Add jarmode tools command to print / export the SBOM

[blaghed]

With native images, and starting with GraalVM 23, it is possible to include the SBOM file in the classpath by running the build with --enable-sbom=classpath.
It would be handy to have a standard approach to view/print this SBOM file on demand.

Discussion in #40630 suggests an approach via -Djarmode=tools.
Examples:
my-app -Djarmode=tools sbom
java -Djarmode=tools -jar my-app.jar sbom
java -Djarmode=tools -jar my-app.jar sbom [--destination my-app.sbom.json] (toggle between System.out or a file)

[mhalbritter]

We are also supporting creation of SBOM files via the CycloneDX plugins and could print them, too.

One thing to note here is that Spring Boot application binaries created with native-image don't have the jarmode jar on the classpath - we'd need to invent something else for that.

[xxxxxxjun]

I'd like to pick this up if it's still open for contribution, but a couple of things I'd want to settle before writing any code.

The uber jar side seems clear enough. Packager already writes Sbom-Location and Sbom-Format into the manifest when a CycloneDX SBOM is packaged, so the command can read the location from there and print that entry. Native binaries are the part I don't have an answer for, since they don't go through the loader launcher and never see the jarmode jar.

So:

1. Would a command limited to jars and wars be acceptable for now, with the native image case handled separately?
2. Should it only use the manifest attributes, or also fall back to the locations that the SBOM actuator endpoint auto-detects?
3. Is stdout by default, with an optional --destination, roughly what you had in mind?

Thanks.

[mhalbritter]

Hello,

thanks for your offer!

Would a command limited to jars and wars be acceptable for now, with the native image case handled separately?

jar / war for now is fine.

Should it only use the manifest attributes, or also fall back to the locations that the SBOM actuator endpoint auto-detects?

I'd only use the manifest attributes.

Is stdout by default, with an optional --destination, roughly what you had in mind?

That sounds great.

[mhalbritter]

Superseded by #51505.