asmhatre/spring-boot-demo
1
0
Fork 0
Code Activity

Add sbom module: Spring Boot 4.2.0-RC1 tools jar-mode sbom command, CycloneDX in the jar, Actuator endpoint, licence check and OSV scan

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf
This commit is contained in:
asmhatre
2026-10-24 18:12:28 +00:00
co-authored by Claude Sonnet 5.5
parent 8252cba4c5
commit 809272f7dc
23 changed files with 574 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sbom/scripts/run-all.sh
Executable
+58
View File
@@ -0,0 +1,58 @@
#!/usr/bin/env bash
# Regenerates every file in output/. Needs JDK 25, Maven 3.9, python3 and network access to api.osv.dev.
# Spring Boot 4.2.0-RC1 is a release candidate, so the first run downloads it from Maven Central.
set -uo pipefail
cd "$(dirname "$0")/.."
rm -rf output && mkdir output
JAR=target/sbom-1.0.0.jar
TOOLS="java -Djarmode=tools -jar $JAR"
# Tests write 05 and 06 (and need the SBOM the build puts into target/classes).
mvn -B -q clean test >/dev/null 2>&1 || { echo "tests failed"; exit 1; }
# A jar built with SBOM generation switched off.
mvn -B -q clean package -DskipTests -Dcyclonedx.skip=true >/dev/null 2>&1
cp $JAR /tmp/sbom-without.jar
{
echo '$ unzip -p sbom-without.jar META-INF/MANIFEST.MF | grep -i sbom'
unzip -p /tmp/sbom-without.jar META-INF/MANIFEST.MF | grep -i sbom || echo '(no matching line)'
echo '$ java -Djarmode=tools -jar sbom-without.jar sbom'
java -Djarmode=tools -jar /tmp/sbom-without.jar sbom 2>&1
echo "exit code: $?"
} > output/02-no-sbom.txt
# The normal build.
mvn -B -q clean package -DskipTests >/dev/null 2>&1
{
echo '$ java -Djarmode=tools -jar sbom-1.0.0.jar help'
$TOOLS help 2>&1
echo
echo '$ java -Djarmode=tools -jar sbom-1.0.0.jar help sbom'
$TOOLS help sbom 2>&1
} > output/01-jarmode-help.txt
{
echo '$ unzip -p sbom-1.0.0.jar META-INF/MANIFEST.MF | grep -i sbom'
unzip -p $JAR META-INF/MANIFEST.MF | grep -i sbom
$TOOLS sbom > /tmp/from-command.json; echo "exit code of 'sbom': $?"
echo '$ java -Djarmode=tools -jar sbom-1.0.0.jar sbom (first 120 characters)'
head -c 120 /tmp/from-command.json; echo
$TOOLS sbom --destination /tmp/from-destination.json >/dev/null 2>&1; echo "--destination exit code: $?"
unzip -p $JAR META-INF/sbom/application.cdx.json > /tmp/from-zip.json
echo "bytes: command $(wc -c < /tmp/from-command.json), --destination $(wc -c < /tmp/from-destination.json), unzip $(wc -c < /tmp/from-zip.json)"
echo "SHA-256 of the three files: $(sha256sum /tmp/from-command.json /tmp/from-destination.json /tmp/from-zip.json | cut -d' ' -f1 | sort -u | wc -l) distinct value(s)"
} > output/03-sbom-command.txt
bash scripts/commands-by-version.sh > output/11-jarmode-commands-by-version.txt
python3 scripts/analyse.py inspect /tmp/from-command.json > output/04-inspect.txt
python3 scripts/analyse.py compare /tmp/from-command.json $JAR > output/07-sbom-against-jar.txt
python3 scripts/analyse.py licences /tmp/from-command.json > output/08-licences.txt
{ echo "scanned: $(date -u +%Y-%m-%d)"; python3 scripts/analyse.py scan /tmp/from-command.json; } > output/09-osv-scan-clean.txt
# The same build with one old library added.
mvn -B -q clean package -DskipTests -Pvulnerable >/dev/null 2>&1
java -Djarmode=tools -jar $JAR sbom > /tmp/vulnerable.json
{ echo "scanned: $(date -u +%Y-%m-%d)"; python3 scripts/analyse.py scan /tmp/vulnerable.json; } > output/10-osv-scan-vulnerable.txt
mvn -B -q clean package -DskipTests >/dev/null 2>&1
echo "done: $(ls output | wc -l) files in output/"