spring-boot-demo/sbom

sbom

Companion code for Spring Boot SBOM in Practice: the tools jar-mode sbom Command, CycloneDX and Dependency Scanning.

A small Spring Boot application whose build writes a CycloneDX software bill of materials into the jar, then reads it back three ways: with the new sbom command of the tools jar mode, over HTTP from Actuator, and with a vulnerability scan and a licence check.

Spring Boot 4.2.0-RC1 is a release candidate, not a GA release. The latest GA is 4.1.2. The sbom jar-mode command exists only in the 4.2 line (output/11-jarmode-commands-by-version.txt). Everything else here works on 4.1 as well.

Part	Version
Spring Boot	4.2.0-RC1 (Spring Framework 7.1.0-RC1)
cyclonedx-maven-plugin	2.9.3 (CycloneDX spec 1.6)
JDK	25

Run it

# needs JDK 25, Maven 3.9, python3 and access to api.osv.dev
scripts/run-all.sh           # rebuilds and regenerates every file in output/ (about a minute)
java -Djarmode=tools -jar target/sbom-1.0.0.jar sbom
java -Djarmode=tools -jar target/sbom-1.0.0.jar sbom --destination app.cdx.json

What is where

File	What it does
pom.xml	Boot parent, cyclonedx-maven-plugin writing META-INF/sbom/application.cdx.json, and a vulnerable profile that adds log4j-core 2.14.1 (never ship it)
src/main/resources/application.properties	exposes the sbom Actuator endpoint
src/test/.../ActuatorSbomTest.java	starts the app, calls /actuator/sbom, writes output/05
src/test/.../DefaultExposureTest.java	the endpoint with default exposure, writes output/06
scripts/analyse.py	inspect, compare, licences and scan over a CycloneDX file (standard library only)
scripts/run-all.sh	the build variants and the jar-mode runs
scripts/commands-by-version.sh	lists the jar-mode command classes for 4.1.2 and 4.2.0-RC1

Captured output

Output	Content
output/01-jarmode-help.txt	the command list and help sbom
output/02-no-sbom.txt	a jar built without an SBOM: no manifest attribute, the command fails with exit code 1
output/03-sbom-command.txt	the manifest attributes, the command, --destination, and a check that all three routes give the same bytes
output/04-inspect.txt	what is inside the document
output/05-actuator-sbom.txt	/actuator, /actuator/sbom, /actuator/sbom/application
output/06-actuator-sbom-not-exposed.txt	404 unless the endpoint is exposed
output/07-sbom-against-jar.txt	SBOM components against the jars in BOOT-INF/lib
output/08-licences.txt	licence counts and two checking rules
output/09-osv-scan-clean.txt	the application scanned against OSV
output/10-osv-scan-vulnerable.txt	the vulnerable profile scanned against OSV
output/11-jarmode-commands-by-version.txt	SbomCommand present in 4.2.0-RC1, absent in 4.1.2

Files 09 and 10 depend on the OSV database on the day they were run (the date is on the first line), so they will change over time.