌 -`$schema`를 거부한다. 근거와 검토한 대안은 -[ADR-0011](../decisions/ADR-0011-tool-input-schema-stays-in-document.md)에 있다. - -정규식도 같은 자리에서 막는다. optional인 `joni`·`graal-js`를 해석하지 않아 `pattern` 검증이 JDK 정규식 -엔진으로 처리되고 백트래킹 폭증이 가능하므로, `ToolSchemaPatternPolicy`가 반복 구조와 수량자 개수, 정규식 -길이를 제한하고 `pattern` 필드에 `maxLength`(≤256) 동반 선언을 요구한다. key 길이를 묶을 자리가 없는 -`patternProperties`는 사용을 금지한다. 규칙은 JDK 21 실측에 근거하며 근거와 한계는 -[ADR-0012](../decisions/ADR-0012-tool-input-schema-pattern-budget.md)에 있다. - -남은 위험은 문자 집합이 겹치면서 무한 수량자가 3개 이하인 정규식이다. 이 조합은 통과하며 `maxLength`가 -256이면 수백 ms가 걸릴 수 있다. 두 통제는 위험을 없애지 않고 측정된 폭증 구간 밖으로 옮긴다. - ## 산출 방법과 한계 버전과 해시는 `build.gradle` 선언에서 출발해 Gradle 로컬 캐시의 실제 `pom`을 따라가 그래프를