Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch '3.3.x'

Browse Source 
Closes gh-42629
This commit is contained in:
Moritz Halbritter
2024-10-14 11:59:26 +02:00
parent d583bde3b0 5754be36f1
commit 4429e847bf
4 changed files with 45 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
spring-boot-project/spring-boot-docs/src/docs/antora/modules/how-to/pages/build.adoc
View File

@@ -87,6 +87,37 @@ Using this format lets the time be parsed into a `Date` and its format, when ser
[[howto.build.generate-cyclonedx-sbom]]
== Generate a CycloneDX SBOM
Both Maven and Gradle allow generating a CycloneDX SBOM at project build time.
For Maven users, the `spring-boot-starter-parent` POM includes a pre-configured plugin to generate the SBOM.
To use it, add the following declaration for the {url-cyclonedx-docs-maven-plugin}[`cyclonedx-maven-plugin`] to your POM:
[source,xml]
----
<build>
<plugins>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
----
Gradle users can achieve the same result by using the {url-cyclonedx-docs-gradle-plugin}[`cyclonedx-gradle-plugin`] plugin, as shown in the following example:
[source,gradle]
----
plugins {
id 'org.cyclonedx.bom' version '1.10.0'
}
----
[[howto.build.customize-dependency-versions]]
== Customize Dependency Versions

27
spring-boot-project/spring-boot-docs/src/docs/antora/modules/reference/pages/actuator/endpoints.adoc
View File

@@ -1275,33 +1275,10 @@ If you reach the `info` endpoint, you should see a response that contains the fo
The `sbom` endpoint exposes the https://en.wikipedia.org/wiki/Software_supply_chain[Software Bill of Materials].
CycloneDX SBOMs can be auto-detected, but other formats can be manually configured, too.
The `spring-boot-starter-parent` Maven parent and the Spring Boot Gradle plugin configure the https://github.com/CycloneDX/cyclonedx-maven-plugin[CycloneDX Maven plugin] and the https://github.com/CycloneDX/cyclonedx-gradle-plugin[CycloneDX Gradle plugin] respectively.
To get a CycloneDX SBOM, you'll need to add this to your Maven build:
[source,xml]
----
<build>
<plugins>
<plugin>
<groupId>org.cyclonedx</groupId>
<artifactId>cyclonedx-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
----
For Gradle, you'll need to apply the CycloneDX Gradle plugin:
[source,groovy]
----
plugins {
id 'org.cyclonedx.bom' version '1.10.0'
}
----
The `sbom` actuator endpoint will then expose an SBOM called "application", which describes the contents of your application.
TIP: To automatically generate a CycloneDX SBOM at project build time, please see the xref:how-to:build.adoc#howto.build.generate-cyclonedx-sbom[] section.
[[actuator.endpoints.sbom.other-formats]]