asmhatre/spring-boot-demo
1
0
Fork 0
Code Activity

sbom: use the bare cyclonedx plugin declaration that starter-parent configures; outputs unchanged

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf
This commit is contained in:
asmhatre
2026-10-24 18:13:59 +00:00
co-authored by Claude Sonnet 5.5
parent 809272f7dc
commit 93c709c34d
2 changed files with 1 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sbom/README.md
+1 -1
View File
@@ -25,7 +25,7 @@ java -Djarmode=tools -jar target/sbom-1.0.0.jar sbom --destination app.cdx.json
| File | What it does |
|---|---|
| `pom.xml` | Boot parent, `cyclonedx-maven-plugin` writing `META-INF/sbom/application.cdx.json`, and a `vulnerable` profile that adds log4j-core 2.14.1 (never ship it) |
| `pom.xml` | Boot parent, a bare `cyclonedx-maven-plugin` declaration (the parent supplies version, goal and output path, so the build writes `META-INF/sbom/application.cdx.json`), and a `vulnerable` profile that adds log4j-core 2.14.1 (never ship it) |
| `src/main/resources/application.properties` | exposes the `sbom` Actuator endpoint |
| `src/test/.../ActuatorSbomTest.java` | starts the app, calls `/actuator/sbom`, writes `output/05` |
| `src/test/.../DefaultExposureTest.java` | the endpoint with default exposure, writes `output/06` |