asmhatreandClaude Sonnet 5.5
809272f7dc
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Cfo2K4u4rF18QsPXPFnytf
53 lines
3.1 KiB
Markdown
53 lines
3.1 KiB
Markdown
# sbom
|
|
|
|
Companion code for [Spring Boot SBOM in Practice: the tools jar-mode sbom Command, CycloneDX and Dependency Scanning](https://ankurm.com/spring-boot-sbom-tools-jarmode-cyclonedx-dependency-scanning/).
|
|
|
|
A small Spring Boot application whose build writes a CycloneDX software bill of materials into the jar, then reads it back three ways: with the new `sbom` command of the `tools` jar mode, over HTTP from Actuator, and with a vulnerability scan and a licence check.
|
|
|
|
**Spring Boot 4.2.0-RC1 is a release candidate, not a GA release.** The latest GA is 4.1.2. The `sbom` jar-mode command exists only in the 4.2 line (`output/11-jarmode-commands-by-version.txt`). Everything else here works on 4.1 as well.
|
|
|
|
| Part | Version |
|
|
|---|---|
|
|
| Spring Boot | 4.2.0-RC1 (Spring Framework 7.1.0-RC1) |
|
|
| cyclonedx-maven-plugin | 2.9.3 (CycloneDX spec 1.6) |
|
|
| JDK | 25 |
|
|
|
|
## Run it
|
|
|
|
```
|
|
# needs JDK 25, Maven 3.9, python3 and access to api.osv.dev
|
|
scripts/run-all.sh # rebuilds and regenerates every file in output/ (about a minute)
|
|
java -Djarmode=tools -jar target/sbom-1.0.0.jar sbom
|
|
java -Djarmode=tools -jar target/sbom-1.0.0.jar sbom --destination app.cdx.json
|
|
```
|
|
|
|
## What is where
|
|
|
|
| File | What it does |
|
|
|---|---|
|
|
| `pom.xml` | Boot parent, `cyclonedx-maven-plugin` writing `META-INF/sbom/application.cdx.json`, and a `vulnerable` profile that adds log4j-core 2.14.1 (never ship it) |
|
|
| `src/main/resources/application.properties` | exposes the `sbom` Actuator endpoint |
|
|
| `src/test/.../ActuatorSbomTest.java` | starts the app, calls `/actuator/sbom`, writes `output/05` |
|
|
| `src/test/.../DefaultExposureTest.java` | the endpoint with default exposure, writes `output/06` |
|
|
| `scripts/analyse.py` | `inspect`, `compare`, `licences` and `scan` over a CycloneDX file (standard library only) |
|
|
| `scripts/run-all.sh` | the build variants and the jar-mode runs |
|
|
| `scripts/commands-by-version.sh` | lists the jar-mode command classes for 4.1.2 and 4.2.0-RC1 |
|
|
|
|
## Captured output
|
|
|
|
| Output | Content |
|
|
|---|---|
|
|
| `output/01-jarmode-help.txt` | the command list and `help sbom` |
|
|
| `output/02-no-sbom.txt` | a jar built without an SBOM: no manifest attribute, the command fails with exit code 1 |
|
|
| `output/03-sbom-command.txt` | the manifest attributes, the command, `--destination`, and a check that all three routes give the same bytes |
|
|
| `output/04-inspect.txt` | what is inside the document |
|
|
| `output/05-actuator-sbom.txt` | `/actuator`, `/actuator/sbom`, `/actuator/sbom/application` |
|
|
| `output/06-actuator-sbom-not-exposed.txt` | 404 unless the endpoint is exposed |
|
|
| `output/07-sbom-against-jar.txt` | SBOM components against the jars in `BOOT-INF/lib` |
|
|
| `output/08-licences.txt` | licence counts and two checking rules |
|
|
| `output/09-osv-scan-clean.txt` | the application scanned against OSV |
|
|
| `output/10-osv-scan-vulnerable.txt` | the `vulnerable` profile scanned against OSV |
|
|
| `output/11-jarmode-commands-by-version.txt` | `SbomCommand` present in 4.2.0-RC1, absent in 4.1.2 |
|
|
|
|
Files 09 and 10 depend on the OSV database on the day they were run (the date is on the first line), so they will change over time.
|