From 93c709c34d69182c432ab9cdccc0d366700ba2c0 Mon Sep 17 00:00:00 2001
From: asmhatre <asmhatre@gmail.com>
Date: Sat, 24 Oct 2026 18:13:59 +0000
Subject: [PATCH] sbom: use the bare cyclonedx plugin declaration that
 starter-parent configures; outputs unchanged

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf
---
 sbom/README.md |  2 +-
 sbom/pom.xml   | 15 ---------------
 2 files changed, 1 insertion(+), 16 deletions(-)

diff --git a/sbom/README.md b/sbom/README.md
index f6b7d68..2053dec 100644
--- a/sbom/README.md
+++ b/sbom/README.md
@@ -25,7 +25,7 @@ java -Djarmode=tools -jar target/sbom-1.0.0.jar sbom --destination app.cdx.json
 
 | File | What it does |
 |---|---|
-| `pom.xml` | Boot parent, `cyclonedx-maven-plugin` writing `META-INF/sbom/application.cdx.json`, and a `vulnerable` profile that adds log4j-core 2.14.1 (never ship it) |
+| `pom.xml` | Boot parent, a bare `cyclonedx-maven-plugin` declaration (the parent supplies version, goal and output path, so the build writes `META-INF/sbom/application.cdx.json`), and a `vulnerable` profile that adds log4j-core 2.14.1 (never ship it) |
 | `src/main/resources/application.properties` | exposes the `sbom` Actuator endpoint |
 | `src/test/.../ActuatorSbomTest.java` | starts the app, calls `/actuator/sbom`, writes `output/05` |
 | `src/test/.../DefaultExposureTest.java` | the endpoint with default exposure, writes `output/06` |
diff --git a/sbom/pom.xml b/sbom/pom.xml
index 796b641..0069e29 100644
--- a/sbom/pom.xml
+++ b/sbom/pom.xml
@@ -60,21 +60,6 @@
       <plugin>
         <groupId>org.cyclonedx</groupId>
         <artifactId>cyclonedx-maven-plugin</artifactId>
-        <version>2.9.3</version>
-        <executions>
-          <execution>
-            <phase>generate-resources</phase>
-            <goals>
-              <goal>makeAggregateBom</goal>
-            </goals>
-          </execution>
-        </executions>
-        <configuration>
-          <outputFormat>json</outputFormat>
-          <outputName>application.cdx</outputName>
-          <outputDirectory>${project.build.outputDirectory}/META-INF/sbom</outputDirectory>
-          <projectType>application</projectType>
-        </configuration>
       </plugin>
     </plugins>
   </build>