Add jarmode tools command to print / export the SBOM - #51505
Merged
mhalbritter merged 2 commits intoSep 2, 2026
Merged
Conversation
spring-projects-issues
added
the
status: waiting-for-triage
xxxxxxjun
force-pushed
the
add-jarmode-tools-sbom-command
branch
from
August 29, 2026 18:25
94897a0 to
74ccdfb
Compare
mhalbritter
added
type: enhancement
mhalbritter
changed the title
Contributor
|
Hello @xxxxxxjun , thanks for the PR!
That would be very welcome. Please target Much appreciated! |
xxxxxxjun
force-pushed
the
add-jarmode-tools-sbom-command
branch
from
September 2, 2026 09:45
74ccdfb to
28ecd8f
Compare
Contributor
Author
|
Done – split out as #51540 against The test there uses |
Add an 'sbom' command to the tools jar mode which prints the SBOM packaged in an uber jar or war. The SBOM is located using the Sbom-Location manifest attribute and its bytes are copied verbatim to the console, or to the file given by --destination. See spring-projectsgh-51505 Signed-off-by: Hyeongjun Cho <ryuu.public@gmail.com>
mhalbritter
force-pushed
the
add-jarmode-tools-sbom-command
branch
from
September 2, 2026 14:48
28ecd8f to
e5a24ba
Compare
Contributor
|
Thanks @xxxxxxjun ! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an
sbomcommand to thetoolsjar mode. Given an uber jar or war, it prints the packaged SBOM. Reading that SBOM currently means starting the application and calling the actuator'ssbomendpoint.To find the SBOM, the command reads the
Sbom-Locationmanifest attribute and uses the value as-is: the Gradle plugin already writes theWEB-INF/classes/prefix for wars. The entry at that location is written byte for byte to the console, or to the file given by--destination. Because the output is meant to be piped elsewhere, the command exits with a non-zero code if it can't write to the console.Command failures in the tools jar mode print as a stack trace instead of
Error: <message>. That is a pre-existing bug, now fixed separately in #51540 against4.0.x.Closes #45954