Add sbom module: Spring Boot 4.2.0-RC1 tools jar-mode sbom command, CycloneDX in the jar, Actuator endpoint, licence check and OSV scan

Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf
2026-10-24 18:12:28 +00:00
parent 8252cba4c5
commit 809272f7dc
23 changed files with 574 additions and 0 deletions
@@ -0,0 +1,18 @@
+$ java -Djarmode=tools -jar sbom-1.0.0.jar help
+Usage:
+  java -Djarmode=tools -jar sbom-1.0.0.jar
+
+Available commands:
+  extract      Extract the contents from the jar
+  list-layers  List layers from the jar that can be extracted
+  sbom         Print the SBOM from the jar
+  help         Help about any command
+
+$ java -Djarmode=tools -jar sbom-1.0.0.jar help sbom
+Print the SBOM from the jar
+
+Usage:
+  java -Djarmode=tools -jar sbom-1.0.0.jar sbom [options]
+
+Options:
+  --destination string  File to write the SBOM to. Defaults to printing the SBOM to the console
@@ -0,0 +1,7 @@
+$ unzip -p sbom-without.jar META-INF/MANIFEST.MF | grep -i sbom
+Implementation-Title: sbom
+Start-Class: com.ankurm.sbom.SbomApplication
+$ java -Djarmode=tools -jar sbom-without.jar sbom
+Error: No SBOM found in the jar; the manifest has no 'Sbom-Location' attribute
+
+exit code: 1
@@ -0,0 +1,14 @@
+$ unzip -p sbom-1.0.0.jar META-INF/MANIFEST.MF | grep -i sbom
+Implementation-Title: sbom
+Start-Class: com.ankurm.sbom.SbomApplication
+Sbom-Location: META-INF/sbom/application.cdx.json
+Sbom-Format: CycloneDX
+exit code of 'sbom': 0
+$ java -Djarmode=tools -jar sbom-1.0.0.jar sbom   (first 120 characters)
+{
+  "bomFormat" : "CycloneDX",
+  "specVersion" : "1.6",
+  "serialNumber" : "urn:uuid:268f551b-ceaa-3a72-8f92-245b35596fa
+--destination exit code: 0
+bytes: command 127460, --destination 127460, unzip 127460
+SHA-256 of the three files: 1 distinct value(s)
@@ -0,0 +1,17 @@
+format CycloneDX 1.6, serial urn:uuid:268f...
+lifecycle phase: build
+generated by: org.cyclonedx:cyclonedx-maven-plugin 2.9.3
+describes: application com.ankurm:sbom:1.0.0
+components: 49
+by scope: required 49
+with a hash: 49 of 49
+hash algorithms on the first component: MD5, SHA-1, SHA-256, SHA-512, SHA-384, SHA3-384, SHA3-256, SHA3-512
+with a licence: 49 of 49
+dependency entries: 50
+direct dependencies of the application: 2
+  org.springframework.boot/[email protected]
+  org.springframework.boot/[email protected]
+first three components:
+  pkg:maven/org.springframework.boot/[email protected]
+  pkg:maven/org.springframework.boot/[email protected]
+  pkg:maven/org.springframework.boot/[email protected]
@@ -0,0 +1,6 @@
+GET /actuator              -> links: self, sbom, sbom-id, health, health-path
+GET /actuator/sbom         -> 200 {"ids":["application"]}
+GET /actuator/sbom/application -> 200, content-type application/vnd.cyclonedx+json
+  bomFormat CycloneDX, specVersion 1.6, components 49
+same document as the file the build wrote: true
+GET /actuator/sbom/nope    -> 404
@@ -0,0 +1,2 @@
+management.endpoints.web.exposure.include=health
+GET /actuator/sbom -> 404
@@ -0,0 +1,14 @@
+components in the SBOM: 49
+jars in BOOT-INF/lib:   42
+in both:                41
+in the SBOM but not in the jar:
+  spring-boot-starter-4.2.0-RC1.jar
+  spring-boot-starter-actuator-4.2.0-RC1.jar
+  spring-boot-starter-jackson-4.2.0-RC1.jar
+  spring-boot-starter-logging-4.2.0-RC1.jar
+  spring-boot-starter-micrometer-metrics-4.2.0-RC1.jar
+  spring-boot-starter-tomcat-4.2.0-RC1.jar
+  spring-boot-starter-tomcat-runtime-4.2.0-RC1.jar
+  spring-boot-starter-webmvc-4.2.0-RC1.jar
+in the jar but not in the SBOM:
+  spring-boot-jarmode-tools-4.2.0-RC1.jar
@@ -0,0 +1,17 @@
+licence entries (a component with two licences counts once under each):
+  Apache-2.0                           43
+  EPL-2.0                              3
+  LGPL-2.1-only                        2
+  MIT                                  2
+  GPL-2.0-with-classpath-exception     1
+  CC0-1.0                              1
+  BSD-2-Clause                         1
+
+naive rule 'fail on any GPL or LGPL entry' flags 3: logback-classic, logback-core, jakarta.annotation-api
+rule 'fail only when every listed licence is GPL or LGPL' flags 0
+no licence listed: none
+dual-licensed components (more than one entry):
+  logback-classic: EPL-2.0 / LGPL-2.1-only
+  logback-core: EPL-2.0 / LGPL-2.1-only
+  jakarta.annotation-api: EPL-2.0 / GPL-2.0-with-classpath-exception
+  HdrHistogram: CC0-1.0 / BSD-2-Clause
@@ -0,0 +1,3 @@
+scanned: 2026-10-24
+queried 49 components against api.osv.dev
+components with at least one advisory: 0
@@ -0,0 +1,11 @@
+scanned: 2026-10-24
+queried 50 components against api.osv.dev
+components with at least one advisory: 1
+org.apache.logging.log4j:log4j-core:2.14.1 - 7 advisories
+  GHSA-3pxv-7cmr-fjr4 CVE-2026-34480 fixed in 2.25.4: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped
+  GHSA-6hg6-v5c8-fphq CVE-2026-34477 fixed in 2.25.4: Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS 
+  GHSA-7rjr-3q55-vv33 CVE-2021-45046 fixed in 1.10.8,1.11.11,1.9.2,2.0.12,2.12.2,2.16.0,2.3.1: Incomplete fix for Apache Log4j vulnerability
+  GHSA-8489-44mv-ggj8 CVE-2021-44832 fixed in 1.10.9,1.11.13,1.9.2,2.0.14,2.12.4,2.17.1,2.3.2: Improper Input Validation and Injection in Apache Log4j2
+  GHSA-jfh8-c2jp-5v3q CVE-2021-44228 fixed in 1.10.8,1.11.10,1.9.2,2.0.11,2.12.2,2.15.0,2.3.1: Remote code injection in Log4j
+  GHSA-p6xc-xr62-6r2g CVE-2021-45105 fixed in 1.10.9,1.11.12,1.9.2,2.0.13,2.12.3,2.17.0,2.3.1: Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled
+  GHSA-vc5p-v9hr-52mj CVE-2025-68161 fixed in 2.25.3: Apache Log4j does not verify the TLS hostname in its Socket Appender
@@ -0,0 +1,2 @@
+4.1.2: Command ExtractCommand ExtractLayersCommand HelpCommand ListCommand ListLayersCommand 
+4.2.0-RC1: Command ExtractCommand ExtractLayersCommand HelpCommand ListCommand ListLayersCommand SbomCommand