asmhatre/spring-boot-demo
1
0
Fork 0
Code Activity

Add sbom module: Spring Boot 4.2.0-RC1 tools jar-mode sbom command, CycloneDX in the jar, Actuator endpoint, licence check and OSV scan

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf
This commit is contained in:
asmhatre
2026-10-24 18:12:28 +00:00
co-authored by Claude Sonnet 5.5
parent 8252cba4c5
commit 809272f7dc
23 changed files with 574 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sbom/pom.xml
+81
View File
@@ -0,0 +1,81 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>4.2.0-RC1</version>
<relativePath/>
</parent>
<groupId>com.ankurm</groupId>
<artifactId>sbom</artifactId>
<version>1.0.0</version>
<name>sbom</name>
<description>Spring Boot SBOMs: the 4.2 tools jar-mode command, CycloneDX, Actuator and scanning</description>
<properties>
<java.version>25</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-webmvc</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<profiles>
<!-- Adds a library with a famous vulnerability so the scanner has something to find. Never ship this. -->
<profile>
<id>vulnerable</id>
<dependencies>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.14.1</version>
</dependency>
</dependencies>
</profile>
</profiles>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
<version>2.9.3</version>
<executions>
<execution>
<phase>generate-resources</phase>
<goals>
<goal>makeAggregateBom</goal>
</goals>
</execution>
</executions>
<configuration>
<outputFormat>json</outputFormat>
<outputName>application.cdx</outputName>
<outputDirectory>${project.build.outputDirectory}/META-INF/sbom</outputDirectory>
<projectType>application</projectType>
</configuration>
</plugin>
</plugins>
</build>
</project>